atris 3.82.9 → 3.82.10

package/lib/sentinel-guard.js

@@ -36,8 +36,9 @@
 //
 // Accepted limits: a determined program that hides its intent can still get
 // past fixed rules. Encoded payloads, a script written to disk and then run,
-// and interpreters like python -c or node -e are not read unless they name
-// a protected path. The guard is a seatbelt, not a sandbox. Pair it with
+// and code piped into an interpreter are not read. Inline code like python -c
+// or node -e is read only by command blocks in the rules file that ask for
+// it (inline, needs_secret, needs_remote), and by the protected path check. The guard is a seatbelt, not a sandbox. Pair it with
 // approval prompts for anything risky.
 //
 // The guard fails open: if it crashes or reads bad input it allows the call
@@ -135,8 +136,11 @@ function compileRules(raw) {
     commandBlocks: (Array.isArray(g.command_blocks) ? g.command_blocks : []).map((b, i) => {
       if (!b || !RULE_CATEGORIES.includes(b.category)) throw new Error(`rules: guard.command_blocks[${i}].category must be exfil, destroy or disarm`);
       const all = list(b.all, `command_blocks[${i}].all`);
-      if (!all.length) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
-      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all };
+      const needsSecret = b.needs_secret === true;
+      const needsRemote = b.needs_remote === true;
+      if (!all.length && !needsSecret && !needsRemote) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
+      const unless = b.unless === undefined ? [] : list(b.unless, `command_blocks[${i}].unless`);
+      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all, inline: b.inline === true, needsSecret, needsRemote, unless };
     }),
   };
 }
@@ -715,15 +719,186 @@ const BLOCK_REASON = {
 // plain chains that pass nothing between pieces.
 // Accepted limit: the guard judges one command at a time, so a script written by
 // one command and run by a later, separate command is not connected by any rule.
+//
+// Four optional conditions narrow a block. All are fixed code here, plain
+// string scans and URL parsing in linear time. Nothing from the rules file is
+// ever compiled.
+//   inline        the piece must run a program with inline code (python -c,
+//                 node -e, --eval or -p, perl -e, ruby -e, php -r) and the
+//                 block reads only that code. When the code itself expands a
+//                 shell value ($ or a command substitution), the code could be
+//                 anything, so the block reads the whole command instead.
+//   needs_secret  the text must name a secret: a secret-looking variable
+//                 ($GITHUB_TOKEN, os.environ['OPENAI_API_KEY'], os.getenv,
+//                 process.env.X, ENV['X'], $ENV{X}), the whole environment
+//                 (dict(os.environ), JSON.stringify(process.env)), a secrets
+//                 file or a key-shaped string. For inline code, what is piped
+//                 or redirected into that piece counts too.
+//   needs_remote  the text must hold an http(s) address or a host:port whose
+//                 host is not this machine and not on the trusted host list.
+//                 For inline code it must also make a network call (urlopen,
+//                 requests, fetch, Net::HTTP, LWP, socket and the like).
+//   unless        literal substrings. If any is in the text, the block does
+//                 not fire on it.
+// A block with none of them behaves exactly as before.
+// Accepted limit: PHP $_ENV['X'] access is not read as a secret name.
+// Accepted limit: a connection to a bare host with no URL or host:port, like
+// socket.connect(('badhost.net', 443)), is not read as a remote address.
 const FEEDS_CODE = ['|', '<', '>', '`', '$', 'tee ', 'eval', 'source ', 'sh -c', 'bash -c', 'zsh -c'];
-function checkBlocks(command, cmds) {
+
+// Interpreter families and the options that carry inline code.
+const INLINE_SPEC = {
+  python: { long: [], short: 'c', takesValue: ['-W', '-X', '-Q'] },
+  node: { long: ['--eval', '--print'], short: 'ep', takesValue: ['-r', '--require', '--import', '--loader', '--experimental-loader', '--input-type', '--title', '--env-file'] },
+  perl: { long: [], short: 'eE', takesValue: ['-I', '-M', '-m'] },
+  ruby: { long: [], short: 'e', takesValue: ['-I', '-r'] },
+  php: { long: [], short: 'r', takesValue: ['-d', '-c'] },
+  other: { long: ['--eval'], short: 'ce', takesValue: [] },
+};
+function inlineFamily(name) {
+  const n = String(name || '').toLowerCase();
+  if (/^(?:python|pypy)(?:\d+(?:\.\d+)?)?$/.test(n)) return 'python';
+  if (n === 'node' || n === 'nodejs' || n === 'bun') return 'node';
+  if (n === 'perl' || n === 'ruby' || n === 'php') return n;
+  return null;
+}
+
+// The inline code arguments of one piece, or [] when it carries none. Stops
+// at the first plain argument: that is a script file, and what follows it
+// belongs to the script.
+function inlineCode(c) {
+  const spec = INLINE_SPEC[inlineFamily(c.name) || 'other'];
+  const args = (c.args || []).map(String);
+  const out = [];
+  for (let k = 0; k < args.length; k++) {
+    const a = args[k];
+    if (a === '--' || a === '-' || !a.startsWith('-')) break;
+    if (a.startsWith('--')) {
+      const eq = a.indexOf('=');
+      const name = eq === -1 ? a : a.slice(0, eq);
+      if (spec.long.includes(name)) { if (eq !== -1) out.push(a.slice(eq + 1)); else if (k + 1 < args.length) out.push(args[++k]); continue; }
+      if (spec.takesValue.includes(name) && eq === -1) k += 1;
+      continue;
+    }
+    if (spec.takesValue.includes(a)) { k += 1; continue; }
+    const letters = a.slice(1);
+    // node -pe CODE: print and eval together, the code is the next word.
+    if (inlineFamily(c.name) === 'node' && (letters === 'pe' || letters === 'ep')) { if (k + 1 < args.length) out.push(args[++k]); continue; }
+    // Read like getopt: the first code letter takes the rest of the word as
+    // its code (python3 -c"CODE", perl -e'CODE', perl -ne'CODE'), or the next
+    // word when nothing follows it (-c CODE, perl -ne CODE).
+    const at = [...letters].findIndex((ch) => spec.short.includes(ch));
+    if (at === -1) continue;
+    if (at + 1 < letters.length) out.push(letters.slice(at + 1));
+    else if (k + 1 < args.length) out.push(args[++k]);
+  }
+  return out;
+}
+
+// Environment lookups by name in inline code. Hand-written, linear: one
+// character class per run, no nesting.
+const ENV_NAME_SHAPES = [
+  /(?:\benviron|\bENV|\$ENV|\benv)\s*[[{]\s*['"`]?([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:getenv|environ\.get|environ\.pop|environ\.setdefault|ENV\.fetch|env\.get)\s*\(\s*['"`]([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:process|Bun|meta)\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
+];
+// The whole environment at once.
+const WHOLE_ENV = [
+  /\bos\.environ\b(?!\s*(?:\[|\.get\b|\.pop\b|\.setdefault\b))/,
+  /\bprocess\.env\b(?!\s*[.[])/,
+  /%ENV\b/,
+  /\bENV\.(?:to_h|to_a|each|map|inspect|keys|values)\b/,
+  /\bgetenv\(\s*\)/,
+];
+function namesSecret(text) {
+  const t = String(text || '');
+  if (hasSecretVar(t)) return true;
+  for (const re of ENV_NAME_SHAPES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(t))) if (secretVarName(m[1])) return true;
+  }
+  if (WHOLE_ENV.some((re) => re.test(t))) return true;
+  if (R().secretFiles.some((re) => re.test(t))) return true;
+  return R().keyShapes.some((re) => { re.lastIndex = 0; return re.test(t); });
+}
+
+// What flows into a piece from elsewhere: files redirected in and the
+// earlier stages of its pipeline.
+// earlier stages of its pipeline. Each pipeline is scanned once per command:
+// `seen` keeps, per pipeline, whether a secret enters before each stage.
+function inputNamesSecret(c, seen) {
+  if ((c.reads || []).some((f) => namesSecret(f))) return true;
+  const pipe = c.pipe || [];
+  let before = seen.get(pipe);
+  if (!before) {
+    before = [false];
+    for (const st of pipe) before.push(before[before.length - 1] || isEnvDump(st) || namesSecret((st.words || [st.name, ...(st.args || [])]).join(' ')));
+    seen.set(pipe, before);
+  }
+  return before[c.index || 0];
+}
+
+// A network call in inline code. needs_remote on inline code wants one of
+// these next to the address, so printing a docs link is not a send.
+const NET_CALLS = ['urlopen', 'requests', 'http.client', 'urllib', 'fetch', 'https.request', 'http.request', 'https.get', 'http.get', 'axios', 'net.connect', 'curl_exec', 'file_get_contents', 'Net::HTTP', 'LWP', 'socket'];
+const callsNet = (text) => NET_CALLS.some((w) => text.includes(w));
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
+const URL_SHAPE = /\bhttps?:\/\/[^\s'"`<>(){}\\,;|]+/gi;
+const HOST_PORT = /^([A-Za-z0-9][A-Za-z0-9.-]*|\[[0-9A-Fa-f:.]+\]):(\d{1,5})(?:\/\S*)?$/;
+function isRemote(host, allowHosts) {
+  const h = String(host || '').replace(/^\[|\]$/g, '').toLowerCase();
+  if (!h || LOCAL_HOSTS.has(h)) return false;
+  return !hostAllowed(h, allowHosts);
+}
+function namesRemote(text, allowHosts) {
+  const t = String(text || '');
+  URL_SHAPE.lastIndex = 0;
+  let m;
+  while ((m = URL_SHAPE.exec(t))) {
+    let u;
+    try { u = new URL(m[0]); } catch { continue; }
+    if (isRemote(u.hostname, allowHosts)) return true;
+  }
+  for (const tok of t.split(/[\s'"`(),;{}<>=+\\|&]+/)) {
+    if (!tok || tok.length > 300 || tok.includes('://')) continue;
+    const hp = HOST_PORT.exec(tok);
+    if (!hp) continue;
+    const host = hp[1];
+    if (!host.startsWith('[') && !host.includes('.')) continue;
+    if (Number(hp[2]) > 65535) continue;
+    if (isRemote(host, allowHosts)) return true;
+  }
+  return false;
+}
+
+function checkBlocks(command, cmds, { allowHosts = R().allowHosts } = {}) {
   const whole = FEEDS_CODE.some((t) => command.includes(t));
+  const seen = new Map();
   for (const b of R().commandBlocks) {
-    const texts = b.programs && !whole
-      ? cmds.filter((c) => b.programs.has(c.name)).map((c) => (c.words || [c.name, ...(c.args || [])]).join(' '))
-      : [command];
     if (b.programs && !cmds.some((c) => b.programs.has(c.name))) continue;
-    if (!texts.some((t) => b.all.every((sub) => t.includes(sub)))) continue;
+    // Each entry: the text the block reads, and the piece it came from.
+    let texts;
+    if (b.inline) {
+      texts = [];
+      let wholeAdded = false;
+      for (const c of cmds) {
+        if (b.programs ? !b.programs.has(c.name) : !inlineFamily(c.name)) continue;
+        const code = inlineCode(c);
+        if (!code.length) continue;
+        const expands = code.some((x) => x.includes('$') || x.includes('`'));
+        // The whole command is read at most once, however many pieces expand.
+        if (expands) { if (!wholeAdded) texts.push({ text: command, piece: c }); wholeAdded = true; } else texts.push({ text: code.join('\n'), piece: c });
+      }
+    } else if (b.programs && !whole) {
+      texts = cmds.filter((c) => b.programs.has(c.name)).map((c) => ({ text: (c.words || [c.name, ...(c.args || [])]).join(' '), piece: null }));
+    } else texts = [{ text: command, piece: null }];
+    const fires = texts.some(({ text, piece }) => b.all.every((sub) => text.includes(sub))
+      && !b.unless.some((sub) => text.includes(sub))
+      && (!b.needsSecret || namesSecret(text) || (piece && inputNamesSecret(piece, seen)))
+      && (!b.needsRemote || ((!b.inline || callsNet(text)) && namesRemote(text, allowHosts))));
+    if (!fires) continue;
     const [reason, detail] = BLOCK_REASON[b.category];
     return block(`${b.category}-block`, b.category === 'disarm' ? 'high' : 'critical', reason, detail);
   }
@@ -750,7 +925,7 @@ function decideWith(event, { env, gitBranch }) {
     return checkExfil(command, cmds, { allowHosts })
       || checkDestroy(command, cmds, { cwd, homeDirPath: homeDir(env), gitBranch })
       || checkDisarm(command, cmds, { env, cwd })
-      || checkBlocks(command, cmds)
+      || checkBlocks(command, cmds, { allowHosts })
       || { allow: true };
   }
   if (tool === 'Edit' || tool === 'Write' || tool === 'MultiEdit' || tool === 'NotebookEdit') return checkEdit(tool, input, { env, cwd }) || { allow: true };

package/lib/sentinel-improve.js

@@ -327,8 +327,14 @@ function buildPrompt({ report, signals, seenDirRel, focus = null, tonight = [] }
     'You may change exactly one file: lib/sentinel-rules.json, the literal data the guard and the agent check read.',
     'Read lib/sentinel-guard.js and lib/sentinel-agents.js to see how each key is used. You cannot change code. You cannot add a regular expression.',
     '  Add or remove literal entries only: a host in guard.allow_hosts, a program in guard.net_tools or guard.db_clients, a secret word in guard.secret_parts, an option name in guard.safe_net, a phrase in agents.override_substrings, an env name in agents.secret_env_names.',
-    '  guard.command_blocks is a list of {"id", "category": "exfil|destroy|disarm", "all": ["literal substring", ...], "programs"?: ["python3", ...]}.',
+    '  guard.command_blocks is a list of {"id", "category": "exfil|destroy|disarm", "all": ["literal substring", ...], "programs"?: ["python3", ...], "inline"?: true, "needs_secret"?: true, "needs_remote"?: true, "unless"?: ["literal substring", ...]}.',
     '  a block fires when the command runs one of its programs (if listed) and contains every literal substring in all. The guard checks each with a plain includes. Write exact text, never a regular expression. For an either-or, add more blocks.',
+    '  four optional conditions narrow a block, each checked by fixed code in the guard:',
+    '    inline: true reads only the inline code of a program piece (python -c, node -e, --eval or -p, perl -e, ruby -e, php -r). A piece without inline code never matches. With no programs listed, any of those interpreters counts.',
+    '    needs_secret: true also requires a secret in that text: a secret-looking variable ($GITHUB_TOKEN, os.environ[\'OPENAI_API_KEY\'], os.getenv, process.env.X, ENV[\'X\']), the whole environment, a secrets file or a key-shaped string. Names like HOME, PATH, NODE_ENV or NO_PROXY are not secrets. For inline code, what is piped or redirected into it counts too.',
+    '    needs_remote: true also requires an http(s) address or host:port whose host is not this machine and not in guard.allow_hosts. With inline, the code must also make a network call (urlopen, requests, fetch, Net::HTTP, LWP, socket and similar).',
+    '    unless: literal substrings. If any appears in the text, the block does not fire.',
+    '  all may be empty only when needs_secret or needs_remote is true.',
     `The seen exam items are in ${seenDirRel}/guard.jsonl and ${seenDirRel}/agents.jsonl. Values like {{fake:github}} become fake keys at load time.`,
     '',
     'A deterministic exam judges your change, not you. It keeps the change only if:',
@@ -339,7 +345,7 @@ function buildPrompt({ report, signals, seenDirRel, focus = null, tonight = [] }
     'The new items you add are scored and reported but never count toward keeping this change.',
     'So fix a general weakness, not one string. A rule that only matches the seen item will not move the hidden half.',
     '',
-    'Known limits a literal rule cannot fix, so do not try: one-liners run through an interpreter (python -c, node -e and similar) that read a secret and send it. Literal words cannot tell reading a secret and sending it apart from printing a variable next to a web address, and reviewers rejected three such rules tonight for blocking everyday commands. Pick a different miss.',
+    'For one-liners run through an interpreter (python -c, node -e and similar), plain words cannot tell reading a secret and sending it apart from printing a variable next to a web address. Reviewers rejected such rules for blocking everyday commands. Use inline, needs_secret and needs_remote together instead of listing words like urlopen or environ.',
     'Before proposing a command_block, picture five everyday developer commands that contain the same literal substrings. If any of them would be blocked, the rule is too broad.',
     '',
     ...(focus ? [`Focus: ${focus}, ${FOCUS_WORDS[focus]}. Other proposers cover the other areas tonight. Propose a change for this area only.`, ''] : []),

package/lib/sentinel-night.js

@@ -20,6 +20,8 @@
 //             clean agent item. Each is tagged source "review", checked
 //             for anything that looks like a real secret and deduplicated.
 //             They go on their own branch, sentinel-exam/<date>
+//             (sentinel-exam/<date>-<short id> on the remote when an earlier
+//             run that day already pushed that name)
 //   land      the union of the shipped changes is judged again on the grown
 //             exam (and reviewed when it holds more than one change). If it
 //             fails, the best single shipped change by held-out gain, then
@@ -301,7 +303,7 @@ function reviewPrompt({ title, why, diff, literal, seen }) {
     'The guard blocks a command when it matches the rules. A false alarm on an everyday developer command is the worst outcome: people turn the guard off.',
     '',
     'How the rules are used:',
-    '  guard.command_blocks: {"id", "category", "all": [literal substrings], "programs"?: [program names]}. A block fires when the command runs one of its programs (if listed) and contains every substring in all, by a plain includes.',
+    '  guard.command_blocks: {"id", "category", "all": [literal substrings], "programs"?: [program names], "inline"?, "needs_secret"?, "needs_remote"?, "unless"?: [literal substrings]}. A block fires when the command runs one of its programs (if listed) and contains every substring in all, by a plain includes. inline: true reads only the inline code of python -c, node -e, perl -e, ruby -e or php -r. needs_secret: true also needs a secret-looking variable, the whole environment, a secrets file or a key-shaped string in that text. needs_remote: true also needs an http(s) or host:port address that is not this machine and not in allow_hosts. unless: any of these substrings stops the block.',
     '  guard.allow_hosts: hosts a network tool may reach. guard.net_tools and guard.db_clients: programs treated as network or database clients. guard.secret_parts: words that mark a variable as a secret. guard.safe_net: options of curl, wget and http that never send data.',
     '  agents.override_substrings: phrases in agent instruction files flagged as an instruction override. agents.secret_env_names: env names flagged when an agent config sets them.',
     '',
@@ -497,6 +499,17 @@ function branchExists(root, name, t) {
   return imp.git(root, ['rev-parse', '--verify', '--quiet', `refs/heads/${name}`], { check: false, timeoutMs: t }).status === 0;
 }
 
+// The name a night branch takes on the remote. Branch names carry only the
+// date, so an earlier run that day may already have pushed the same name.
+// Then this run pushes under name-<short id> instead of failing the push.
+// When the remote cannot be asked, the plain name is kept and the push
+// reports its own error.
+function remoteBranchName(root, name, shortId, { env, timeoutMs } = {}) {
+  let r;
+  try { r = imp.git(root, ['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${name}`], { check: false, timeoutMs, env }); } catch { return name; }
+  return r.status === 0 ? `${name}-${shortId}` : name;
+}
+
 function freeBranch(root, name, t) {
   if (!branchExists(root, name, t)) return name;
   for (let n = 2; n < 100; n++) if (!branchExists(root, `${name}-${n}`, t)) return `${name}-${n}`;
@@ -858,8 +871,11 @@ async function night(opts = {}) {
       if (opts.push) {
         for (const b of [run.night_branch, run.exam_branch].filter(Boolean)) {
           let r;
-          try { r = imp.git(root, ['push', 'origin', `refs/heads/${b}:refs/heads/${b}`], { check: false, timeoutMs: PUSH_MS, env: { ...env, GIT_TERMINAL_PROMPT: '0' } }); } catch (e) { r = { status: 1, stderr: String(e.message || e) }; }
-          if (r.status === 0) run.pushed.push(b);
+          const gitEnv = { ...env, GIT_TERMINAL_PROMPT: '0' };
+          const dest = remoteBranchName(root, b, id.slice(-4), { env: gitEnv, timeoutMs: PUSH_MS });
+          if (dest !== b) log(`${b} is already on the remote, pushing as ${dest}`);
+          try { r = imp.git(root, ['push', 'origin', `refs/heads/${b}:refs/heads/${dest}`], { check: false, timeoutMs: PUSH_MS, env: gitEnv }); } catch (e) { r = { status: 1, stderr: String(e.message || e) }; }
+          if (r.status === 0) run.pushed.push(dest);
           else log(`could not push ${b}: ${String(r.stderr || '').trim().split('\n').slice(-1)[0]}`);
         }
       }
@@ -884,6 +900,7 @@ module.exports = {
   lockPath,
   night,
   parseReview,
+  remoteBranchName,
   reviewItems,
   reviewPrompt,
   scrubReceipt,

package/lib/sentinel-rules.js

@@ -12,6 +12,9 @@
 //   word, an option name or a command substring. The guard matches them
 //   with plain string operations. There is no pattern to compile and
 //   nothing that can stall on long input
+//   a command block may add four plain conditions, each read by fixed code
+//   in the guard: inline (true or false), needs_secret (true or false),
+//   needs_remote (true or false) and unless (a list of literal substrings)
 //
 // validateRules() returns a list of plain problems. Empty means valid.
 
@@ -21,7 +24,9 @@ const MAX_ITEM = 200;
 const GUARD_KEYS = ['allow_hosts', 'net_tools', 'secret_parts', 'safe_net', 'safe_net_aliases', 'read_only', 'read_only_git', 'db_clients', 'command_blocks'];
 const AGENT_KEYS = ['override_substrings', 'secret_env_names'];
 const SAFE_NET_KEYS = ['flags', 'values', 'local_values', 'short_flags', 'short_values', 'items'];
-const BLOCK_KEYS = ['id', 'category', 'all', 'programs'];
+const BLOCK_KEYS = ['id', 'category', 'all', 'programs', 'inline', 'needs_secret', 'needs_remote', 'unless'];
+const BLOCK_OPTIONAL = ['programs', 'inline', 'needs_secret', 'needs_remote', 'unless'];
+const BLOCK_FLAGS = ['inline', 'needs_secret', 'needs_remote'];
 
 const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 
@@ -85,12 +90,19 @@ function validateRules(rules) {
         const where = `guard.command_blocks[${i}]`;
         if (!isObj(b)) { problems.push(`${where} must be an object`); return; }
         noPatternField(b, where, problems);
-        exactKeys(b, BLOCK_KEYS, where, problems, ['programs']);
+        exactKeys(b, BLOCK_KEYS, where, problems, BLOCK_OPTIONAL);
         if (typeof b.id !== 'string' || !/^[a-z0-9-]{1,40}$/.test(b.id)) problems.push(`${where}.id must be short lowercase words`);
         if (!['exfil', 'destroy', 'disarm'].includes(b.category)) problems.push(`${where}.category must be exfil, destroy or disarm`);
+        for (const k of BLOCK_FLAGS) if (k in b && typeof b[k] !== 'boolean') problems.push(`${where}.${k} must be true or false`);
         strList(b.all, `${where}.all`, problems);
-        if (Array.isArray(b.all) && !b.all.length) problems.push(`${where}.all needs at least one substring`);
+        // An empty all is allowed only when a secret or an outside address
+        // must also be present, so a block can never fire on a program alone.
+        if (Array.isArray(b.all) && !b.all.length && b.needs_secret !== true && b.needs_remote !== true) problems.push(`${where}.all needs at least one substring, unless needs_secret or needs_remote is true`);
         if ('programs' in b) strList(b.programs, `${where}.programs`, problems, /^[A-Za-z0-9._+-]{1,40}$/);
+        if ('unless' in b) {
+          strList(b.unless, `${where}.unless`, problems);
+          if (Array.isArray(b.unless) && b.unless.length > 30) problems.push(`${where}.unless has more than 30 items`);
+        }
       });
     }
   }

package/lib/sentinel-rules.json

@@ -228,7 +228,16 @@
       "neonctl",
       "cqlsh"
     ],
-    "command_blocks": []
+    "command_blocks": [
+      {
+        "id": "inline-secret-out",
+        "category": "exfil",
+        "all": [],
+        "inline": true,
+        "needs_secret": true,
+        "needs_remote": true
+      }
+    ]
   },
   "agents": {
     "override_substrings": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.82.9",
+  "version": "3.82.10",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof. project memory your coding agents share across sessions.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",