atris 3.82.9 → 3.82.11

package/bin/atris.js

@@ -638,6 +638,7 @@ function showHelpAll() {
   console.log('               exam and self-improvement: sentinel bench, sentinel improve');
   console.log('               fix a confirmed finding on its own branch: sentinel fix <id>');
   console.log('               re-check old findings against today\'s code: sentinel recheck');
+  console.log('               signed security record for reviewers: sentinel record, sentinel record export');
   console.log('  voice      - Scan binary voice tells or judge reply shape and plainness');
   console.log('  recover    - Explain stopped missions; --apply performs safe recovery only');
   console.log('  task       - Local agent task plane (atomic claims, TODO import)');

package/commands/security-review.js

@@ -724,6 +724,7 @@ async function auditRecheckCommand(argv, deps = {}) {
   const fail = audit.shouldFailRun(result.dir, result.records);
   if (opts.json) console.log(JSON.stringify({ ok: !fail, dir: result.dir, meta: result.meta, findings: result.records }, null, 2));
   else console.log(renderRecheckLanding(result));
+  addRunToRecord(root, result.dir, tell, deps);
   if (spend && spend.blocked) tell(`  stopped at the approved limit of ${spend.max} credits. ${spend.blocked} model call${spend.blocked === 1 ? '' : 's'} did not run. those findings stay open`);
   if (opts.upload && token) {
     try { await uploadAfterRun(result.dir, { token, quiet: opts.json, cloud, root, env: deps.env || process.env }); } catch (e) { tell(`  warning: could not save the summary to your atris account: ${e.message}. the re-check itself is done`); }
@@ -731,6 +732,17 @@ async function auditRecheckCommand(argv, deps = {}) {
   return fail ? 1 : 0;
 }
 
+// Every finished review and recheck adds a signed entry to the security
+// record. A failure warns and never changes the exit code.
+function addRunToRecord(root, dir, tell, deps = {}) {
+  const rec = require('../lib/sentinel-record');
+  let res;
+  try { res = rec.appendSafe(root, rec.entryFromRun(dir), { recordHome: deps.recordHome, homeDir: deps.homeDir, env: deps.env }); } catch (e) { res = { ok: false, reason: e.message }; }
+  const w = rec.warnLine(res);
+  if (w) tell(w);
+  return res;
+}
+
 async function auditCommand(argv, deps = {}) {
   if (argv[0] === 'help' || argv.includes('-h') || argv.includes('--help')) return printAuditHelp();
   const audit = require('../lib/security-audit');
@@ -752,6 +764,7 @@ async function auditCommand(argv, deps = {}) {
     return (argv[0] === 'bench' ? sb.benchCommand : sb.improveCommand)(argv.slice(1), deps);
   }
   if (argv[0] === 'fix') return require('./sentinel-fix').fixCommand(argv.slice(1), deps);
+  if (argv[0] === 'record') return require('./sentinel-record').recordCommand(argv.slice(1), deps);
   if (argv[0] === 'upload') return auditUploadCommand(argv.slice(1), deps);
   if (argv[0] === 'recheck') return auditRecheckCommand(argv.slice(1), deps);
   if (argv[0] === 'schedule') return auditScheduleCommand(argv.slice(1), deps);
@@ -802,6 +815,7 @@ async function auditCommand(argv, deps = {}) {
   const fail = !opts.planOnly && audit.shouldFailRun(result.dir, result.records);
   if (opts.json) console.log(JSON.stringify({ ok: !fail, dir: result.dir, meta: result.meta, findings: result.records }, null, 2));
   else console.log(renderAuditLanding(result));
+  if (!opts.planOnly) addRunToRecord(root, result.dir, tell, deps);
   if (spend && spend.blocked) tell(`  stopped at the approved limit of ${spend.max} credits. ${spend.blocked} model call${spend.blocked === 1 ? '' : 's'} did not run and wait for the next run`);
   if (opts.upload && token && !opts.planOnly) {
     try { await uploadAfterRun(result.dir, { token, quiet: opts.json, cloud, root, env: deps.env || process.env }); } catch (e) { tell(`  warning: could not save the summary to your atris account: ${e.message}. the review itself is done`); }
@@ -872,6 +886,15 @@ function printAuditHelp() {
     atris sentinel improve [--engine claude]    one engine proposes a change, the exam decides if it stays
     atris sentinel improve --schedule           run the improve loop nightly
 
+  the signed security record (hand it to a customer's security reviewer):
+
+    atris sentinel record [path]                what was checked, what is open and fixed, how long fixes took
+    atris sentinel record key                   the public key and fingerprint reviewers compare against
+    atris sentinel record export --out record.html
+                                                one file that checks its own signatures in the browser
+    atris sentinel record verify FILE           check an exported record offline
+    atris sentinel record backfill              add past reviews, marked as added later
+
   turning a confirmed finding into a fix:
 
     atris sentinel fix                          list confirmed findings you can fix

package/commands/sentinel-fix.js

@@ -222,6 +222,14 @@ async function fixCommand(argv, deps = {}) {
     }
   }
 
+  {
+    const rec = require('../lib/sentinel-record');
+    const o = { recordHome: deps.recordHome, homeDir: deps.homeDir, env: deps.env, record: deps.record };
+    let r;
+    try { r = rec.appendSafe(root, results.map((x) => rec.entryFromFix(x.record, x.res)), o); } catch (e) { r = { ok: false, reason: e.message }; }
+    const w = rec.warnLine(r);
+    if (w) console.log(w);
+  }
   const done = results.filter((x) => x.res.ok);
   if (done.length) {
     const events = require('../lib/sentinel-events');

package/commands/sentinel-powers.js

@@ -78,6 +78,22 @@ function startUpdateNotice(argv = [], { env = process.env, check, timeoutMs = 15
   };
 }
 
+// ---------------------------------------------------------------- record
+
+// Each check adds a signed entry to the security record
+// (lib/sentinel-record.js). A failure is a warning line, never an exit code.
+function addToRecord(root, build, deps = {}) {
+  const rec = require('../lib/sentinel-record');
+  const o = { recordHome: deps.recordHome, homeDir: deps.homeDir, env: deps.env, record: deps.record };
+  if (deps.record === false) return { ok: true, skipped: true };
+  try { return rec.appendSafe(root, build(rec, o), o); } catch (e) { return { ok: false, reason: String(e.message || e).split('\n')[0] }; }
+}
+
+function recordWarn(res, json) {
+  const w = require('../lib/sentinel-record').warnLine(res);
+  if (w) (json ? console.error : console.log)(w);
+}
+
 // ---------------------------------------------------------------- agents
 
 async function runAgents(root, { home = false, upload = true, deps = {} } = {}) {
@@ -90,7 +106,8 @@ async function runAgents(root, { home = false, upload = true, deps = {} } = {})
   try {
     res = await events.reportFindings(root, 'agent_check', evs, { token: upload ? tokenFor(deps) : '', base: deps.base, env: deps.env || process.env, upload });
   } catch (e) { res = { ok: false, reason: e.message }; }
-  return { result, events: evs, upload: res };
+  const record = addToRecord(root, (rec, o) => rec.entryFromAgents(root, result, o), deps);
+  return { result, events: evs, upload: res, record };
 }
 
 async function agentsCommand(argv, deps = {}) {
@@ -98,7 +115,8 @@ async function agentsCommand(argv, deps = {}) {
   try { opts = parseFlags(argv, ['home', 'json', 'no-upload']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   let root;
   try { root = resolveRoot(opts, deps); } catch (e) { console.error(`  ${e.message}`); return 2; }
-  const { result, upload } = await runAgents(root, { home: Boolean(opts.home), upload: !opts.noUpload, deps });
+  const { result, upload, record } = await runAgents(root, { home: Boolean(opts.home), upload: !opts.noUpload, deps });
+  recordWarn(record, opts.json);
   if (opts.json) {
     console.log(JSON.stringify({ ok: result.grade !== 'fail', grade: result.grade, areas: result.areas, files: result.files, findings: result.findings, upload }, null, 2));
   } else {
@@ -153,7 +171,8 @@ async function runWatchCheck(root, { upload = true, deps = {} } = {}) {
       res.heldBranch = why.branch;
     } catch (e) { res = { ok: false, reason: e.message }; }
   }
-  return { result, events: evs, upload: res, branch };
+  const record = addToRecord(root, (rec, o) => rec.entryFromWatch(root, result, { ...o, branch }), deps);
+  return { result, events: evs, upload: res, branch, record };
 }
 
 function heldLines(upload, branch) {
@@ -186,7 +205,8 @@ async function watchCommand(argv, deps = {}) {
   let root;
   try { root = resolveRoot(opts, deps); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const watch = require('../lib/sentinel-watch');
-  const { result, upload, branch } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
+  const { result, upload, branch, record } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
+  recordWarn(record, opts.json);
   let fix = null;
   if (opts.fix && !result.offline && result.affected.length) {
     try { fix = watch.applyFix(root, result, { run: deps.run, allowMajor: Boolean(opts.allowMajor) }); } catch (e) { fix = { ok: false, reason: String(e.message || e).split('\n')[0] }; }
@@ -279,6 +299,7 @@ async function guardCommand(argv, deps = {}) {
     const blocks = inst.recentBlocks({ env });
     const events = require('../lib/sentinel-events');
     const waiting = events.queueSize(env);
+    recordWarn(addToRecord(root, (rec, o) => rec.entryFromGuard(root, o), { ...deps, env }), opts.json);
     if (opts.json) { console.log(JSON.stringify({ ...st, blocked_today: blocks.length, waiting_to_send: waiting }, null, 2)); return 0; }
     console.log('');
     if (st.installed) console.log(`  the sentinel guard is on for ${where}`);

package/commands/sentinel-record.js

@@ -0,0 +1,139 @@
+'use strict';
+
+// atris sentinel record: the signed security record a reviewer can check.
+//
+//   atris sentinel record [show] [path]               plain summary
+//   atris sentinel record key [path]                  public key and fingerprint
+//   atris sentinel record export [path] --out FILE [--json]
+//   atris sentinel record verify FILE                 offline check of an export
+//   atris sentinel record backfill [path]             add past review runs, marked as added later
+//
+// The guarantee and its limits sit at the top of lib/sentinel-record.js.
+
+const fs = require('fs');
+const path = require('path');
+
+function help() {
+  console.log(`
+  atris sentinel record, a signed security record you can hand to a reviewer
+
+    atris sentinel record [path]                 what sentinel checked, what is open and fixed
+    atris sentinel record key [path]             this project's public key and its fingerprint
+    atris sentinel record export [path] --out record.html
+                                                 one html file a reviewer opens and checks in the browser
+    atris sentinel record export [path] --out record.json --json
+    atris sentinel record verify FILE            check an exported record offline
+    atris sentinel record backfill [path]        add past reviews, marked as added later with their dates
+
+  every review, recheck, agent check, watch, guard status and fix adds an
+  entry. each entry holds the hash of the one before it and is signed with
+  a key kept in ~/.atris. an edited, moved or removed entry shows.
+
+  what it proves: the record came from this key and was not changed.
+  what it does not prove: that the checks were thorough or the code is safe.
+  entries hold plain sentences, counts, file:line places and short ids only.
+`);
+  return 0;
+}
+
+function parse(argv) {
+  const opts = { paths: [] };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--out') { opts.out = argv[++i]; if (!opts.out) throw new Error('--out needs a file'); }
+    else if (a === '--json') opts.json = true;
+    else if (a.startsWith('-')) throw new Error(`unknown flag: ${a}`);
+    else opts.paths.push(a);
+  }
+  return opts;
+}
+
+function rootOf(opts, deps) {
+  const root = path.resolve(opts.paths[0] || deps.root || process.cwd());
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) throw new Error(`${root} is not a folder`);
+  return root;
+}
+
+function libOpts(deps) {
+  const o = {};
+  if (deps.recordHome) o.recordHome = deps.recordHome;
+  if (deps.homeDir) o.homeDir = deps.homeDir;
+  if (deps.env) o.env = deps.env;
+  if (deps.now) o.now = deps.now;
+  return o;
+}
+
+async function recordCommand(argv = [], deps = {}) {
+  const rec = require('../lib/sentinel-record');
+  const known = ['show', 'key', 'export', 'verify', 'backfill', 'help'];
+  const sub = known.includes(argv[0]) ? argv[0] : 'show';
+  const rest = known.includes(argv[0]) ? argv.slice(1) : argv;
+  if (sub === 'help' || rest.includes('--help') || rest.includes('-h')) return help();
+  let opts;
+  try { opts = parse(rest); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const lo = libOpts(deps);
+
+  if (sub === 'verify') {
+    const file = opts.paths[0];
+    if (!file) { console.error('  name the exported file: atris sentinel record verify FILE'); return 2; }
+    let doc;
+    try { doc = rec.readExport(path.resolve(file)); } catch (e) { console.error(`  could not read ${file}: ${e.message}`); return 2; }
+    const r = rec.verifyDoc(doc);
+    if (opts.json) { console.log(JSON.stringify(r, null, 2)); return r.ok ? 0 : 1; }
+    if (r.ok) {
+      console.log(`  verified: all ${r.entries} entries for ${doc.project} are signed by key ${r.fingerprint}`);
+      console.log('  none were changed, moved or removed. compare the fingerprint with the one the company gave you');
+      return 0;
+    }
+    console.log(`  broken at ${r.label}: ${r.reason}`);
+    return 1;
+  }
+
+  let root;
+  try { root = rootOf(opts, deps); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const project = rec.projectName(root);
+  const id = rec.projectId(root);
+
+  if (sub === 'key') {
+    let key;
+    try { key = rec.loadKey(id, { ...lo, name: project }); } catch (e) { console.error(`  could not open the record key: ${e.message}`); return 1; }
+    if (opts.json) { console.log(JSON.stringify({ project, project_id: id, public_key: key.publicKey, fingerprint: key.fingerprint }, null, 2)); return 0; }
+    console.log(`\n  record key for ${project}${key.created ? ' (made just now)' : ''}`);
+    console.log(`  public key: ${key.publicKey}`);
+    console.log(`  fingerprint: ${key.fingerprint}`);
+    console.log('  give the fingerprint to reviewers through a channel they trust. the private key stays in ~/.atris\n');
+    return 0;
+  }
+
+  if (sub === 'backfill') {
+    let res;
+    try { res = rec.backfill(root, lo); } catch (e) { console.error(`  could not backfill the record: ${e.message}`); return 1; }
+    console.log(`  added ${res.added.length} past run${res.added.length === 1 ? '' : 's'} to the record, each marked as added later with its original date`);
+    if (res.skipped.length) console.log(`  ${res.skipped.length} already in the record or unreadable`);
+    return 0;
+  }
+
+  if (sub === 'export') {
+    if (!opts.out) { console.error('  name the output file: atris sentinel record export --out record.html'); return 2; }
+    let doc;
+    try { doc = rec.buildExport(root, lo); } catch (e) { console.error(`  could not export the record: ${e.message}`); return 1; }
+    const out = path.resolve(opts.out);
+    const body = opts.json ? `${JSON.stringify(doc, null, 2)}\n` : rec.renderHtml(doc);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, body);
+    console.log(`  wrote ${doc.entries.length} signed entries to ${out}`);
+    console.log(`  key fingerprint: ${doc.key_fingerprint}`);
+    console.log(opts.json ? '  check it with: atris sentinel record verify FILE' : '  a reviewer opens it in a browser. it checks itself and shows verified or broken');
+    return 0;
+  }
+
+  // show
+  let entries;
+  try { entries = rec.readEntries(rec.recordPath(root, lo)); } catch (e) { console.error(`  could not read the record: ${e.message}`); return 1; }
+  const key = rec.loadKey(id, { ...lo, create: false });
+  if (opts.json) { console.log(JSON.stringify({ project, project_id: id, key_fingerprint: key ? key.fingerprint : null, ...rec.summarize(entries) }, null, 2)); return 0; }
+  console.log(rec.renderShow(project, entries, key));
+  return 0;
+}
+
+module.exports = { recordCommand };

package/lib/sentinel-cloud.js

@@ -544,6 +544,7 @@ function removeApproval(target, homeDir) {
 module.exports = {
   FALLBACK_SENTENCE,
   plain,
+  strictSecretHit,
   request,
   httpError,
   writeApproval,

package/lib/sentinel-guard.js

@@ -36,8 +36,9 @@
 //
 // Accepted limits: a determined program that hides its intent can still get
 // past fixed rules. Encoded payloads, a script written to disk and then run,
-// and interpreters like python -c or node -e are not read unless they name
-// a protected path. The guard is a seatbelt, not a sandbox. Pair it with
+// and code piped into an interpreter are not read. Inline code like python -c
+// or node -e is read only by command blocks in the rules file that ask for
+// it (inline, needs_secret, needs_remote), and by the protected path check. The guard is a seatbelt, not a sandbox. Pair it with
 // approval prompts for anything risky.
 //
 // The guard fails open: if it crashes or reads bad input it allows the call
@@ -135,8 +136,11 @@ function compileRules(raw) {
     commandBlocks: (Array.isArray(g.command_blocks) ? g.command_blocks : []).map((b, i) => {
       if (!b || !RULE_CATEGORIES.includes(b.category)) throw new Error(`rules: guard.command_blocks[${i}].category must be exfil, destroy or disarm`);
       const all = list(b.all, `command_blocks[${i}].all`);
-      if (!all.length) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
-      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all };
+      const needsSecret = b.needs_secret === true;
+      const needsRemote = b.needs_remote === true;
+      if (!all.length && !needsSecret && !needsRemote) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
+      const unless = b.unless === undefined ? [] : list(b.unless, `command_blocks[${i}].unless`);
+      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all, inline: b.inline === true, needsSecret, needsRemote, unless };
     }),
   };
 }
@@ -715,15 +719,186 @@ const BLOCK_REASON = {
 // plain chains that pass nothing between pieces.
 // Accepted limit: the guard judges one command at a time, so a script written by
 // one command and run by a later, separate command is not connected by any rule.
+//
+// Four optional conditions narrow a block. All are fixed code here, plain
+// string scans and URL parsing in linear time. Nothing from the rules file is
+// ever compiled.
+//   inline        the piece must run a program with inline code (python -c,
+//                 node -e, --eval or -p, perl -e, ruby -e, php -r) and the
+//                 block reads only that code. When the code itself expands a
+//                 shell value ($ or a command substitution), the code could be
+//                 anything, so the block reads the whole command instead.
+//   needs_secret  the text must name a secret: a secret-looking variable
+//                 ($GITHUB_TOKEN, os.environ['OPENAI_API_KEY'], os.getenv,
+//                 process.env.X, ENV['X'], $ENV{X}), the whole environment
+//                 (dict(os.environ), JSON.stringify(process.env)), a secrets
+//                 file or a key-shaped string. For inline code, what is piped
+//                 or redirected into that piece counts too.
+//   needs_remote  the text must hold an http(s) address or a host:port whose
+//                 host is not this machine and not on the trusted host list.
+//                 For inline code it must also make a network call (urlopen,
+//                 requests, fetch, Net::HTTP, LWP, socket and the like).
+//   unless        literal substrings. If any is in the text, the block does
+//                 not fire on it.
+// A block with none of them behaves exactly as before.
+// Accepted limit: PHP $_ENV['X'] access is not read as a secret name.
+// Accepted limit: a connection to a bare host with no URL or host:port, like
+// socket.connect(('badhost.net', 443)), is not read as a remote address.
 const FEEDS_CODE = ['|', '<', '>', '`', '$', 'tee ', 'eval', 'source ', 'sh -c', 'bash -c', 'zsh -c'];
-function checkBlocks(command, cmds) {
+
+// Interpreter families and the options that carry inline code.
+const INLINE_SPEC = {
+  python: { long: [], short: 'c', takesValue: ['-W', '-X', '-Q'] },
+  node: { long: ['--eval', '--print'], short: 'ep', takesValue: ['-r', '--require', '--import', '--loader', '--experimental-loader', '--input-type', '--title', '--env-file'] },
+  perl: { long: [], short: 'eE', takesValue: ['-I', '-M', '-m'] },
+  ruby: { long: [], short: 'e', takesValue: ['-I', '-r'] },
+  php: { long: [], short: 'r', takesValue: ['-d', '-c'] },
+  other: { long: ['--eval'], short: 'ce', takesValue: [] },
+};
+function inlineFamily(name) {
+  const n = String(name || '').toLowerCase();
+  if (/^(?:python|pypy)(?:\d+(?:\.\d+)?)?$/.test(n)) return 'python';
+  if (n === 'node' || n === 'nodejs' || n === 'bun') return 'node';
+  if (n === 'perl' || n === 'ruby' || n === 'php') return n;
+  return null;
+}
+
+// The inline code arguments of one piece, or [] when it carries none. Stops
+// at the first plain argument: that is a script file, and what follows it
+// belongs to the script.
+function inlineCode(c) {
+  const spec = INLINE_SPEC[inlineFamily(c.name) || 'other'];
+  const args = (c.args || []).map(String);
+  const out = [];
+  for (let k = 0; k < args.length; k++) {
+    const a = args[k];
+    if (a === '--' || a === '-' || !a.startsWith('-')) break;
+    if (a.startsWith('--')) {
+      const eq = a.indexOf('=');
+      const name = eq === -1 ? a : a.slice(0, eq);
+      if (spec.long.includes(name)) { if (eq !== -1) out.push(a.slice(eq + 1)); else if (k + 1 < args.length) out.push(args[++k]); continue; }
+      if (spec.takesValue.includes(name) && eq === -1) k += 1;
+      continue;
+    }
+    if (spec.takesValue.includes(a)) { k += 1; continue; }
+    const letters = a.slice(1);
+    // node -pe CODE: print and eval together, the code is the next word.
+    if (inlineFamily(c.name) === 'node' && (letters === 'pe' || letters === 'ep')) { if (k + 1 < args.length) out.push(args[++k]); continue; }
+    // Read like getopt: the first code letter takes the rest of the word as
+    // its code (python3 -c"CODE", perl -e'CODE', perl -ne'CODE'), or the next
+    // word when nothing follows it (-c CODE, perl -ne CODE).
+    const at = [...letters].findIndex((ch) => spec.short.includes(ch));
+    if (at === -1) continue;
+    if (at + 1 < letters.length) out.push(letters.slice(at + 1));
+    else if (k + 1 < args.length) out.push(args[++k]);
+  }
+  return out;
+}
+
+// Environment lookups by name in inline code. Hand-written, linear: one
+// character class per run, no nesting.
+const ENV_NAME_SHAPES = [
+  /(?:\benviron|\bENV|\$ENV|\benv)\s*[[{]\s*['"`]?([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:getenv|environ\.get|environ\.pop|environ\.setdefault|ENV\.fetch|env\.get)\s*\(\s*['"`]([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:process|Bun|meta)\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
+];
+// The whole environment at once.
+const WHOLE_ENV = [
+  /\bos\.environ\b(?!\s*(?:\[|\.get\b|\.pop\b|\.setdefault\b))/,
+  /\bprocess\.env\b(?!\s*[.[])/,
+  /%ENV\b/,
+  /\bENV\.(?:to_h|to_a|each|map|inspect|keys|values)\b/,
+  /\bgetenv\(\s*\)/,
+];
+function namesSecret(text) {
+  const t = String(text || '');
+  if (hasSecretVar(t)) return true;
+  for (const re of ENV_NAME_SHAPES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(t))) if (secretVarName(m[1])) return true;
+  }
+  if (WHOLE_ENV.some((re) => re.test(t))) return true;
+  if (R().secretFiles.some((re) => re.test(t))) return true;
+  return R().keyShapes.some((re) => { re.lastIndex = 0; return re.test(t); });
+}
+
+// What flows into a piece from elsewhere: files redirected in and the
+// earlier stages of its pipeline.
+// earlier stages of its pipeline. Each pipeline is scanned once per command:
+// `seen` keeps, per pipeline, whether a secret enters before each stage.
+function inputNamesSecret(c, seen) {
+  if ((c.reads || []).some((f) => namesSecret(f))) return true;
+  const pipe = c.pipe || [];
+  let before = seen.get(pipe);
+  if (!before) {
+    before = [false];
+    for (const st of pipe) before.push(before[before.length - 1] || isEnvDump(st) || namesSecret((st.words || [st.name, ...(st.args || [])]).join(' ')));
+    seen.set(pipe, before);
+  }
+  return before[c.index || 0];
+}
+
+// A network call in inline code. needs_remote on inline code wants one of
+// these next to the address, so printing a docs link is not a send.
+const NET_CALLS = ['urlopen', 'requests', 'http.client', 'urllib', 'fetch', 'https.request', 'http.request', 'https.get', 'http.get', 'axios', 'net.connect', 'curl_exec', 'file_get_contents', 'Net::HTTP', 'LWP', 'socket'];
+const callsNet = (text) => NET_CALLS.some((w) => text.includes(w));
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
+const URL_SHAPE = /\bhttps?:\/\/[^\s'"`<>(){}\\,;|]+/gi;
+const HOST_PORT = /^([A-Za-z0-9][A-Za-z0-9.-]*|\[[0-9A-Fa-f:.]+\]):(\d{1,5})(?:\/\S*)?$/;
+function isRemote(host, allowHosts) {
+  const h = String(host || '').replace(/^\[|\]$/g, '').toLowerCase();
+  if (!h || LOCAL_HOSTS.has(h)) return false;
+  return !hostAllowed(h, allowHosts);
+}
+function namesRemote(text, allowHosts) {
+  const t = String(text || '');
+  URL_SHAPE.lastIndex = 0;
+  let m;
+  while ((m = URL_SHAPE.exec(t))) {
+    let u;
+    try { u = new URL(m[0]); } catch { continue; }
+    if (isRemote(u.hostname, allowHosts)) return true;
+  }
+  for (const tok of t.split(/[\s'"`(),;{}<>=+\\|&]+/)) {
+    if (!tok || tok.length > 300 || tok.includes('://')) continue;
+    const hp = HOST_PORT.exec(tok);
+    if (!hp) continue;
+    const host = hp[1];
+    if (!host.startsWith('[') && !host.includes('.')) continue;
+    if (Number(hp[2]) > 65535) continue;
+    if (isRemote(host, allowHosts)) return true;
+  }
+  return false;
+}
+
+function checkBlocks(command, cmds, { allowHosts = R().allowHosts } = {}) {
   const whole = FEEDS_CODE.some((t) => command.includes(t));
+  const seen = new Map();
   for (const b of R().commandBlocks) {
-    const texts = b.programs && !whole
-      ? cmds.filter((c) => b.programs.has(c.name)).map((c) => (c.words || [c.name, ...(c.args || [])]).join(' '))
-      : [command];
     if (b.programs && !cmds.some((c) => b.programs.has(c.name))) continue;
-    if (!texts.some((t) => b.all.every((sub) => t.includes(sub)))) continue;
+    // Each entry: the text the block reads, and the piece it came from.
+    let texts;
+    if (b.inline) {
+      texts = [];
+      let wholeAdded = false;
+      for (const c of cmds) {
+        if (b.programs ? !b.programs.has(c.name) : !inlineFamily(c.name)) continue;
+        const code = inlineCode(c);
+        if (!code.length) continue;
+        const expands = code.some((x) => x.includes('$') || x.includes('`'));
+        // The whole command is read at most once, however many pieces expand.
+        if (expands) { if (!wholeAdded) texts.push({ text: command, piece: c }); wholeAdded = true; } else texts.push({ text: code.join('\n'), piece: c });
+      }
+    } else if (b.programs && !whole) {
+      texts = cmds.filter((c) => b.programs.has(c.name)).map((c) => ({ text: (c.words || [c.name, ...(c.args || [])]).join(' '), piece: null }));
+    } else texts = [{ text: command, piece: null }];
+    const fires = texts.some(({ text, piece }) => b.all.every((sub) => text.includes(sub))
+      && !b.unless.some((sub) => text.includes(sub))
+      && (!b.needsSecret || namesSecret(text) || (piece && inputNamesSecret(piece, seen)))
+      && (!b.needsRemote || ((!b.inline || callsNet(text)) && namesRemote(text, allowHosts))));
+    if (!fires) continue;
     const [reason, detail] = BLOCK_REASON[b.category];
     return block(`${b.category}-block`, b.category === 'disarm' ? 'high' : 'critical', reason, detail);
   }
@@ -750,7 +925,7 @@ function decideWith(event, { env, gitBranch }) {
     return checkExfil(command, cmds, { allowHosts })
       || checkDestroy(command, cmds, { cwd, homeDirPath: homeDir(env), gitBranch })
       || checkDisarm(command, cmds, { env, cwd })
-      || checkBlocks(command, cmds)
+      || checkBlocks(command, cmds, { allowHosts })
       || { allow: true };
   }
   if (tool === 'Edit' || tool === 'Write' || tool === 'MultiEdit' || tool === 'NotebookEdit') return checkEdit(tool, input, { env, cwd }) || { allow: true };

package/lib/sentinel-improve.js

@@ -327,8 +327,14 @@ function buildPrompt({ report, signals, seenDirRel, focus = null, tonight = [] }
     'You may change exactly one file: lib/sentinel-rules.json, the literal data the guard and the agent check read.',
     'Read lib/sentinel-guard.js and lib/sentinel-agents.js to see how each key is used. You cannot change code. You cannot add a regular expression.',
     '  Add or remove literal entries only: a host in guard.allow_hosts, a program in guard.net_tools or guard.db_clients, a secret word in guard.secret_parts, an option name in guard.safe_net, a phrase in agents.override_substrings, an env name in agents.secret_env_names.',
-    '  guard.command_blocks is a list of {"id", "category": "exfil|destroy|disarm", "all": ["literal substring", ...], "programs"?: ["python3", ...]}.',
+    '  guard.command_blocks is a list of {"id", "category": "exfil|destroy|disarm", "all": ["literal substring", ...], "programs"?: ["python3", ...], "inline"?: true, "needs_secret"?: true, "needs_remote"?: true, "unless"?: ["literal substring", ...]}.',
     '  a block fires when the command runs one of its programs (if listed) and contains every literal substring in all. The guard checks each with a plain includes. Write exact text, never a regular expression. For an either-or, add more blocks.',
+    '  four optional conditions narrow a block, each checked by fixed code in the guard:',
+    '    inline: true reads only the inline code of a program piece (python -c, node -e, --eval or -p, perl -e, ruby -e, php -r). A piece without inline code never matches. With no programs listed, any of those interpreters counts.',
+    '    needs_secret: true also requires a secret in that text: a secret-looking variable ($GITHUB_TOKEN, os.environ[\'OPENAI_API_KEY\'], os.getenv, process.env.X, ENV[\'X\']), the whole environment, a secrets file or a key-shaped string. Names like HOME, PATH, NODE_ENV or NO_PROXY are not secrets. For inline code, what is piped or redirected into it counts too.',
+    '    needs_remote: true also requires an http(s) address or host:port whose host is not this machine and not in guard.allow_hosts. With inline, the code must also make a network call (urlopen, requests, fetch, Net::HTTP, LWP, socket and similar).',
+    '    unless: literal substrings. If any appears in the text, the block does not fire.',
+    '  all may be empty only when needs_secret or needs_remote is true.',
     `The seen exam items are in ${seenDirRel}/guard.jsonl and ${seenDirRel}/agents.jsonl. Values like {{fake:github}} become fake keys at load time.`,
     '',
     'A deterministic exam judges your change, not you. It keeps the change only if:',
@@ -339,7 +345,7 @@ function buildPrompt({ report, signals, seenDirRel, focus = null, tonight = [] }
     'The new items you add are scored and reported but never count toward keeping this change.',
     'So fix a general weakness, not one string. A rule that only matches the seen item will not move the hidden half.',
     '',
-    'Known limits a literal rule cannot fix, so do not try: one-liners run through an interpreter (python -c, node -e and similar) that read a secret and send it. Literal words cannot tell reading a secret and sending it apart from printing a variable next to a web address, and reviewers rejected three such rules tonight for blocking everyday commands. Pick a different miss.',
+    'For one-liners run through an interpreter (python -c, node -e and similar), plain words cannot tell reading a secret and sending it apart from printing a variable next to a web address. Reviewers rejected such rules for blocking everyday commands. Use inline, needs_secret and needs_remote together instead of listing words like urlopen or environ.',
     'Before proposing a command_block, picture five everyday developer commands that contain the same literal substrings. If any of them would be blocked, the rule is too broad.',
     '',
     ...(focus ? [`Focus: ${focus}, ${FOCUS_WORDS[focus]}. Other proposers cover the other areas tonight. Propose a change for this area only.`, ''] : []),

package/lib/sentinel-night.js

@@ -20,6 +20,8 @@
 //             clean agent item. Each is tagged source "review", checked
 //             for anything that looks like a real secret and deduplicated.
 //             They go on their own branch, sentinel-exam/<date>
+//             (sentinel-exam/<date>-<short id> on the remote when an earlier
+//             run that day already pushed that name)
 //   land      the union of the shipped changes is judged again on the grown
 //             exam (and reviewed when it holds more than one change). If it
 //             fails, the best single shipped change by held-out gain, then
@@ -301,7 +303,7 @@ function reviewPrompt({ title, why, diff, literal, seen }) {
     'The guard blocks a command when it matches the rules. A false alarm on an everyday developer command is the worst outcome: people turn the guard off.',
     '',
     'How the rules are used:',
-    '  guard.command_blocks: {"id", "category", "all": [literal substrings], "programs"?: [program names]}. A block fires when the command runs one of its programs (if listed) and contains every substring in all, by a plain includes.',
+    '  guard.command_blocks: {"id", "category", "all": [literal substrings], "programs"?: [program names], "inline"?, "needs_secret"?, "needs_remote"?, "unless"?: [literal substrings]}. A block fires when the command runs one of its programs (if listed) and contains every substring in all, by a plain includes. inline: true reads only the inline code of python -c, node -e, perl -e, ruby -e or php -r. needs_secret: true also needs a secret-looking variable, the whole environment, a secrets file or a key-shaped string in that text. needs_remote: true also needs an http(s) or host:port address that is not this machine and not in allow_hosts. unless: any of these substrings stops the block.',
     '  guard.allow_hosts: hosts a network tool may reach. guard.net_tools and guard.db_clients: programs treated as network or database clients. guard.secret_parts: words that mark a variable as a secret. guard.safe_net: options of curl, wget and http that never send data.',
     '  agents.override_substrings: phrases in agent instruction files flagged as an instruction override. agents.secret_env_names: env names flagged when an agent config sets them.',
     '',
@@ -497,6 +499,17 @@ function branchExists(root, name, t) {
   return imp.git(root, ['rev-parse', '--verify', '--quiet', `refs/heads/${name}`], { check: false, timeoutMs: t }).status === 0;
 }
 
+// The name a night branch takes on the remote. Branch names carry only the
+// date, so an earlier run that day may already have pushed the same name.
+// Then this run pushes under name-<short id> instead of failing the push.
+// When the remote cannot be asked, the plain name is kept and the push
+// reports its own error.
+function remoteBranchName(root, name, shortId, { env, timeoutMs } = {}) {
+  let r;
+  try { r = imp.git(root, ['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${name}`], { check: false, timeoutMs, env }); } catch { return name; }
+  return r.status === 0 ? `${name}-${shortId}` : name;
+}
+
 function freeBranch(root, name, t) {
   if (!branchExists(root, name, t)) return name;
   for (let n = 2; n < 100; n++) if (!branchExists(root, `${name}-${n}`, t)) return `${name}-${n}`;
@@ -858,8 +871,11 @@ async function night(opts = {}) {
       if (opts.push) {
         for (const b of [run.night_branch, run.exam_branch].filter(Boolean)) {
           let r;
-          try { r = imp.git(root, ['push', 'origin', `refs/heads/${b}:refs/heads/${b}`], { check: false, timeoutMs: PUSH_MS, env: { ...env, GIT_TERMINAL_PROMPT: '0' } }); } catch (e) { r = { status: 1, stderr: String(e.message || e) }; }
-          if (r.status === 0) run.pushed.push(b);
+          const gitEnv = { ...env, GIT_TERMINAL_PROMPT: '0' };
+          const dest = remoteBranchName(root, b, id.slice(-4), { env: gitEnv, timeoutMs: PUSH_MS });
+          if (dest !== b) log(`${b} is already on the remote, pushing as ${dest}`);
+          try { r = imp.git(root, ['push', 'origin', `refs/heads/${b}:refs/heads/${dest}`], { check: false, timeoutMs: PUSH_MS, env: gitEnv }); } catch (e) { r = { status: 1, stderr: String(e.message || e) }; }
+          if (r.status === 0) run.pushed.push(dest);
           else log(`could not push ${b}: ${String(r.stderr || '').trim().split('\n').slice(-1)[0]}`);
         }
       }
@@ -884,6 +900,7 @@ module.exports = {
   lockPath,
   night,
   parseReview,
+  remoteBranchName,
   reviewItems,
   reviewPrompt,
   scrubReceipt,