dante-watch 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,58 @@
-# Temporary Holding Version
+# Dante
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Dante watches a server you own — and never lies to itself.**
+
+```
+npx dante-watch                 # check this machine
+npx dante-watch --ssh root@host --key ~/.ssh/id   # check a server you own
+```
+
+Every verdict carries the real line it came from. If Dante cannot read the proof, it says
+`UNBEKANNT` (unknown) — never `safe`. Safe is a thing it proves, not a thing it assumes.
+
+## What Dante sends: nothing
+
+Read the source — it is 19 kB. Dante makes **no network connections of its own**: there is no
+`fetch`, no HTTP, no telemetry, nothing is uploaded anywhere. It imports exactly one Node builtin,
+`node:child_process`, to run local commands. It connects out **only** if you pass `--ssh`, and then
+only to the host you named, with the key you named.
+
+- **No install hooks.** `npm install` runs no scripts. No `postinstall`, nothing executes on install.
+- **No dependencies.** Nothing is pulled in that you did not read.
+- **Every command is shown.** Each verdict prints the exact command it ran and the line it got
+  back, so you can audit every move Dante makes.
+
+If you review packages for a living: this one phones home to no one, and it says so here on purpose.
+Questions: info@nm-streetwear.space.
+
+## Why
+
+In October 2026 the PHP2Shell flaw (CVE-2026-109618 / -109619) put most of the web on the clock,
+and AI agents started hunting unpatched servers within the hour. The honest defence is not a
+scary report — it is a fast, grounded check you can run on your own box and believe.
+
+## How it stays honest
+
+- **Channel first.** Dante proves it can see the target (it must get its own nonce back) before it
+  concludes anything. No channel → everything is unknown.
+- **Every claim shows its line.** A claim without a real command output is printed as a gap, never
+  as proof.
+- **Backports are respected.** A distro patch keeps the old version number but fixes the bug, so a
+  version number alone can never decide. The changelog is the authority; if it can't be read, the
+  answer is unknown.
+- **Read-only (v0.1).** Dante looks and reports. It changes nothing. Fixes come behind a yes/no
+  gate.
+- **Check me against another AI.** If Dante tells you something is open, verify it against an
+  independent model. If that check disagrees, write us: info@nm-streetwear.space.
+
+## Zero dependencies
+
+A security tool with a fat dependency tree is itself a supply-chain risk. Dante ships with none —
+only Node (≥18). You can read all of it.
+
+## Credits
+
+Dante is the pilgrim who walked through Hell and came back with the map — companion to
+[Virgil](https://www.npmjs.com/package/virgil-cli). Built by nm. More coming.
+
+MIT License

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "dante-watch",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Dante watches your own server and never lies to itself: every verdict carries the real line it came from.",
+  "type": "module",
+  "bin": { "dante-watch": "src/cli.mjs" },
+  "files": ["src", "README.md"],
+  "engines": { "node": ">=18" },
+  "license": "MIT",
+  "dependencies": {},
+  "keywords": ["security", "server", "cve", "php", "self-check", "zero-dependencies"]
+}

package/src/checks/demo.mjs

@@ -0,0 +1,24 @@
+// Demo check (only with --demo): a harmless "open door" = a temp file. Lets you watch the whole
+// loop — human-listen → plan → ja/nein → fix → re-prove — without touching anything real.
+import { run, firstLine } from "../core/sh.mjs";
+import { result, evidence, SAFE, RISK } from "../core/check.mjs";
+
+const HOLE = "/tmp/dante-demo-hole";
+
+export const demo = {
+  id: "demo",
+  title: "Demo — eine harmlose offene Tür (Übung)",
+  run() {
+    const ls = run("ls -l " + HOLE + " 2>/dev/null");
+    const open = ls.ran && ls.ok && ls.out.trim().length > 0;
+    if (!open) {
+      return result({ id: this.id, title: this.title, verdict: SAFE,
+        was: "Die Übungs-Tür ist zu.", wie: "Die Datei " + HOLE + " existiert nicht.",
+        wo: "Dieser Rechner.", evidence: [evidence("Keine Übungs-Datei da", { cmd: "ls " + HOLE, line: "(nicht vorhanden)" })] });
+    }
+    return result({ id: this.id, title: this.title, verdict: RISK,
+      was: "Die Übungs-Tür steht offen.", wie: "Die Datei " + HOLE + " ist da.",
+      wo: "Dieser Rechner.", evidence: [evidence("Übungs-Datei existiert", { cmd: "ls -l " + HOLE, line: firstLine(ls.out) })],
+      fix: { why: "Die Übungs-Datei entfernen.", steps: [{ desc: "Datei löschen", script: "rm -f " + HOLE }] } });
+  },
+};

package/src/checks/php2shell.mjs

@@ -0,0 +1,103 @@
+// Check: PHP2Shell (CVE-2026-109618 / CVE-2026-109619), the RCE flaw in the PHP engine.
+// Read-only. The rule that keeps Dante honest here: a distro BACKPORT keeps the old version
+// number but fixes the bug, so the version number alone can never prove "safe" or "risk".
+// The changelog is the authority. If Dante cannot read the changelog, it says UNKNOWN — not RISK.
+import { run, firstLine } from "../core/sh.mjs";
+import { result, evidence, SAFE, WARN, RISK, UNKNOWN } from "../core/check.mjs";
+
+const CVE_RE = "CVE-2026-109618|CVE-2026-109619";
+const FIXED = { 8: { 2: 35, 3: 36, 4: 27, 5: 12 } }; // upstream fixed versions (2026-10-21)
+
+function parseVer(s) {
+  const m = String(s || "").match(/\b(\d+)\.(\d+)\.(\d+)/);
+  return m ? [+m[1], +m[2], +m[3]] : null;
+}
+function upstreamFixed(v) {
+  if (!v) return false;
+  const min = FIXED[v[0]] && FIXED[v[0]][v[1]];
+  if (min == null) return v[0] > 8;
+  return v[2] >= min;
+}
+
+export const php2shell = {
+  id: "php2shell",
+  title: "PHP2Shell — RCE im PHP-Kern (CVE-2026-109618/-619)",
+
+  run() {
+    const ev = [];
+
+    // 1) Is PHP present at all?
+    const cli = run("php -v");
+    const fpm = run("systemctl list-units --type=service --all --no-legend 2>/dev/null | grep -iE 'php[0-9.]*-fpm' | awk '{print $1, $4}'");
+    const anyFpm = fpm.ok && fpm.out.trim().length > 0;
+    const anyCli = cli.ok && /PHP\s+\d/.test(cli.out);
+    if (!anyCli && !anyFpm) {
+      // Only call it SAFE if the "is php here" commands actually RAN. Otherwise we don't know.
+      if (!cli.ran && !fpm.ran) {
+        return result({ id: this.id, title: this.title, verdict: UNKNOWN,
+          was: "Konnte den Server nicht abfragen.", wie: cli.errorMsg || fpm.errorMsg || "Befehle liefen nicht.",
+          wo: "Ziel nicht erreichbar.", evidence: [] });
+      }
+      ev.push(evidence("Kein PHP-CLI", { cmd: "php -v", line: firstLine(cli.err || cli.out) || "command not found" }));
+      ev.push(evidence("Kein PHP-FPM-Dienst", { cmd: "systemctl … grep php-fpm", line: "(keine Treffer)" }));
+      return result({ id: this.id, title: this.title, verdict: SAFE,
+        was: "PHP2Shell betrifft nur Server mit PHP.", wie: "Kein PHP-CLI und kein PHP-FPM-Dienst installiert.",
+        wo: "Dieser Server.", evidence: ev });
+    }
+
+    if (anyCli) {
+      const verLine = firstLine(cli.out);
+      const v = parseVer(verLine);
+      ev.push(evidence("PHP-Version: " + (v ? v.join(".") : verLine), { cmd: "php -v", line: verLine }));
+      if (upstreamFixed(v)) {
+        return result({ id: this.id, title: this.title, verdict: SAFE,
+          was: "PHP ist auf einer upstream-gepatchten Version.", wie: "Version ≥ Fix-Grenze (8.2.35/8.3.36/8.4.27/8.5.12).",
+          wo: "Dieser Server.", evidence: ev });
+      }
+    }
+
+    // 2) The authority: can we read the distro changelog, and does it name the CVE patch?
+    const docs = run("ls /usr/share/doc/php*-common/changelog.* 2>/dev/null");
+    const canReadChangelog = docs.ran && docs.ok && docs.out.trim().length > 0;
+    const chg = run("zcat /usr/share/doc/php*-common/changelog.* 2>/dev/null | grep -iE '" + CVE_RE + "' | head -1");
+
+    if (chg.ran && chg.ok && chg.out.trim()) {
+      ev.push(evidence("Distro-Changelog nennt den CVE-Patch (Backport)", { cmd: "zcat changelog | grep CVE-2026-109618", line: firstLine(chg.out) }));
+      return result({ id: this.id, title: this.title, verdict: SAFE,
+        was: "Der PHP2Shell-Patch ist auf diesem Server belegt.", wie: "Der Distro-Changelog weist den CVE-Patch aus.",
+        wo: "Dieser Server.", evidence: ev });
+    }
+
+    // Not upstream-fixed and no CVE line found. Could we even READ the changelog?
+    if (!canReadChangelog) {
+      ev.push(evidence("Changelog nicht lesbar — Patch-Stand nicht belegbar", { cmd: "ls /usr/share/doc/php*-common/changelog.*", line: firstLine(docs.err || docs.out) || "(keine Datei)" }));
+      return result({ id: this.id, title: this.title, verdict: UNKNOWN,
+        was: "PHP ist da, aber der Patch-Stand war nicht belegbar.",
+        wie: "Versionsnummer allein reicht nicht (Distro-Backports), und der Changelog ließ sich nicht lesen.",
+        wo: "Dieser Server.", evidence: ev,
+        fix: "Patch-Stand von Hand prüfen (Changelog/Advisory) oder PHP aktualisieren und PHP-FPM neu starten." });
+    }
+
+    // Changelog readable, CVE absent, version below fix line → genuinely unpatched. Exposure decides urgency.
+    ev.push(evidence("Changelog gelesen, kein CVE-Patch darin", { cmd: "zcat changelog | grep CVE", line: "(keine Treffer, Datei lesbar)" }));
+    const expose = run("grep -rslE 'fastcgi_pass|\\\\.php' /etc/nginx/sites-enabled/ /etc/apache2/sites-enabled/ 2>/dev/null | head -3");
+    const exposed = expose.ran && expose.ok && expose.out.trim().length > 0;
+    ev.push(evidence(exposed ? "Webserver leitet .php/FastCGI weiter (prüfen: Honeypot oder echt)" : "Keine PHP-Weiterleitung im Webserver gefunden",
+      { cmd: "grep -rl fastcgi_pass sites-enabled", line: exposed ? firstLine(expose.out) : "(keine Treffer)" }));
+
+    const major = (parseVer(firstLine(cli.out)) || [8, 3]).slice(0, 2).join(".");
+    const fpmSvc = anyFpm ? firstLine(fpm.out).split(" ")[0] : ("php" + major + "-fpm");
+    return result({ id: this.id, title: this.title, verdict: exposed ? RISK : WARN,
+      was: exposed ? "PHP ist ungepatcht UND vom Web erreichbar." : "PHP ist ungepatcht, aber nicht offen erreichbar.",
+      wie: "Version unter der Fix-Grenze und kein CVE-Patch im lesbaren Changelog.",
+      wo: "Dieser Server.", evidence: ev,
+      fix: {
+        why: "PHP auf den gepatchten Stand bringen und den laufenden Dienst darauf neu starten.",
+        steps: [
+          { desc: "Paketliste aktualisieren", script: "apt-get update" },
+          { desc: "PHP-Pakete patchen", script: "apt-get install --only-upgrade -y php" + major + "-fpm php" + major + "-cli php" + major + "-common" },
+          { desc: "PHP-FPM neu starten (lädt die gepatchte Version)", script: "systemctl restart " + fpmSvc },
+        ],
+      } });
+  },
+};

package/src/cli.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+// Dante — watches a server you own, never lies to itself, and changes nothing without a yes.
+// It looks and reports with real lines. On a real finding it comes to the foreground, shows its
+// plan (plain words + the exact commands) and asks ja/nein. On yes it acts, then re-proves.
+import { configureTarget, targetLabel, probe, run, firstLine } from "./core/sh.mjs";
+import { renderResult, renderSummary } from "./core/render.mjs";
+import { RISK, WARN, SAFE, UNKNOWN } from "./core/check.mjs";
+import { ask, recordYes } from "./core/consent.mjs";
+import { banner } from "./mascot.mjs";
+import { php2shell } from "./checks/php2shell.mjs";
+import { demo } from "./checks/demo.mjs";
+
+function parseArgs(argv) {
+  const a = { ssh: null, key: null, json: false, yes: false, fix: false, demo: false };
+  for (let i = 0; i < argv.length; i++) {
+    const t = argv[i];
+    if (t === "--ssh") a.ssh = argv[++i];
+    else if (t === "--key") a.key = argv[++i];
+    else if (t === "--json") a.json = true;
+    else if (t === "--yes" || t === "-y") a.yes = true;
+    else if (t === "--fix") a.fix = true;
+    else if (t === "--demo") a.demo = true;
+    else if (t === "--help" || t === "-h") a.help = true;
+  }
+  return a;
+}
+
+const HELP = `Dante — wächter
+
+  npx dante-watch                 prüft diesen Rechner (nur schauen)
+  npx dante-watch --ssh user@host [--key /pfad]   prüft einen Server, der dir gehört
+  --fix        bei einem Fund: Plan zeigen und nach deinem Ja schließen
+  --demo       harmlose Übung: zeigt die ganze Schleife (human → plan → ja/nein → fix → Beweis)
+  --json       Maschinen-Ausgabe
+  -y, --yes    nicht nachfragen (für Automode/Cron)
+
+Dante ändert nichts ohne dein Ja. Jedes Urteil trägt die echte Zeile; fehlt sie, sagt er „unbekannt“, nie „sicher“.`;
+
+const C = (code, s) => (process.stdout.isTTY && !process.env.NO_COLOR ? `\x1b[${code}m${s}\x1b[0m` : s);
+
+async function handleFinding(check, r, a) {
+  // "Human, hör zu" — foreground, plan in words + exact commands, then ja/nein, then re-prove.
+  console.log("\n" + C("41;37", " HUMAN, HÖR ZU ") + " " + C("1", r.title));
+  console.log("  " + C("2", "was:") + " " + r.was);
+  console.log("  " + C("2", "wie:") + " " + r.wie);
+  console.log("  " + C("36", "mein plan:") + " " + r.fix.why);
+  r.fix.steps.forEach((s, i) => {
+    console.log("    " + (i + 1) + ") " + s.desc);
+    console.log("       " + C("2", "$ " + s.script));
+  });
+  // On a real risk, Dante tells you to distrust it (SPEC): check against another AI.
+  console.log("  " + C("33", "prüf das ruhig gegen eine andere KI. Sagt die was anderes — schreib uns: info@nm-streetwear.space"));
+
+  const answer = await ask(check.id, "  Soll ich das ausführen? [ja / nein / (a)utomode] ", { yes: a.yes });
+  if (answer === "no") { console.log("  " + C("2", "nichts geändert.")); return r.verdict; }
+  if (answer === "always") { await recordYes(check.id, { yes: true }); const { grantAutomode } = await import("./core/consent.mjs"); grantAutomode(check.id); }
+
+  for (const s of r.fix.steps) {
+    const res = run(s.script, { timeout: 120000 });
+    const line = firstLine(res.out || res.err) || (res.ok ? "(ok)" : "(fehler)");
+    console.log("  " + (res.ok ? C("32", "✓") : C("31", "✗")) + " " + s.desc + "  " + C("2", "→ " + line));
+    if (!res.ok) { console.log("  " + C("31", "Schritt fehlgeschlagen — ich halte an. Nichts weiter geändert.")); return r.verdict; }
+  }
+  if (answer === "yes") await recordYes(check.id, { yes: a.yes });
+
+  // Re-prove: run the same check again and show the new, real verdict.
+  const after = check.run();
+  console.log("  " + C("2", "nochmal geprüft:"));
+  console.log(renderResult(after).split("\n").map((l) => "  " + l).join("\n"));
+  if (after.verdict === SAFE) console.log("  " + C("42;30", " GESCHLOSSEN ") + " " + C("2", "— mit neuer echter Zeile belegt."));
+  else console.log("  " + C("33", "Noch nicht sicher. Dante behauptet nichts, was die Zeilen nicht hergeben."));
+  return after.verdict;
+}
+
+async function main() {
+  const a = parseArgs(process.argv.slice(2));
+  if (a.help) { console.log(HELP); return; }
+  configureTarget(a.ssh ? { host: a.ssh, key: a.key } : null);
+  const target = targetLabel();
+
+  const ch = probe();
+  if (!ch.reached) {
+    const r = { id: "channel", title: "Kanal zum Ziel", verdict: UNKNOWN, was: "Dante konnte " + target + " nicht sehen.", wie: ch.line, wo: target, evidence: [] };
+    if (a.json) console.log(JSON.stringify({ target, results: [r] }, null, 2));
+    else { console.log(banner()); console.log(renderResult(r)); console.log(renderSummary([r], target) + "\n" + C("2", "Kein Urteil über einen Server, den Dante nicht erreicht.")); }
+    process.exit(1);
+  }
+
+  const checks = [php2shell, ...(a.demo ? [demo] : [])];
+  const results = checks.map((c) => { try { return c.run(); } catch (e) { return { id: c.id, title: c.title, verdict: UNKNOWN, was: "Check brach ab.", wie: String((e && e.message) || e), wo: target, evidence: [] }; } });
+
+  if (a.json) { console.log(JSON.stringify({ target, results }, null, 2)); process.exit(results.some((r) => r.verdict === RISK) ? 2 : 0); }
+
+  console.log(banner());
+  for (const r of results) console.log(renderResult(r));
+  console.log(renderSummary(results, target));
+
+  // Findings with a plan → the consent flow (only with --fix or --demo; otherwise just report).
+  if (a.fix || a.demo) {
+    for (const c of checks) {
+      const r = results.find((x) => x.id === c.id);
+      if (r && (r.verdict === RISK || r.verdict === WARN) && r.fix && r.fix.steps) {
+        await handleFinding(c, r, a);
+      }
+    }
+  } else if (results.some((r) => (r.verdict === RISK || r.verdict === WARN) && r.fix)) {
+    console.log("\n" + C("2", "Dante kann das nach deinem Ja schließen: noch einmal mit ") + "--fix" + C("2", " starten."));
+  }
+  process.exit(results.some((r) => r.verdict === RISK) ? 2 : 0);
+}
+
+main();

package/src/core/check.mjs

@@ -0,0 +1,26 @@
+// The contract that makes Dante unable to lie to itself.
+//
+// A check returns a verdict and a list of EVIDENCE. Every evidence item ties a plain-language
+// claim to the exact command and the raw line it came from. The renderer refuses to print a
+// claim that has no raw line. A check that cannot gather real evidence must return "unknown" —
+// never "safe". Safe is a thing you prove, not a thing you assume.
+
+export const SAFE = "safe";     // proven not vulnerable, with evidence
+export const WARN = "warn";     // partially mitigated / needs a step (e.g. restart)
+export const RISK = "risk";     // proven exposed / vulnerable, with evidence
+export const UNKNOWN = "unknown"; // could not gather real evidence — never claim safety
+
+export function evidence(claim, source) {
+  // source = { cmd, line } — cmd is the real command, line is the real output it produced.
+  const line = (source && source.line != null) ? String(source.line).trim() : "";
+  const cmd = (source && source.cmd) ? String(source.cmd) : "";
+  return { claim: String(claim), cmd, line, grounded: line.length > 0 };
+}
+
+export function result({ id, title, verdict, was, wie, wo, evidence: ev = [], fix = null }) {
+  // Guard: a verdict of SAFE/RISK/WARN must stand on at least one grounded evidence line.
+  const grounded = ev.filter((e) => e.grounded);
+  let v = verdict;
+  if ((v === SAFE || v === RISK || v === WARN) && grounded.length === 0) v = UNKNOWN;
+  return { id, title, verdict: v, was: was || "", wie: wie || "", wo: wo || "", evidence: ev, fix };
+}

package/src/core/consent.mjs

@@ -0,0 +1,47 @@
+// Consent: Dante never changes anything without a yes. It comes to the foreground, shows its plan
+// in plain words AND the exact commands, and waits. A trust count per check-id earns an automode
+// offer after 5 yeses (SPEC). State lives in ~/.dante/trust.json, local to the user.
+import { createInterface } from "node:readline/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+
+const DIR = join(homedir(), ".dante");
+const FILE = join(DIR, "trust.json");
+
+function load() { try { return JSON.parse(readFileSync(FILE, "utf8")); } catch { return {}; } }
+function save(d) { try { mkdirSync(DIR, { recursive: true }); writeFileSync(FILE, JSON.stringify(d, null, 1)); } catch { /* best effort */ } }
+
+export function automodeFor(id) {
+  const d = load();
+  return d[id] && d[id].automode === true;
+}
+
+/** Returns "yes" | "no" | "always". In --yes mode: auto-yes. Honours earned automode. */
+export async function ask(id, question, { yes = false } = {}) {
+  if (yes || automodeFor(id)) return "yes";
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  let answer = "no";
+  try {
+    const raw = (await rl.question(question)).trim().toLowerCase();
+    if (/^(a|immer|always)/.test(raw)) answer = "always";
+    else if (/^(j|y)/.test(raw)) answer = "yes";
+    else answer = "no";
+  } finally { rl.close(); }
+  return answer;
+}
+
+/** Record a yes; after 5, offer automode. Returns true if automode was just granted. */
+export async function recordYes(id, { yes = false } = {}) {
+  const d = load();
+  const e = d[id] || (d[id] = { yes: 0, automode: false });
+  e.yes = (e.yes || 0) + 1;
+  save(d);
+  if (!e.automode && e.yes >= 5 && !yes && !automodeFor(id)) {
+    const a = await ask(id + ":automode-offer", "  Du hast für „" + id + "“ schon " + e.yes + "× ja gesagt. Künftig ohne Nachfrage (Automode)? [ja/nein] ", {});
+    if (a === "yes" || a === "always") { e.automode = true; save(d); return true; }
+  }
+  return false;
+}
+
+export function grantAutomode(id) { const d = load(); d[id] = Object.assign(d[id] || { yes: 0 }, { automode: true }); save(d); }

package/src/core/render.mjs

@@ -0,0 +1,55 @@
+// Render a check result as a Formular: was / wie / wo, a verdict badge, and the Belege.
+// A claim without a real line is never shown as proof — it is marked as a gap.
+import { SAFE, WARN, RISK, UNKNOWN } from "./check.mjs";
+
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const c = (code, s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : s);
+const dim = (s) => c("2", s), bold = (s) => c("1", s);
+
+const BADGE = {
+  [SAFE]: () => c("42;30", " SICHER "),
+  [WARN]: () => c("43;30", " SCHRITT NÖTIG "),
+  [RISK]: () => c("41;37", " OFFEN "),
+  [UNKNOWN]: () => c("100;37", " UNBEKANNT "),
+};
+
+export function renderResult(r) {
+  const lines = [];
+  lines.push("");
+  lines.push((BADGE[r.verdict] || BADGE[UNKNOWN])() + "  " + bold(r.title));
+  if (r.was) lines.push("  " + dim("was:") + " " + r.was);
+  if (r.wie) lines.push("  " + dim("wie:") + " " + r.wie);
+  if (r.wo) lines.push("  " + dim("wo: ") + " " + r.wo);
+  if (r.evidence && r.evidence.length) {
+    lines.push("  " + dim("belege:"));
+    for (const e of r.evidence) {
+      if (e.grounded) {
+        lines.push("    • " + e.claim);
+        lines.push("      " + dim("↳ " + e.cmd + "  →  " + truncate(e.line, 96)));
+      } else {
+        lines.push("    • " + e.claim + "  " + c("33", "(ohne Beleg — nicht als Beweis gewertet)"));
+      }
+    }
+  }
+  if ((r.verdict === RISK || r.verdict === WARN) && r.fix) {
+    const why = typeof r.fix === "string" ? r.fix : (r.fix.why || "Dante kann das schließen.");
+    lines.push("  " + c("36", "vorschlag:") + " " + why + dim("  (Plan + ja/nein mit --fix)"));
+  }
+  return lines.join("\n");
+}
+
+export function renderSummary(results, target) {
+  const n = (v) => results.filter((r) => r.verdict === v).length;
+  const parts = [];
+  if (n(RISK)) parts.push(c("41;37", ` ${n(RISK)} offen `));
+  if (n(WARN)) parts.push(c("43;30", ` ${n(WARN)} Schritt nötig `));
+  if (n(UNKNOWN)) parts.push(c("100;37", ` ${n(UNKNOWN)} unbekannt `));
+  if (n(SAFE)) parts.push(c("42;30", ` ${n(SAFE)} sicher `));
+  return "\n" + bold("Dante · Wache über ") + bold(target) + "\n" + (parts.join("  ") || "keine Checks") +
+    "\n" + dim("Jedes Urteil steht auf einer echten Zeile. Fehlt die Zeile, sagt Dante „unbekannt“, nie „sicher“.");
+}
+
+function truncate(s, n) {
+  s = String(s).replace(/\s+/g, " ");
+  return s.length > n ? s.slice(0, n - 1) + "…" : s;
+}

package/src/core/sh.mjs

@@ -0,0 +1,61 @@
+// sh: the only place a real line enters Dante. Runs a command, captures stdout/stderr/exit.
+// Optionally prefixes with ssh so Dante can look at a remote server the user owns.
+// Nothing here is a model's opinion — it is the machine's own output.
+import { spawnSync } from "node:child_process";
+
+let PREFIX = null; // e.g. ["ssh","-i","/key","root@host"] — set by configureTarget()
+
+export function configureTarget(ssh) {
+  // ssh: null (local) | {host, key?} — we build an argv prefix, never a shell string.
+  if (!ssh) { PREFIX = null; return; }
+  const p = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10"];
+  if (ssh.key) p.push("-i", ssh.key);
+  p.push(ssh.host);
+  PREFIX = p;
+}
+
+export function targetLabel() {
+  return PREFIX ? PREFIX[PREFIX.length - 1] : "localhost";
+}
+
+/**
+ * Run a shell SCRIPT (one string). Locally via `bash -lc <script>`, remotely via `ssh host <script>`
+ * where the remote login shell parses the exact same string — no fragile argv joining.
+ * Returns { cmd, out, err, code, ok, ran }. `ran` = the process actually executed (vs ssh/spawn error).
+ * ok=true only means it exited 0 — the caller decides what the lines mean.
+ */
+export function run(script, { timeout = 15000, input } = {}) {
+  const s = Array.isArray(script) ? script.join(" ") : String(script);
+  const argv = PREFIX ? [...PREFIX, s] : ["bash", "-lc", s];
+  const bin = argv[0];
+  const args = argv.slice(1);
+  const r = spawnSync(bin, args, { encoding: "utf8", timeout, input, maxBuffer: 8 * 1024 * 1024 });
+  const out = (r.stdout || "").trimEnd();
+  const err = (r.stderr || "").trimEnd();
+  return {
+    cmd: s,
+    out,
+    err,
+    code: typeof r.status === "number" ? r.status : (r.error ? -1 : null),
+    ok: r.status === 0,
+    ran: typeof r.status === "number", // process ran and returned an exit code (not an ssh/spawn failure)
+    failed: !!r.error,
+    errorMsg: r.error ? String(r.error.message) : "",
+  };
+}
+
+/**
+ * Prove the channel before concluding anything. Dante must get its own nonce back from the target.
+ * No nonce → the target was never reached, and "nothing found" means nothing. Returns {reached, line}.
+ */
+export function probe() {
+  const nonce = "dnt-" + Math.random().toString(36).slice(2, 10);
+  const r = run("echo " + nonce, { timeout: 12000 });
+  const reached = r.ran && r.ok && r.out.includes(nonce);
+  return { reached, line: reached ? "Kanal bestätigt (" + targetLabel() + ")" : firstLine(r.err || r.errorMsg || r.out) || "keine Antwort" };
+}
+
+/** First non-empty line of a command's output, for a compact Beleg. */
+export function firstLine(s) {
+  return String(s || "").split("\n").map((x) => x.trim()).find(Boolean) || "";
+}

package/src/mascot.mjs

@@ -0,0 +1,54 @@
+// Dante — the pilgrim who walked through Hell and came back with the map.
+// Hand-pixeled sprite, 256-colour half-blocks (two pixel rows per text line). No library.
+// Companion to Virgil's lantern-bearer; Dante wears the red robe and the laurel.
+const PAL = {
+  ".": null, // transparent
+  L: 100, //  laurel (olive green)
+  s: 180, //  skin / face
+  R: 124, //  red robe
+  r: 160, //  robe highlight
+  m: 230, //  the map/scroll he carries back
+  e: 16,  //  eyes / shadow
+};
+// 14 rows × 14 cols → 7 text rows.
+const ART = [
+  "...LL....LL...",
+  "..LLLsssLLL...",
+  "...LsssssL....",
+  "...sseesess...",
+  "...ssssssss...",
+  "....RRRRRR....",
+  "...RRrrrrRR.mm",
+  "..RRrrrrrrRmm.",
+  "..RRrrrrrrRR..",
+  "..RRrrrrrrRR..",
+  "..RRRrrrrRRR..",
+  "..RRRRRRRRRR..",
+  "..RRRR..RRRR..",
+  ".RRRR....RRRR.",
+];
+
+export function danteSprite() {
+  const out = [];
+  const px = (ch) => PAL[ch];
+  for (let y = 0; y < ART.length; y += 2) {
+    let line = "";
+    const top = ART[y], bot = ART[y + 1] || ".".repeat(top.length);
+    for (let x = 0; x < top.length; x++) {
+      const t = px(top[x]), b = px(bot[x]);
+      if (t == null && b == null) line += " ";
+      else if (t != null && b != null) line += `\x1b[38;5;${t};48;5;${b}m▀\x1b[0m`;
+      else if (t != null) line += `\x1b[38;5;${t}m▀\x1b[0m`;
+      else line += `\x1b[38;5;${b}m▄\x1b[0m`;
+    }
+    out.push(line);
+  }
+  return out.join("\n");
+}
+
+export function banner() {
+  const tty = process.stdout.isTTY && !process.env.NO_COLOR;
+  const name = tty ? "\x1b[1mDante\x1b[0m \x1b[2m· wächter · er geht durch die Hölle und bringt die Karte\x1b[0m" : "Dante · wächter";
+  if (!tty) return name;
+  return danteSprite() + "\n" + name;
+}