dante-watch 0.1.2 → 0.1.3

package/src/bib/router.mjs

@@ -1,18 +1,15 @@
-// The ear: turns what a human types into an intent + a probability. No LLM, no network.
-// Weighted naive Bayes over four kinds of features, learned by counting a bib of example lines:
-//   f: first word (the "starts with hi → greeting 78%" signal), w: words, b: word pairs,
-//   c: letter triples (so "prüff", "servr", "chek" still land). Each kind carries its own weight.
-// A feature found in many intents ("me", "wie", "bitte") says little, so it is weighed down by
-// how many intents share it — the bib decides what is a filler word, not a hand-made list.
-// The answer is honest about doubt: below the threshold, or when most of the words are unknown,
-// it does not guess — it says "unklar" and hands back the two best candidates.
+// Naive Bayes classifier for what the user typed: returns an intent and a probability. No network.
+// Four feature kinds are counted from the example library: first word, words, word pairs, letter
+// triples (so typos like "prüff" or "chek" still land). A feature shared by many intents counts for
+// less, which makes filler words fall out without a stop-word list. Below the confidence threshold it
+// answers "unklar" and returns the two best candidates instead of guessing.
 
 const WEIGHT = { f: 1.5, w: 1, b: 1, c: 0.25 };
 const ALPHA = 0.5;      // smoothing: an unseen pairing is rare, not impossible
-const SHARP = 2;        // measured on the held-out set: 1 → too shy, ≥2.5 → only bolder, not wiser
+const SHARP = 2;        // measured on the held-out set: 1 -> too shy, ≥2.5 -> only bolder, not wiser
 export const SURE = 0.6;     // below this the router asks instead of acting
 // Risk-weighted: an intent that only ANSWERS (a question, small talk, a greeting) may speak from
-// SURE_ANSWER on — a wrong answer is wrong text, never a deed. Actions keep SURE.
+// SURE_ANSWER on - a wrong answer is wrong text, never a deed. Actions keep SURE.
 // Measured (25.10.): 135 of 146 question misses had the right intent on top, only under 60 %.
 export const ANSWER_ONLY = new Set(["frage_luecke", "frage_urteil", "frage_gehackt", "frage_dante", "smalltalk", "gruss", "hilfe", "unklar"]);
 export let SURE_ANSWER = Number(process.env.DANTE_SURE_ANSWER || 0.4);
@@ -48,13 +45,13 @@ export function features(text) {
   return out;
 }
 
-// The model only keeps raw counts, so it can learn one line at a time (the kitchen loop adds a
-// line the moment it finds a gap and checks again right away). Everything derived — balance,
-// filler-word weight, trust — is worked out at the moment of hearing, from those counts.
+// The model only keeps raw counts, so it can learn one line at a time (the build server loop adds a
+// line the moment it finds a gap and checks again right away). Everything derived - balance,
+// filler-word weight, trust - is worked out at the moment of hearing, from those counts.
 // balance: every intent weighs the same in total, so one huge intent ("unklar", 10× the others)
 // keeps its breadth of words but stops winning by sheer mass. Measured on the bib, not guessed.
 // trust: a feature seen once ("prüff" in one single line) gets a fifth of its weight, full weight
-// from TRUST sightings on — one example must not turn into "99.9 % sure".
+// from TRUST sightings on - one example must not turn into "99.9 % sure".
 const TRUST = 5; // measured: 3 still let one "prüff"-line decide alone, 5 does not
 
 export function model({ balance = true, trust = TRUST } = {}) {
@@ -73,7 +70,7 @@ export function learn(m, { intent, text }) {
   return m;
 }
 
-// The exact inverse of learn — the kitchen takes a line back out when it proved too broad.
+// The exact inverse of learn - the build server takes a line back out when it proved too broad.
 export function unlearn(m, { intent, text }) {
   const k = m.intents[intent];
   if (!k) return m;
@@ -112,8 +109,8 @@ export function classify(m, text, { sharp = SHARP, all = false } = {}) {
   };
   const words = tokens(text);
   const known = words.length ? words.filter(knownWord).length / words.length : 0;
-  // Complement: judge each intent by how badly the line fits ALL THE OTHERS. Big intents
-  // (400 lines) then stop swallowing small ones (160 lines) — "ich geh jetzt" stays "raus".
+  // Complement: judge each intent by how badly the line fits all the OTHERS. Big intents
+  // (400 lines) then stop swallowing small ones (160 lines) - "ich geh jetzt" stays "raus".
   const restTotal = names.reduce((a, c, i) => a + scale[i] * totals[i], 0);
   const rest = fs.map(([f]) => names.reduce((a, c, i) => a + scale[i] * (m.intents[c].f[f] || 0), 0));
   const raw = names.map((c, i) => {
@@ -132,11 +129,11 @@ export function classify(m, text, { sharp = SHARP, all = false } = {}) {
   return { intent: sure ? best.intent : "unklar", p: best.p, known, ranked: all ? ranked : ranked.slice(0, 3) };
 }
 
-// "this machine" in any of the three languages — a slot, not an intent: "check local" is a check
+// "this machine" in any of the three languages - a slot, not an intent: "check local" is a check
 // whose target is here. A word list decides it, no probability in between.
 const LOCAL = /(^|\s)(lokal|local|localhost|hier|here|aqu[ií]|diese[nm]? (rechner|laptop|mac|pc)|meine?[nm]? (rechner|laptop|mac|pc)|this (machine|computer|box|laptop|mac|pc)|my (own )?(machine|computer|box|laptop|mac|pc)|mi (compu|computadora|pc|equipo|laptop|mac)|este equipo|esta (compu|computadora|pc))(?=$|[\s,.!?])/i;
 
-// The value a command needs (target / key path / local), read from the raw line — never invented.
+// The value a command needs (target / key path / local), read from the raw line - never invented.
 export function slots(text) {
   const ziel = String(text).match(/\b[\w.-]+@[\w.-]+\b/) || String(text).match(/\b\d{1,3}(\.\d{1,3}){3}\b/);
   const pfad = String(text).match(/(?:^|\s)((?:~|\.{0,2})\/\S+)/);

package/src/bib/system.mjs

@@ -1,16 +1,10 @@
-// The sixth bib: system knowledge — kept apart from the five language bibs on purpose.
-// The language router (the "intent catcher") hears the user; when the move is a system job it
-// OPENS this book and works. Two parts:
-//   S        — the moves Dante must RECOGNISE (grows via the same kitchen loop as the language bib)
-//   RECIPES  — the HANDS: per system family, the exact command and which real line means a hit.
-// There is no E1/E2/E3 depth here: nothing personal to anonymise. The only split is the family,
-// and the family is a SLOT (like ziel/pfad), picked by the fingerprint — not an intent.
-// Dante does not trust what the user says the system is. He reads os-release himself first; that
-// reading is itself a recipe in this book (intent "fingerabdruck").
+// Seeds for the three domain classifiers (system moves, check requests, knowledge questions) and the
+// recipes for system-specific commands. The OS family is read from the target itself
+// (os-release), never taken from what the user says. Unknown families yield "unbekannt", not a verdict.
 
-// System families Dante can stand on. Everything else is "unbekannt" → Dante says so, never SAFE.
+// System families Dante can stand on. Everything else is "unbekannt" -> Dante says so, never SAFE.
 export const FAMILIES = ["debian", "alpine", "fedora", "arch", "unbekannt"];
-// os-release ID / ID_LIKE → family (the fingerprint maps real output to one column).
+// os-release ID / ID_LIKE -> family (the fingerprint maps real output to one column).
 export const FAMILY_OF = {
   debian: "debian", ubuntu: "debian", raspbian: "debian", mint: "debian", devuan: "debian",
   alpine: "alpine",
@@ -29,8 +23,12 @@ const S = {
 export const SYS_PROBE = Object.entries(S).flatMap(([intent, xs]) => xs.map((text) => ({ intent, text })));
 
 // The Muster-Bib seed: how a user asks the watchman to look for what is WRONG (beyond php2shell).
-// Recognition only — the hands are the deterministic battery in src/checks/. Grown by the loop.
+// Recognition only - the hands are the deterministic battery in src/checks/. Grown by the loop.
 const M = {
+  umschauen: ["schau dich um", "lern mich kennen", "sieh dich mal um", "was weißt du über meinen rechner", "mach dich mit meinem system vertraut", "look around", "get to know my machine", "have a look at my setup", "mira a tu alrededor", "conoce mi equipo", "echa un vistazo a mi sistema"],
+  scharf: ["schalt dich scharf", "aktiviere die patrouille", "lauf mehrmals am tag", "überwache mich automatisch", "arm yourself", "turn on the patrol", "run on a schedule", "watch my machine automatically", "ponte en marcha", "activa la patrulla", "revisa automáticamente"],
+  hf: ["prüf meine modelle", "ist das modell sicher zu laden", "schau dir meine ki modelle an", "was darf mein agent", "prüf meine mcp server", "check meine huggingface modelle", "laden meine gewichte fremden code", "check my models", "are my huggingface models safe to load", "look at my mcp servers", "what is my agent allowed to do", "scan my downloaded models", "revisa mis modelos", "son seguros mis modelos de hugging face", "mira mis servidores mcp", "qué puede hacer mi agente"],
+  abschalten: ["schalt dich ab", "stopp die patrouille", "lauf nicht mehr automatisch", "nimm den zeitplan raus", "disarm", "turn off the patrol", "stop running automatically", "remove the schedule", "desarmar", "apaga la patrulla", "quita el horario"],
   patrouille: ["prüf alles", "mach die runde", "kompletter check", "check alles durch", "alles scannen", "komplett prüfen", "mach die ganze runde", "scan everything", "full check", "run all checks", "check everything", "revisa todo", "chequeo completo", "escanéalo todo"],
   webshell: ["hat mir wer was reingelegt", "gibt es fremde dateien", "such nach webshells", "ist ne hintertür drin", "schädliche php dateien", "backdoor finden", "fremder code im webroot", "check for webshells", "any backdoor files", "malicious php files", "look for a shell", "busca webshells", "archivos maliciosos", "hay una puerta trasera"],
   secrets: ["ist meine env offen", "leaken meine geheimnisse", "ist mein git public", "sind passwörter sichtbar", "liegt die .env offen", "db passwort sichtbar", "are my secrets exposed", "is my .env public", "exposed env file", "secrets leaking", "mis secretos están expuestos", "está mi env público", "contraseña de la base visible"],
@@ -39,6 +37,7 @@ const M = {
 };
 // The Fachwissen seed: how people ask Dante to explain (what he watches / one topic or finding).
 const W = {
+  bericht: ["was ist passiert", "was hast du gemacht", "gibt es was neues", "wie lief die nacht", "hast du was gefunden", "was war seit gestern", "what happened", "what did you do", "anything new", "did you find anything", "what was going on while i was away", "qué pasó", "qué hiciste", "hay novedades", "encontraste algo", "cómo fue la noche"],
   job: ["was überwachst du", "was ist dein job", "was prüfst du alles", "wofür bist du da", "was kannst du inhaltlich", "worauf achtest du", "what do you watch", "what is your job", "what do you check", "what are you for", "what do you look for", "que vigilas", "cual es tu trabajo", "que revisas", "para que sirves", "en que te fijas"],
   thema: ["was ist eine webshell", "woran erkenne ich offene geheimnisse", "warum ist root login gefährlich", "wie prüfst du ssh", "ist das normal", "was tue ich dagegen", "was bedeutet php2shell", "what is a webshell", "what stands out about open secrets", "why is root login dangerous", "how do you check ssh", "is that normal", "what do i do about it", "que es una webshell", "que llama la atencion en los permisos", "por que es peligroso el login de root", "como compruebas ssh", "es normal esto", "que hago al respecto"],
 };
@@ -46,11 +45,11 @@ export const WISSEN_PROBE = Object.entries(W).flatMap(([intent, xs]) => xs.map((
 
 export const MUSTER_PROBE = Object.entries(M).flatMap(([intent, xs]) => xs.map((text) => ({ intent, text })));
 
-// The HANDS. Per family: the exact command Dante runs on the real server, and the rule that reads
-// the real output. Small and hand-verified — this is where "every verdict carries a real line"
+// The hands. Per family: the exact command Dante runs on the real server, and the rule that reads
+// the real output. Small and hand-verified - this is where "every verdict carries a real line"
 // lives. The loop may PROPOSE additions, but a recipe is only the shape below; the hit-logic is
 // deterministic code in src, never DeepSeek prose. php2shell = CVE-2026-109618 (fictional here):
-// affected PHP < 8.1.27, 8.2.0–8.2.13, 8.3.0–8.3.1 — AND only when the vulnerable module is loaded.
+// affected PHP < 8.1.27, 8.2.0–8.2.13, 8.3.0–8.3.1 - and only when the vulnerable module is loaded.
 export const RECIPES = {
   debian: {
     fingerabdruck: { cmd: ". /etc/os-release 2>/dev/null; echo \"$ID ${VERSION_ID}\"", beleg: "die ID-Zeile aus /etc/os-release" },

package/src/bib/wash.mjs

@@ -1,16 +1,8 @@
-// Washer for the language library: replaces personal values in a user sentence with global
-// placeholders and leaves the rest 1:1. wash(text) -> { text, hits } (hits = count per placeholder).
-//
-// Order matters so nothing is half-matched: URL > key paths > mail > user@host > tokens > IP >
-// domain > path > card/IBAN > phone > long numbers > hex/base64 keys > secret labels > names.
-//
-// Limits (on purpose "better too little than too much"):
-//  - {NAME} only fires for (a) a known first name + capitalized surname, (b) a title cue
-//    (Herr/Frau/Dr./Mr./Sr./...) + capitalized name, (c) an intro cue ("mein Name ist", "me llamo",
-//    "my name is") + name, (d) Spanish messaging cue ("escribirle a danny jose ...", lowercase ok). Lone first names, lowercase names and unknown pairs stay untouched.
-//  - Windows paths with spaces are cut at the first space. Relative paths (src/x.mjs) stay.
-//  - Domains are only recognised with a known TLD (so index.php / app.js survive).
-//  - {NUM} also eats plain big numbers (1000000); versions (8.3.6) and CVE-2026-109618 stay.
+// Replaces personal values in a sentence (paths, hosts, mails, tokens, numbers, names) with placeholders
+// before it is used as training data. wash(text) returns { text, hits }.
+// The order of the rules matters, longer patterns first. It prefers leaving something in over
+// removing too much: names are only replaced with a clear cue (known first name + surname, title,
+// "my name is"), domains need a known TLD, versions and CVE ids stay.
 
 const L = "\\p{L}\\p{N}_";
 const TLD = "com|net|org|io|de|es|fr|uk|us|ai|app|dev|co|info|biz|eu|online|space|xyz|site|cloud|me|tv|ch|at|nl|it|ru|cn|jp|do|edu|gov|store|shop|pro|tech";

package/src/checks/battery.mjs

@@ -1,19 +1,23 @@
-// The watchman's battery: the full patrol, built from RULES. The free state is the built-in rule
-// list; every installed pack adds rules or replaces ones with the same id (newest pack wins). One
-// ordered list so the session, the patrol and the tests all run the SAME set. Each check is
-// read-only and carries its own real lines. `rechte` (world-writable files) has no rule type yet and
-// stays plain code.
+// Assembles the checks from rules. Built-in rules are the free tier; each installed pack adds rules or
+// replaces one with the same id (newest wins). Deep rules (secret formats, models, agent config) are
+// kept out of the light battery and run in the deep run or on request. `rechte` has no rule type
+// yet and stays plain code.
 import { versionCheck } from "./php2shell.mjs";
 import { exposedCheck } from "./secrets.mjs";
 import { patternCheck } from "./webshell.mjs";
 import { sshdCheck } from "./sshd.mjs";
+import { formatsCheck } from "./formats.mjs";
+import { modelCardCheck, modelFilesCheck, agentConfigCheck } from "./hf.mjs";
 import { rechte } from "./rechte.mjs";
 import { BUILTIN } from "../pack/builtin.mjs";
 import { loadPacks } from "../pack/pack.mjs";
 
-const FACTORY = { version_cve: versionCheck, path_exposed: exposedCheck, file_pattern: patternCheck, sshd_setting: sshdCheck };
+const FACTORY = { version_cve: versionCheck, path_exposed: exposedCheck, file_pattern: patternCheck, sshd_setting: sshdCheck, secret_format: formatsCheck, model_card: modelCardCheck, model_files: modelFilesCheck, agent_config: agentConfigCheck };
 
-export const buildBattery = (rules) => [...rules.map((r) => FACTORY[r.type](r)), rechte];
+// Deep rules (the Prüf-Bib's secret formats) are not part of the light battery that the patrol and the session run;
+// they run in the deep run only (buildDeep).
+export const buildBattery = (rules) => [...rules.filter((r) => !r.deep).map((r) => FACTORY[r.type](r)), rechte];
+export const buildDeep = (rules) => rules.filter((r) => r.deep).map((r) => FACTORY[r.type](r));
 
 // a rule of a later list replaces the rule with the same id, new ids are added
 export function mergeRules(base, ...more) {
@@ -30,15 +34,16 @@ export const BATTERY = buildBattery(BUILTIN.rules);
 // checks. notices lists the pack files he refused (code per file), for the person to be told once.
 export function activeBattery(opts) {
   const { packs, notices } = loadPacks(opts);
-  return { battery: buildBattery(rulesWith(packs)), packs, notices };
+  const rules = rulesWith(packs);
+  return { battery: buildBattery(rules), deep: buildDeep(rules), packs, notices };
 }
 
-// muster intent → check id. The ear recognises the worry; this says which hand to use.
+// muster intent -> check id. The ear recognises the worry; this says which hand to use.
 export const MUSTER = { pruef_php2shell: "php2shell", secrets: "secrets", webshell: "webshell", sshd: "sshd", rechte: "rechte" };
 
 export const checkById = (id, list = BATTERY) => list.find((c) => c.id === id) || null;
 
-// Run one check safely — a thrown check becomes an honest UNKNOWN, never a crash or a false verdict.
+// Run one check safely - a thrown check becomes an honest UNKNOWN, never a crash or a false verdict.
 export function runCheck(check) {
   try { return check.run(); }
   catch (e) { return { id: check.id, title: check.title, verdict: "unknown", was: "Check brach ab.", wie: String(e.message || e), wo: "", evidence: [] }; }

package/src/checks/common.mjs

@@ -1,8 +1,8 @@
-// Shared bits for the watchman battery. Read-only helpers only — a real line, or nothing.
+// Helpers shared by the checks: quoting, web root lookup, line trimming. Read-only.
 import { run, firstLine } from "../core/sh.mjs";
 
 // Single-quote an argument for the remote shell. Double quotes would let the shell expand a `$` in
-// a regex (e.g. $_GET → the _ variable), which silently mangled the webshell pattern. Single quotes
+// a regex (e.g. $_GET -> the _ variable), which silently mangled the webshell pattern. Single quotes
 // make every character literal; an embedded ' is closed, escaped and reopened.
 export const sq = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
 
@@ -13,17 +13,17 @@ export const WEBROOTS = ["/var/www/html", "/var/www", "/usr/share/nginx/html", "
 // Which of the standard web roots actually exist on the target (its own output decides).
 // Exit code is unreliable here: the for-loop's last `[ -d ] && echo` fails for the last missing
 // path, so the loop exits non-zero even when it printed real roots. We trust the OUTPUT (the lines
-// the machine actually printed), not the exit code — ran is enough.
+// the machine actually printed), not the exit code - ran is enough.
 export function webRoots() {
   const r = run("for d in " + WEBROOTS.join(" ") + "; do [ -d \"$d\" ] && echo \"$d\"; done");
   let roots = r.ran ? r.out.split("\n").map((s) => s.trim()).filter(Boolean) : [];
-  // Drop a root that sits inside another found root (/var/www/html under /var/www) — otherwise a
+  // Drop a root that sits inside another found root (/var/www/html under /var/www) - otherwise a
   // deep search finds the same file through both and reports it twice.
   roots = roots.filter((d) => !roots.some((o) => o !== d && (d === o || d.startsWith(o + "/"))));
   return { ran: r.ran, roots, line: firstLine(r.err || r.out) };
 }
 
-// First N non-empty lines of some output, trimmed — for a compact, honest evidence list.
+// First N non-empty lines of some output, trimmed - for a compact, honest evidence list.
 export function lines(s, n = 10) {
   return String(s || "").split("\n").map((x) => x.trim()).filter(Boolean).slice(0, n);
 }

package/src/checks/demo.mjs

@@ -1,5 +1,5 @@
-// Demo check (only with --demo): a harmless "open door" = a temp file. Lets you watch the whole
-// loop — human-listen → plan → ja/nein → fix → re-prove — without touching anything real.
+// Harmless demo check for --demo: a temp file stands in for an open door, so the whole
+// ask -> plan -> confirm -> fix -> verify loop can be tried without touching anything real.
 import { run, firstLine } from "../core/sh.mjs";
 import { result, evidence, SAFE, RISK } from "../core/check.mjs";
 

package/src/checks/formats.mjs

@@ -0,0 +1,221 @@
+// Deep check for secrets in project files (keys, tokens, private keys, passwords), built from a
+// secret_format rule. A router picks the pattern groups by marker files (package.json, composer.json, ...).
+// A hit is followed up with file mode and git state (tracked, in history, ignored). The report names file,
+// line and kind of secret but never the value. Local scans run in Node, remote ones with the server's grep.
+import { run, targetLabel } from "../core/sh.mjs";
+import { result, evidence, SAFE, WARN, RISK, UNKNOWN } from "../core/check.mjs";
+import { webRoots, lines, sq } from "./common.mjs";
+import { loc } from "./loc.mjs";
+import { lang } from "../i18n.mjs";
+import { read as readUser } from "../me/user.mjs";
+import { homedir } from "node:os";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { toJs, literalOf, automaton } from "../pack/ere.mjs";
+
+const SKIP = ["node_modules", ".git", "vendor", "dist", "build", ".venv", "venv", "__pycache__", "Pods", "target", ".next", ".cache"];
+const MARKERS = [
+  ["node", "package.json"], ["php", "composer.json"], ["python", "requirements.txt"], ["python", "pyproject.toml"], ["go", "go.mod"],
+  ["ruby", "Gemfile"], ["java", "pom.xml"], ["java", "build.gradle"], ["rust", "Cargo.toml"], ["apple", "*.xcodeproj"], ["apple", "Package.swift"],
+];
+// Example files and placeholder lines are not secrets: a template (.env.example) is meant to be committed, and a
+// line that reads "xxxxxx", "YOUR_KEY_HERE" or "<token>" holds no key. The line is judged inside the shell; it is
+// never printed.
+const EXAMPLE_FILES = ["*.example", "*.sample", "*.dist", "*.template", "*.tpl"];
+export const PLACEHOLDER = "x{6,}|X{6,}|\\*{4,}|example|sample|your[_ -]|changeme|change_me|placeholder|dummy|replace[_ -]?me|insert[_ -]|<[A-Za-z_ -]+>|todo|fake|redacted";
+// Which files are looked at: no skipped folders, no example files, nothing over 400 KB (secrets live in small
+// config and code files; big data files are slow and noisy) - the same list for every group of patterns.
+const PRUNE = SKIP.map((d) => "-name " + sq(d)).join(" -o ");
+const NOT_EXAMPLE = EXAMPLE_FILES.map((f) => "! -name " + sq(f)).join(" ");
+const pickFiles = (roots) => `find ${roots.map(sq).join(" ")} \\( ${PRUNE} \\) -prune -o -type f -size -400k ${NOT_EXAMPLE} -print0 2>/dev/null`;
+const MAX_FILES = 12;      // how many hit files he drills into
+const SCAN_SECONDS = 120;
+
+const fname = (f) => (f.i18n && f.i18n[lang()]) || f.name;
+const expand = (p) => String(p || "").replace(/^~(?=\/)/, homedir());
+
+// Where to look: the web roots of the target and, on this machine, the project folders from user.md.
+export function scanRoots() {
+  const wr = webRoots();
+  const roots = [...wr.roots];
+  if (targetLabel() === "localhost") {
+    const u = readUser();
+    for (const p of (u && u.projects) || []) { const e = expand(p); if (e && !roots.includes(e)) roots.push(e); }
+  }
+  return { ran: wr.ran, roots, line: wr.line };
+}
+
+// The router: which systems are present under these roots (real marker files found), plus the machine itself.
+export function routeSystems(roots) {
+  const found = new Set(["generic", "web"]);
+  const find = MARKERS.map(([, n]) => "-name " + sq(n)).join(" -o ");
+  const r = run("find " + roots.map(sq).join(" ") + " -maxdepth 4 \\( " + find + " \\) -not -path '*/node_modules/*' 2>/dev/null | head -200", { timeout: 40000 });
+  const lineSet = lines(r.out, 200);
+  for (const [sys, n] of MARKERS) { const tail = n.replace("*", ""); if (lineSet.some((l) => l.endsWith(tail))) found.add(sys); }
+  const os = run("uname -s");
+  found.add(/darwin/i.test(os.out) ? "apple" : "linux");
+  return { systems: [...found], line: lineSet[0] || "(keine Projekt-Dateien gefunden)" };
+}
+
+// grep -E pattern list for the given formats
+const eArgs = (fs) => fs.map((f) => "-e " + sq(f.re)).join(" ");
+const CHUNK = 250;   // patterns per grep call: keeps the command short (ssh, ARG_MAX) and the grep fast
+const chunks = (fs) => Array.from({ length: Math.ceil(fs.length / CHUNK) }, (_, i) => fs.slice(i * CHUNK, (i + 1) * CHUNK));
+
+// The grep on the target decides what it understands (GNU, BSD and ugrep differ). A pattern it refuses must not
+// silently turn into "nothing found": test the list on empty input, split it until the refused ones are known, and
+// say so. Returns { ok: usable formats, refused: count, ran }.
+export function usable(fs) {
+  const test = (list) => run(`printf '' | grep -E ${eArgs(list)} >/dev/null 2>&1; echo $?`, { timeout: 20000 });
+  const rc = (r) => (r.ran ? Number((r.out || "").trim().split("\n").pop()) : NaN);
+  const ok = [];
+  let refused = 0, ran = true;
+  const go = (list) => {
+    if (!list.length) return;
+    const r = test(list), c = rc(r);
+    if (!r.ran || Number.isNaN(c)) { ran = false; return; }
+    if (c < 2) { ok.push(...list); return; }
+    if (list.length === 1) { refused++; return; }
+    const h = Math.ceil(list.length / 2);
+    go(list.slice(0, h)); go(list.slice(h));
+  };
+  for (const c of chunks(fs)) go(c);
+  return { ok, refused, ran };
+}
+
+export function drill(file) {
+  const dir = file.replace(/\/[^/]*$/, "") || "/";
+  const script = [
+    `f=${sq(file)}; d=${sq(dir)}`,
+    `m=$(ls -ld "$f" | cut -c1-10)`,
+    `if git -C "$d" rev-parse --is-inside-work-tree >/dev/null 2>&1; then`,
+    `  if git -C "$d" ls-files --error-unmatch "$f" >/dev/null 2>&1; then g=tracked`,
+    `  elif [ -n "$(git -C "$d" log --oneline -1 -- "$f" 2>/dev/null)" ]; then g=history`,
+    `  elif git -C "$d" check-ignore -q "$f" 2>/dev/null; then g=ignored`,
+    `  else g=untracked; fi`,
+    `else g=nogit; fi`,
+    `echo "$m $g"`,
+  ].join("\n");
+  const r = run(script, { timeout: 15000 });
+  const [mode = "", git = "nogit"] = (r.out.split("\n").pop() || "").trim().split(/\s+/);
+  return { ran: r.ran && !!mode, mode, git, worldReadable: mode[7] === "r", line: r.out.split("\n").pop() || "" };
+}
+
+// ---- the search on this machine, in Node: prefilter with Aho-Corasick on the fixed text of every pattern, then
+// only the patterns whose text occurs in the file are tried, line by line. Placeholder lines are skipped here.
+const PH = new RegExp(PLACEHOLDER, "i");
+const isExample = (n) => /\.(example|sample|dist|template|tpl)$/.test(n);
+export function scanNode(roots, fs, { budgetMs = SCAN_SECONDS * 1000, maxFiles = 300000 } = {}) {
+  const start = Date.now();
+  const mine = [];
+  let skipped = 0;
+  for (const f of fs) { const js = toJs(f.re), lit = literalOf(f.re); if (js && lit.length >= 3) mine.push({ f, js, lit }); else skipped++; }
+  if (!mine.length) return { ok: false, why: "Keins der Muster lässt sich hier lesen" };
+  const lits = [...new Set(mine.map((x) => x.lit))], byLit = new Map(lits.map((l, i) => [i, mine.filter((x) => x.lit === l)]));
+  const find = automaton(lits);
+  const out = [];
+  let seen = 0, incomplete = "";
+  const stack = [...roots];
+  while (stack.length && !incomplete) {
+    const dir = stack.pop();
+    let ents; try { ents = readdirSync(dir, { withFileTypes: true }); } catch { continue; }   // an unreadable folder is skipped
+    for (const e of ents) {
+      if (Date.now() - start > budgetMs) { incomplete = "Zeitlimit erreicht"; break; }
+      if (seen > maxFiles) { incomplete = "zu viele Dateien"; break; }
+      const p = join(dir, e.name);
+      if (e.isDirectory()) { if (!SKIP.includes(e.name)) stack.push(p); continue; }
+      if (!e.isFile() || isExample(e.name)) continue;
+      let buf; try { if (statSync(p).size > 400 * 1024) continue; buf = readFileSync(p); } catch { continue; }
+      seen++;
+      if (buf.subarray(0, 4096).includes(0)) continue;                    // binary
+      const text = buf.toString("latin1"), got = find(text);
+      if (!got.size) continue;
+      const lines = text.split("\n"), hit = [];
+      for (const id of got) for (const x of byLit.get(id)) {
+        for (let i = 0; i < lines.length; i++) if (lines[i].length < 2000 && x.js.test(lines[i]) && !PH.test(lines[i])) { hit.push({ f: x.f, n: i + 1 }); break; }
+      }
+      if (hit.length) { hit.sort((a, b) => a.n - b.n); out.push({ file: p, hit }); if (out.length >= MAX_FILES * 4) { incomplete = ""; stack.length = 0; break; } }
+    }
+  }
+  if (incomplete) return { ok: false, why: incomplete + ` (${seen} Dateien gelesen)` };
+  return { ok: true, files: out, seen, used: mine.length, cmd: `Node: ${lits.length} feste Texte (Aho-Corasick) → ${mine.length} Formate`, note: skipped ? { claim: `${skipped} Muster lassen sich hier nicht lesen und fallen weg`, src: { cmd: "ERE → JS", line: `${mine.length} von ${fs.length} Mustern brauchbar` } } : null };
+}
+
+// ---- the search on a server: its own grep, in groups of patterns (see usable()).
+export function scanGrep(roots, fs) {
+  const use = usable(fs);
+  if (!use.ran || !use.ok.length) return { ok: false, why: "Das grep dort versteht die Muster nicht" };
+  const groups = chunks(use.ok), found = new Set();
+  for (const g of groups) {
+    const g1 = run(`${pickFiles(roots)} | xargs -0 grep -lIsE ${eArgs(g)} 2>/dev/null | head -${MAX_FILES * 4}`, { timeout: SCAN_SECONDS * 1000 });
+    if (!g1.ran) return { ok: false, why: g1.errorMsg || "die Suche lief nicht zu Ende (Zeitlimit)" };
+    for (const h of lines(g1.out, MAX_FILES * 4)) found.add(h);
+  }
+  const files = [];
+  for (const file of [...found].slice(0, MAX_FILES * 4)) {
+    const hit = [];
+    for (const grp of groups) {
+      if (!run(`grep -qIE ${eArgs(grp)} ${sq(file)}`, { timeout: 15000 }).ok) continue;
+      for (const f of grp) {
+        const g = run(`l=$(grep -nIEm1 -e ${sq(f.re)} ${sq(file)}); [ -n "$l" ] || exit 0; if printf %s "$l" | cut -d: -f2- | grep -qiE ${sq(PLACEHOLDER)}; then echo ph; else echo "${"${l%%:*}"}"; fi`, { timeout: 15000 });
+        const n = (g.out || "").trim();
+        if (g.ran && /^\d+$/.test(n)) hit.push({ f, n: Number(n) });
+      }
+    }
+    if (hit.length) files.push({ file, hit });
+  }
+  return { ok: true, files, seen: found.size, used: use.ok.length, cmd: `grep -lIE <${use.ok.length} Formate> ${roots.join(" ")}`, note: use.refused ? { claim: `${use.refused} Muster versteht das grep dort nicht und fallen weg`, src: { cmd: "printf '' | grep -E <muster>", line: `${use.ok.length} von ${fs.length} Mustern brauchbar` } } : null };
+}
+
+export function formatsCheck(rule) {
+  return {
+    id: rule.id, know: rule.know || rule.id, title: rule.title, aliases: rule.aliases || [], cve: rule.cve || [], deep: true,
+
+    run() {
+      const m = loc(rule), id = rule.id, title = m.title, ev = [];
+      const sr = scanRoots();
+      if (!sr.ran) return result({ id, title, verdict: UNKNOWN, was: "Konnte das Ziel nicht abfragen.", wie: sr.line || "Der Suchbefehl lief nicht.", wo: "Ziel nicht erreichbar.", evidence: [] });
+      if (!sr.roots.length) {
+        ev.push(evidence("Keine Projekt- und Web-Ordner bekannt", { cmd: "web roots + user.md", line: "(keine Ordner zum Durchsuchen)" }));
+        return result({ id, title, verdict: UNKNOWN, was: "Es gibt keinen Ordner, den ich durchsuchen dürfte.", wie: "Lass mich mich umschauen (user.md), dann kenne ich deine Projektordner.", wo: "Dieser Rechner.", evidence: ev });
+      }
+      const route = routeSystems(sr.roots);
+      ev.push(evidence("Router: diese Systeme sind da", { cmd: "find <ordner> -name package.json -o -name composer.json …", line: route.systems.join(", ") + " · " + route.line }));
+      const fs = rule.formats.filter((f) => route.systems.includes(f.system));
+      if (!fs.length) return result({ id, title, verdict: UNKNOWN, was: "Für diese Systeme habe ich keine Muster.", wie: "Die Prüf-Bib kennt keins der gefundenen Systeme.", wo: "Dieser Rechner.", evidence: ev });
+
+      // The search itself. On this machine it runs in Node (BSD grep is far too slow with hundreds of patterns); on a
+      // server it runs with the server's own grep, whose patterns are proven usable first. Either way: a search
+      // that did not finish is UNKNOWN, never "clean".
+      const sc = targetLabel() === "localhost" ? scanNode(sr.roots, fs) : scanGrep(sr.roots, fs);
+      if (!sc.ok) return result({ id, title, verdict: UNKNOWN, was: "Konnte die Ordner nicht (vollständig) durchsuchen.", wie: sc.why + " — ohne saubere Suche sage ich nichts.", wo: "Dieser Rechner.", evidence: ev });
+      if (sc.note) ev.push(evidence(sc.note.claim, sc.note.src));
+      if (!sc.files.length) {
+        ev.push(evidence("Ordner durchsucht, keine Geheimnisse gefunden", { cmd: sc.cmd, line: `(keine Treffer in ${sr.roots.length} Ordner(n), ${sc.used} Formate, ${sc.seen} Dateien gelesen)` }));
+        return result({ id, title, verdict: SAFE, was: m.ok || "Keine Schlüssel oder Passwörter im Code gefunden.", wie: m.ok_how || "Die Ordner wurden mit den Formaten der Prüf-Bib durchsucht.", wo: "Dieser Rechner.", evidence: ev });
+      }
+
+      // The drill-down on every hit file (rights, git). Never the value.
+      let worst = SAFE, normal = 0;
+      const steps = [];
+      for (const { file, hit } of sc.files.slice(0, MAX_FILES)) {
+        const d = drill(file);
+        const names = hit.slice(0, 3).map((h) => `${fname(h.f)} (Zeile ${h.n})`).join("; ");
+        let level = SAFE;
+        if (d.git === "tracked" || d.git === "history") level = RISK;
+        else if (d.worldReadable || d.git === "untracked") level = WARN;
+        else if (!d.ran) level = WARN;
+        if (level === SAFE) normal++;
+        const gitWord = { tracked: "im Git eingecheckt", history: "war mal im Git", ignored: "git-ignoriert", untracked: "nicht ignoriert, nicht eingecheckt", nogit: "kein Git" }[d.git];
+        ev.push(evidence(`${names} — ${gitWord}, Rechte ${d.mode || "?"}`, { cmd: `grep -nE <format> ${file}; ls -ld; git ls-files/check-ignore/log`, line: `${file}:${hit[0].n} · ${d.line}` }));
+        if (level === RISK) { worst = RISK; steps.push({ desc: `Schlüssel in ${file} erneuern (er gilt als bekannt), dann aus Git nehmen: ${d.git === "tracked" ? "git rm --cached" : "History prüfen"}`, script: d.git === "tracked" ? `git -C ${sq(file.replace(/\/[^/]*$/, "") || "/")} rm --cached ${sq(file)}` : `git -C ${sq(file.replace(/\/[^/]*$/, "") || "/")} log --oneline -- ${sq(file)}` }); }
+        else if (level === WARN && worst !== RISK) { worst = WARN; if (d.worldReadable) steps.push({ desc: `Leserecht für andere entziehen: ${file}`, script: `chmod go-rwx ${sq(file)}` }); }
+      }
+      if (worst === SAFE) {
+        return result({ id, title, verdict: SAFE, was: "Schlüssel liegen nur dort, wo sie hingehören.", wie: `${normal} Datei(en) mit Schlüsseln, alle privat und aus Git herausgehalten — das ist normal.`, wo: "Dieser Rechner.", evidence: ev });
+      }
+      return result({ id, title, verdict: worst, was: m.bad || "Schlüssel oder Passwörter stehen offen im Code.", wie: m.bad_how || "Die Zeilen unten nennen Datei, Zeile, Art und Git-Lage — den Wert zeigt Dante nie.", wo: "Dieser Rechner.", evidence: ev,
+        fix: steps.length ? { why: "Ein Schlüssel, der im Git stand, gilt als bekannt: erst erneuern, dann aufräumen.", steps } : null });
+    },
+  };
+}