dante-watch 0.1.2 → 0.1.3

package/src/checks/hf.mjs

@@ -0,0 +1,252 @@
+// Checks for AI models and agent configs on the local machine: model_card (origin, license),
+// model_files (formats that execute code on load, extra Python files) and agent_config (MCP servers and
+// their reach). Rules come from the Hugging Face pack. Only names, sizes, card fields and JSON keys are
+// read; weights are never opened and secret values are never printed.
+import { homedir } from "node:os";
+import { readdirSync, readFileSync, statSync, existsSync, realpathSync } from "node:fs";
+import { join, basename, extname } from "node:path";
+import { targetLabel } from "../core/sh.mjs";
+import { result, evidence, SAFE, WARN, RISK, UNKNOWN } from "../core/check.mjs";
+import { toJs } from "../pack/ere.mjs";
+import { lang } from "../i18n.mjs";
+import { read as readUser } from "../me/user.mjs";
+import { loc } from "./loc.mjs";
+
+const SKIP_DIRS = new Set(["node_modules", ".git", "__pycache__", ".venv", "venv", "Pods", "target"]);
+const BUDGET_MS = 60000, MAX_EVIDENCE = 14;
+const expand = (p) => String(p || "").replace(/^~(?=\/)/, homedir());
+const name3 = (o, fb) => (o && o.i18n && o.i18n[lang()]) || fb;
+// Many checks can describe the same finding; a person needs the worst few, once each.
+const RANK = { risk: 0, warn: 1, info: 2 };
+const topHits = (hits, n = 3) => { const sorted = [...hits].sort((a, b) => RANK[(a.c || a).level] - RANK[(b.c || b).level]); const seen = new Set(), out = []; for (const h of sorted) { const t = name3(h.c || h, (h.c || h).name).toLowerCase().replace(/[^a-zäöüß ]/g, "").slice(0, 28); if (seen.has(t)) continue; seen.add(t); out.push(h); if (out.length === n) break; } return { shown: out, more: hits.length - out.length }; };
+
+// ---- where models live on this machine
+export function modelRoots(env = process.env) {
+  const h = homedir(), out = [];
+  const seen = new Set();
+  const add = (p) => { if (!p || !existsSync(p)) return; let real = p; try { real = realpathSync(p).toLowerCase(); } catch { /* keep */ } if (seen.has(real)) return; seen.add(real); out.push(p); };
+  add(env.HUGGINGFACE_HUB_CACHE); if (env.HF_HOME) add(join(env.HF_HOME, "hub")); add(env.TRANSFORMERS_CACHE);
+  add(join(h, ".cache", "huggingface", "hub")); add(join(h, ".cache", "torch", "hub")); add(join(h, "models")); add(join(h, "Models"));
+  const u = readUser();
+  for (const p of (u && u.projects) || []) add(expand(p));
+  return out;
+}
+
+// Walk the roots (files behind a symlink count - a Hugging Face cache is made of them - folders behind one do not).
+// onDir(dir, entries[{name, size}]) is called for every folder. Stops at the time budget and says so.
+export function walk(roots, onDir, { maxDepth = 9, budgetMs = BUDGET_MS } = {}) {
+  const start = Date.now();
+  let incomplete = false, dirs = 0;
+  const stack = roots.map((r) => [r, 0]);
+  while (stack.length) {
+    if (Date.now() - start > budgetMs) { incomplete = true; break; }
+    const [dir, depth] = stack.pop();
+    let ents; try { ents = readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    const files = [];
+    for (const e of ents) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) { if (depth < maxDepth && !SKIP_DIRS.has(e.name)) stack.push([p, depth + 1]); continue; }
+      let st; try { st = statSync(p); } catch { continue; }
+      if (st.isFile()) files.push({ name: e.name, size: st.size });
+    }
+    dirs++;
+    onDir(dir, files);
+  }
+  return { incomplete, dirs };
+}
+
+// "models--org--name/snapshots/<rev>/..." -> "org/name"; any other folder -> its name
+export function modelName(dir) {
+  const m = dir.match(/models--([^/]+?)--([^/]+)\/snapshots\//);
+  return m ? `${m[1]}/${m[2]}` : basename(dir);
+}
+const rev = (dir) => { const m = dir.match(/snapshots\/([0-9a-f]{7})/); return m ? m[1] : ""; };
+
+// ---- the model card: README front matter (a small YAML subset) and config.json
+export function parseFrontMatter(text) {
+  const m = String(text).match(/^---\s*\n([\s\S]*?)\n---\s*(\n|$)/);
+  if (!m) return null;
+  const out = {}; let key = null;
+  for (const raw of m[1].split("\n")) {
+    const line = raw.replace(/\s+$/, "");
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const item = line.match(/^\s+-\s+(.*)$/);
+    if (item && key) { (out[key] = Array.isArray(out[key]) ? out[key] : []).push(item[1].replace(/^["']|["']$/g, "")); continue; }
+    const kv = line.match(/^([A-Za-z0-9_.-]+):\s*(.*)$/);
+    if (!kv) continue;
+    key = kv[1]; const v = kv[2].trim();
+    if (v === "") { out[key] = out[key] ?? ""; continue; }
+    if (v.startsWith("[") && v.endsWith("]")) out[key] = v.slice(1, -1).split(",").map((x) => x.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+    else out[key] = v.replace(/^["']|["']$/g, "");
+  }
+  return out;
+}
+export function cardFacts(dir, files) {
+  const names = new Set(files.map((f) => f.name));
+  let card = null, cfg = null;
+  if (names.has("README.md")) { try { card = parseFrontMatter(readFileSync(join(dir, "README.md"), "utf8").slice(0, 60000)); } catch { /* unreadable */ } }
+  if (names.has("config.json")) { try { cfg = JSON.parse(readFileSync(join(dir, "config.json"), "utf8").slice(0, 400000)); } catch { /* unreadable */ } }
+  const list = (v) => (Array.isArray(v) ? v : v === undefined || v === "" ? [] : [String(v)]);
+  const facts = {
+    license: card && card.license !== undefined ? String(card.license).toLowerCase() : "",
+    base_model: card ? list(card.base_model) : [],
+    pipeline_tag: card && card.pipeline_tag ? String(card.pipeline_tag) : "",
+    library_name: card && card.library_name ? String(card.library_name) : "",
+    tags: card ? list(card.tags) : [], language: card ? list(card.language) : [], datasets: card ? list(card.datasets) : [],
+    gated: !!(card && (card.extra_gated_prompt !== undefined || card.extra_gated_fields !== undefined || String(card.gated) === "true" || card.gated === "manual" || card.gated === "auto")),
+    auto_map: !!(cfg && cfg.auto_map && typeof cfg.auto_map === "object"),
+    architectures: cfg && Array.isArray(cfg.architectures) ? cfg.architectures.map(String) : [],
+    model_type: cfg && cfg.model_type ? String(cfg.model_type) : "",
+    quantization: !!(cfg && cfg.quantization_config),
+  };
+  return { facts, hasCard: !!card, hasCfg: !!cfg, cardFile: names.has("README.md") ? join(dir, "README.md") : "", cfgFile: names.has("config.json") ? join(dir, "config.json") : "" };
+}
+// one declarative test on one field
+export function testCheck(c, facts) {
+  const v = facts[c.field];
+  const empty = Array.isArray(v) ? v.length === 0 : v === "" || v === false || v === undefined;
+  const vals = Array.isArray(v) ? v.map(String) : [String(v)];
+  switch (c.op) {
+    case "missing": return empty;
+    case "present": return !empty;
+    case "equals": return !empty && vals.some((x) => x.toLowerCase() === String(c.value).toLowerCase());
+    case "in": return !empty && vals.some((x) => c.values.map((y) => y.toLowerCase()).includes(x.toLowerCase()));
+    case "matches": { const re = toJs(c.value); return !!re && !empty && vals.some((x) => re.test(x)); }
+    default: return false;
+  }
+}
+
+const localOnly = (rule, id, title) => targetLabel() !== "localhost"
+  ? result({ id, title, verdict: UNKNOWN, was: "Diese Prüfung liest Modelle und Agent-Dateien auf dem eigenen Rechner.", wie: "Auf einem Server über SSH schaut Dante hier nicht nach.", wo: "Nur dieser Rechner.", evidence: [evidence("Ziel ist ein Server", { cmd: "targetLabel()", line: targetLabel() })] })
+  : null;
+
+const find = (id, rule) => ({ id, know: rule.know || rule.id, title: rule.title, aliases: rule.aliases || [], cve: [], deep: !!rule.deep });
+
+// ---- CHARACTER: where does the model come from?
+export function modelCardCheck(rule) {
+  return { ...find(rule.id, rule), run() {
+    const m = loc(rule), id = rule.id, title = m.title;
+    const off = localOnly(rule, id, title); if (off) return off;
+    const roots = modelRoots();
+    if (!roots.length) return result({ id, title, verdict: SAFE, was: "Keine Modell-Ordner gefunden.", wie: "Kein Hugging-Face-Cache und keine Modell-Ordner auf diesem Rechner.", wo: "Dieser Rechner.", evidence: [evidence("Modell-Ordner gesucht", { cmd: "~/.cache/huggingface/hub, ~/models, Projektordner", line: "(keiner dieser Ordner existiert)" })] });
+    const lic = new Map((rule.licenses || []).map((l) => [l.id, l.class]));
+    const models = [];
+    const w = walk(roots, (dir, files) => {
+      const names = new Set(files.map((f) => f.name));
+      if (!names.has("config.json") && !names.has("README.md")) return;
+      if (!files.some((f) => /\.(safetensors|bin|pt|pth|ckpt|gguf|onnx|h5|pkl|msgpack)$/i.test(f.name)) && !names.has("config.json")) return;
+      const c = cardFacts(dir, files);
+      if (c.hasCfg || c.hasCard) models.push({ dir, ...c });
+    });
+    if (w.incomplete) return result({ id, title, verdict: UNKNOWN, was: "Konnte nicht alle Modell-Ordner lesen.", wie: "Das Zeitlimit war erreicht — ohne vollständige Suche sage ich nichts.", wo: "Dieser Rechner.", evidence: [evidence("Zeitlimit", { cmd: "walk", line: `${models.length} Modelle bis dahin` })] });
+    const ev = [];
+    let warn = 0;
+    for (const md of models.slice(0, MAX_EVIDENCE)) {
+      const f = md.facts, cls = lic.get(f.license) || (f.license ? "unknown" : "");
+      const hits = (rule.checks || []).filter((c) => testCheck(c, f));
+      const warns = hits.filter((c) => c.level === "warn");
+      if (warns.length) warn++;
+      const bits = [`Lizenz ${f.license || "—"}${cls ? " (" + cls + ")" : ""}`, f.base_model.length ? "Basis " + f.base_model.slice(0, 2).join(", ") : "", f.pipeline_tag, f.library_name, f.auto_map ? "eigener Code" : "", f.gated ? "gated" : ""].filter(Boolean).join(" · ");
+      ev.push(evidence(`${modelName(md.dir)}${rev(md.dir) ? "@" + rev(md.dir) : ""}: ${bits}${hits.length ? " — " + (() => { const t = topHits(hits); return t.shown.map((c) => (c.level === "info" ? "" : "⚠ ") + name3(c, c.name)).join("; ") + (t.more > 0 ? ` (+${t.more})` : ""); })() : ""}`, { cmd: "README.md front matter + config.json", line: md.cardFile || md.cfgFile }));
+    }
+    if (models.length > MAX_EVIDENCE) ev.push(evidence(`… und ${models.length - MAX_EVIDENCE} weitere`, { cmd: "walk", line: `${models.length} Modelle insgesamt` }));
+    if (!models.length) return result({ id, title, verdict: SAFE, was: "Keine Modelle mit Karte oder Konfiguration gefunden.", wie: `${roots.length} Ordner durchsucht.`, wo: "Dieser Rechner.", evidence: [evidence("Ordner durchsucht", { cmd: "walk", line: `(keine Modelle in: ${roots.join(", ")})` })] });
+    const bad = models.filter((md) => (rule.checks || []).some((c) => c.level === "warn" && testCheck(c, md.facts))).length;
+    return result({ id, title, verdict: bad ? WARN : SAFE, was: m.bad && bad ? m.bad : (m.ok || "Herkunft der Modelle ist angegeben."), wie: bad ? (m.bad_how || "Die Zeilen nennen Modell, Lizenz, Basis und was auffällt.") : (m.ok_how || "Karte und Konfiguration sagen, woher die Modelle kommen."), wo: "Dieser Rechner.", evidence: ev });
+  } };
+}
+
+// ---- BEHAVIOUR: what does loading it do?
+export function modelFilesCheck(rule) {
+  const kinds = new Map((rule.formats || []).map((f) => [f.ext.toLowerCase(), f]));
+  const codeRes = (rule.code || []).map((c) => ({ c, re: toJs(c.re) })).filter((x) => x.re);
+  return { ...find(rule.id, rule), run() {
+    const m = loc(rule), id = rule.id, title = m.title;
+    const off = localOnly(rule, id, title); if (off) return off;
+    const roots = modelRoots();
+    if (!roots.length) return result({ id, title, verdict: SAFE, was: "Keine Modell-Ordner gefunden.", wie: "Kein Hugging-Face-Cache und keine Modell-Ordner auf diesem Rechner.", wo: "Dieser Rechner.", evidence: [evidence("Modell-Ordner gesucht", { cmd: "~/.cache/huggingface/hub, ~/models, Projektordner", line: "(keiner dieser Ordner existiert)" })] });
+    const dirs = [];
+    const w = walk(roots, (dir, files) => {
+      const weights = files.filter((f) => kinds.has(extname(f.name).slice(1).toLowerCase()));
+      const names = new Set(files.map((f) => f.name));
+      if (!weights.length || (!names.has("config.json") && !weights.some((f) => kinds.get(extname(f.name).slice(1).toLowerCase()).kind !== "unknown"))) return;
+      const cfg = (() => { try { return JSON.parse(readFileSync(join(dir, "config.json"), "utf8").slice(0, 400000)); } catch { return null; } })();
+      const hasCustomCode = !!(cfg && cfg.auto_map) || files.some((f) => /^(modeling|configuration|tokenization)_.*\.py$/.test(f.name));
+      dirs.push({ dir, weights, files, hasCustomCode });
+    });
+    if (w.incomplete) return result({ id, title, verdict: UNKNOWN, was: "Konnte nicht alle Modell-Ordner lesen.", wie: "Das Zeitlimit war erreicht — ohne vollständige Suche sage ich nichts.", wo: "Dieser Rechner.", evidence: [evidence("Zeitlimit", { cmd: "walk", line: `${dirs.length} Modell-Ordner bis dahin` })] });
+    const ev = [], steps = [];
+    let warn = 0, safeOnly = 0;
+    for (const d of dirs) {
+      const byKind = { code: [], safe: [], unknown: [] };
+      for (const f of d.weights) byKind[(kinds.get(extname(f.name).slice(1).toLowerCase()) || { kind: "unknown" }).kind].push(f);
+      const hits = [];
+      if (d.hasCustomCode) for (const f of d.files.filter((x) => /\.py$/.test(x.name) && x.size < 400 * 1024)) {
+        let text; try { text = readFileSync(join(d.dir, f.name), "latin1"); } catch { continue; }
+        const lines = text.split("\n");
+        for (const { c, re } of codeRes) for (let i = 0; i < lines.length; i++) if (lines[i].length < 2000 && re.test(lines[i])) { hits.push({ c, file: join(d.dir, f.name), n: i + 1 }); break; }
+      }
+      const label = `${modelName(d.dir)}${rev(d.dir) ? "@" + rev(d.dir) : ""}`;
+      const redundant = byKind.code.length && byKind.safe.length;      // a pickle next to a safetensors copy is loaded by the safe one
+      if (byKind.code.length && !redundant) {
+        warn++;
+        const exts = [...new Set(byKind.code.map((f) => extname(f.name).slice(1).toLowerCase()))];
+        if (ev.length < MAX_EVIDENCE) ev.push(evidence(`${label}: lädt per ${exts.join("/")} — dabei kann Code laufen (${name3(kinds.get(exts[0]), kinds.get(exts[0]).name)})`, { cmd: "Dateiendungen im Ordner", line: `${join(d.dir, byKind.code[0].name)} · ${byKind.code[0].size} Bytes` }));
+        steps.push({ desc: `Ordner ansehen (nur lesen): ${label}`, script: `ls -l '${d.dir.replace(/'/g, "'\\''")}'` });
+      } else if (byKind.safe.length && !byKind.code.length) {
+        safeOnly++;
+        if (ev.length < MAX_EVIDENCE) ev.push(evidence(`${label}: nur ${[...new Set(byKind.safe.map((f) => extname(f.name).slice(1)))].join("/")} — enthält keinen ausführbaren Code`, { cmd: "Dateiendungen im Ordner", line: join(d.dir, byKind.safe[0].name) }));
+      } else if (redundant && ev.length < MAX_EVIDENCE) ev.push(evidence(`${label}: Pickle liegt neben einer safetensors-Kopie`, { cmd: "Dateiendungen im Ordner", line: join(d.dir, byKind.code[0].name) }));
+      for (const h of hits.slice(0, 4)) { warn++; if (ev.length < MAX_EVIDENCE + 6) ev.push(evidence(`${label}: eigener Code — Muster „${name3(h.c, h.c.name)}“`, { cmd: "Muster in den .py-Dateien des Modells", line: `${h.file}:${h.n}` })); }
+    }
+    if (!dirs.length) return result({ id, title, verdict: SAFE, was: "Keine Modell-Dateien gefunden.", wie: `${roots.length} Ordner durchsucht.`, wo: "Dieser Rechner.", evidence: [evidence("Ordner durchsucht", { cmd: "walk", line: `(keine Modell-Dateien in: ${roots.join(", ")})` })] });
+    if (!warn) return result({ id, title, verdict: SAFE, was: m.ok || "Beim Laden läuft kein fremder Code.", wie: m.ok_how || "Die Modelle liegen in Formaten ohne ausführbaren Code, und ihr Zusatzcode zeigt keine Auffälligkeit.", wo: "Dieser Rechner.", evidence: ev });
+    return result({ id, title, verdict: WARN, was: m.bad || "Beim Laden mancher Modelle kann fremder Code laufen.", wie: m.bad_how || "Pickle-Formate führen beim Laden Code aus; die Zeilen nennen Modell, Datei und Muster. Von Hand ansehen, nicht blind löschen.", wo: "Dieser Rechner.", evidence: ev,
+      fix: steps.length ? { why: "Besser die safetensors-Variante laden (kein Code darin). Bis dahin: nur Modelle aus Quellen laden, denen du traust.", steps: steps.slice(0, 5) } : null });
+  } };
+}
+
+// ---- CAPABILITIES: what may an agent do?
+function serversOf(json) {
+  const out = [];
+  const take = (obj) => { if (obj && typeof obj === "object" && !Array.isArray(obj)) for (const [name, s] of Object.entries(obj)) if (s && typeof s === "object" && (s.command || s.url || s.args)) out.push({ name, s }); };
+  if (!json || typeof json !== "object") return out;
+  take(json.mcpServers); take(json.servers); take(json.context_servers); take(json.mcp && json.mcp.servers);
+  if (json.projects && typeof json.projects === "object") for (const p of Object.values(json.projects)) if (p && p.mcpServers) take(p.mcpServers);
+  return out;
+}
+const where = (name, s) => ({
+  command: String(s.command || ""), args: Array.isArray(s.args) ? s.args.map(String).join(" ") : "", url: String(s.url || ""), name,
+  env: s.env && typeof s.env === "object" ? Object.entries(s.env).map(([k, v]) => `${k}=${typeof v === "string" ? v : ""}`).join("\n") : "",
+});
+export function agentConfigCheck(rule) {
+  const checks = (rule.checks || []).map((c) => ({ c, re: toJs(c.re) })).filter((x) => x.re);
+  const caps = (rule.caps || []).map((c) => ({ c, re: toJs(c.re) })).filter((x) => x.re);
+  return { ...find(rule.id, rule), run() {
+    const m = loc(rule), id = rule.id, title = m.title;
+    const off = localOnly(rule, id, title); if (off) return off;
+    const tried = [], found = [];
+    const proj = []; const u = readUser(); for (const p of (u && u.projects) || []) proj.push(expand(p));
+    for (const f of rule.files) {
+      if (f.startsWith("~/") || f.includes("/")) { const p = expand(f); tried.push(p); if (existsSync(p)) found.push(p); }
+      else for (const root of proj) for (const p of [join(root, f), ...(() => { try { return readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !SKIP_DIRS.has(e.name) && !e.name.startsWith(".")).slice(0, 60).map((e) => join(root, e.name, f)); } catch { return []; } })()]) { if (existsSync(p) && !found.includes(p)) found.push(p); }
+    }
+    if (!found.length) return result({ id, title, verdict: SAFE, was: "Keine Agent- oder MCP-Konfiguration gefunden.", wie: `${tried.length} bekannte Orte geprüft.`, wo: "Dieser Rechner.", evidence: [evidence("Bekannte Konfig-Dateien gesucht", { cmd: "existsSync auf bekannte Pfade", line: `(keine von ${tried.length} gefunden, z. B. ${tried[0] || "?"})` })] });
+    const ev = [], steps = [];
+    let worst = SAFE, servers = 0, unreadable = 0;
+    for (const file of found) {
+      let json; try { json = JSON.parse(readFileSync(file, "utf8").slice(0, 2 * 1024 * 1024)); } catch { unreadable++; ev.push(evidence(`${basename(file)} ist kein lesbares JSON`, { cmd: "JSON.parse", line: file })); if (worst === SAFE) worst = WARN; continue; }
+      for (const { name, s } of serversOf(json)) {
+        servers++;
+        const w = where(name, s);
+        const have = [...new Set(caps.filter((x) => x.re.test(`${w.command} ${w.args} ${name}`)).map((x) => x.c.cap))];
+        const hits = checks.filter((x) => x.re.test(w[x.c.where] || ""));
+        for (const lvl of ["risk", "warn"]) if (hits.some((x) => x.c.level === lvl) && (worst === SAFE || (lvl === "risk" && worst !== RISK))) worst = lvl === "risk" ? RISK : (worst === RISK ? RISK : WARN);
+        if (ev.length < MAX_EVIDENCE + 8) ev.push(evidence(`${name}${have.length ? " kann: " + have.join(", ") : ""}${hits.length ? " — " + (() => { const t = topHits(hits); return t.shown.map((x) => (x.c.level === "info" ? "" : "⚠ ") + name3(x.c, x.c.name)).join("; ") + (t.more > 0 ? ` (+${t.more})` : ""); })() : ""}`, { cmd: "JSON-Eintrag des Servers (Werte werden nie gezeigt)", line: `${file} · Server „${name}“` }));
+      }
+    }
+    if (!servers && !unreadable) return result({ id, title, verdict: SAFE, was: "Die Konfiguration nennt keine Server.", wie: `${found.length} Datei(en) gelesen, kein Server eingetragen.`, wo: "Dieser Rechner.", evidence: [evidence("Konfig-Dateien gelesen", { cmd: "JSON.parse", line: found[0] })] });
+    return result({ id, title, verdict: worst, was: worst === SAFE ? (m.ok || "Keine auffälligen Rechte in den Agent-Konfigurationen.") : (m.bad || "Ein Agent hat mehr Rechte, als er braucht."), wie: worst === SAFE ? (m.ok_how || `${servers} Server geprüft; die Zeilen sagen, was jeder kann.`) : (m.bad_how || "Die Zeilen nennen Server, Fähigkeit und was auffällt — Werte zeigt Dante nie."), wo: "Dieser Rechner.", evidence: ev,
+      fix: worst === SAFE ? null : { why: "Nur die Rechte lassen, die der Agent wirklich braucht; Schlüssel nicht in die Datei schreiben, sondern als Umgebungsvariable setzen.", steps: [{ desc: "Konfig-Datei ansehen (nur lesen)", script: `ls -l '${found[0].replace(/'/g, "'\\''")}'` }] } });
+  } };
+}

package/src/checks/loc.mjs

@@ -1,7 +1,5 @@
-// The words of a rule in the language of the person. A rule carries German as its base text and
-// i18n.en / i18n.es next to it; the pack factory refuses a rule that lacks either, so a pack can
-// never put a German sentence into an English session. An older pack without them falls back to the
-// German base (the phrasebook in i18n-checks.mjs still translates what it knows).
+// Picks the wording of a rule for the current language. Rules carry German as base text plus
+// i18n.en / i18n.es; the pack factory rejects rules without both. Older packs fall back to German.
 import { lang } from "../i18n.mjs";
 
 export function loc(rule) {

package/src/checks/php2shell.mjs

@@ -1,7 +1,6 @@
-// Check: a version-bound CVE (PHP2Shell, CVE-2026-109618 / CVE-2026-109619, is the first), built from
-// a rule of type version_cve. Read-only. The rule that keeps Dante honest here: a distro BACKPORT
-// keeps the old version number but fixes the bug, so the version number alone can never prove "safe"
-// or "risk". The changelog is the authority. If Dante cannot read the changelog, it says UNKNOWN.
+// Version-bound CVE check (PHP2Shell, CVE-2026-109618/-619 first), built from a version_cve rule.
+// Distro backports keep the old version number, so a version alone never proves safe or vulnerable;
+// the package changelog decides, and without it the verdict is unknown.
 import { run, firstLine } from "../core/sh.mjs";
 import { result, evidence, SAFE, WARN, RISK, UNKNOWN } from "../core/check.mjs";
 import { FAMILY_OF, fixSteps } from "../bib/system.mjs";
@@ -10,7 +9,7 @@ import { BUILTIN } from "../pack/builtin.mjs";
 import { loc } from "./loc.mjs";
 
 // How to ask a program for its version, which service belongs to it, where its changelog lives.
-// This table is CODE: a pack only picks a name from it (rules.mjs PROBES), it cannot add a command.
+// This table is code: a pack only picks a name from it (rules.mjs PROBES), it cannot add a command.
 const PROBES = {
   php: { ver: "php -v", doc: "/usr/share/doc/php*-common/changelog.*", svc: "php[0-9.]*-fpm" },
   nginx: { ver: "nginx -v 2>&1", doc: "/usr/share/doc/nginx*/changelog.*", svc: "nginx" },
@@ -44,7 +43,7 @@ export function versionCheck(rule) {
 
       // 1) Is the program present at all?
       const cli = run(P.ver);
-      const fpm = P.svc ? run("systemctl list-units --type=service --all --no-legend 2>/dev/null | grep -iE " + sq(P.svc) + " | awk '{print $1, $4}'") : { ran: false, ok: false, out: "" }; // no service to ask → it must not count as "I looked"
+      const fpm = P.svc ? run("systemctl list-units --type=service --all --no-legend 2>/dev/null | grep -iE " + sq(P.svc) + " | awk '{print $1, $4}'") : { ran: false, ok: false, out: "" }; // no service to ask -> it must not count as "I looked"
       const anyFpm = fpm.ok && fpm.out.trim().length > 0;
       const anyCli = cli.ok && parseVer(cli.out) != null;
       if (!anyCli && !anyFpm) {
@@ -84,7 +83,7 @@ export function versionCheck(rule) {
           wo, evidence: ev });
       }
 
-      // Not upstream-fixed and no CVE line found. Could we even READ the changelog?
+      // Not upstream-fixed and no CVE line found. Could we even read the changelog?
       if (!canReadChangelog) {
         ev.push(evidence("Changelog nicht lesbar — Patch-Stand nicht belegbar", { cmd: "ls " + P.doc, line: firstLine(docs.err || docs.out) || "(keine Datei)" }));
         return result({ id, title, verdict: UNKNOWN,
@@ -94,7 +93,7 @@ export function versionCheck(rule) {
           fix: "Patch-Stand von Hand prüfen (Changelog/Advisory) oder " + L + " aktualisieren und " + (rule.probe === "php" ? "PHP-FPM" : "den Dienst") + " neu starten." });
       }
 
-      // Changelog readable, CVE absent, version below fix line → genuinely unpatched. Exposure decides urgency.
+      // Changelog readable, CVE absent, version below fix line -> genuinely unpatched. Exposure decides urgency.
       ev.push(evidence("Changelog gelesen, kein CVE-Patch darin", { cmd: "zcat changelog | grep CVE", line: "(keine Treffer, Datei lesbar)" }));
       let exposed = null; // only PHP has an exposure test (a web server that hands .php to FastCGI)
       if (rule.probe === "php") {
@@ -111,7 +110,7 @@ export function versionCheck(rule) {
       const major = (parseVer(firstLine(cli.out)) || [8, 3]).slice(0, 2).join(".");
       const fpmSvc = anyFpm ? firstLine(fpm.out).split(" ")[0] : ("php" + major + "-fpm");
       // The fix must speak the system's own package manager. Read the family off the target itself
-      // (os-release), not from anything the user claimed — unreadable → debian (the most common).
+      // (os-release), not from anything the user claimed - unreadable -> debian (the most common).
       const osId = firstLine(run(". /etc/os-release 2>/dev/null; echo \"$ID\"").out).toLowerCase();
       const family = FAMILY_OF[osId] || "debian";
       ev.push(evidence("System-Familie (für den Fix-Weg): " + family, { cmd: ". /etc/os-release; echo $ID", line: osId || "(nicht lesbar → debian angenommen)" }));

package/src/checks/rechte.mjs

@@ -1,6 +1,5 @@
-// Check: world-writable files in sensitive places (/etc and the web roots). A file anyone can
-// rewrite is a file anyone can turn into a foothold (a cron, a config, a PHP page). Read-only:
-// it only lists paths with the dangerous mode bit. Can't search → UNKNOWN, never "safe".
+// World-writable files under /etc and the web roots. Anyone can turn such a file into a foothold
+// (cron, config, PHP page). Lists paths only. If the search cannot run the verdict is unknown.
 import { run } from "../core/sh.mjs";
 import { result, evidence, SAFE, WARN, UNKNOWN } from "../core/check.mjs";
 import { webRoots, lines } from "./common.mjs";

package/src/checks/secrets.mjs

@@ -1,7 +1,5 @@
-// Check: secrets left world-readable inside a web root (.env, *.sql, backups, .git/config), built
-// from a rule of type path_exposed. These are the classic "one GET request and your DB password is
-// public" holes. Read-only. Honest rule: no standard web root found → UNKNOWN (we don't know where
-// the site is), never "safe".
+// Readable secrets inside a web root (.env, *.sql, backups, .git/config), from a path_exposed rule.
+// Without a standard web root the verdict is unknown, because the site could be anywhere.
 import { run } from "../core/sh.mjs";
 import { result, evidence, SAFE, RISK, UNKNOWN } from "../core/check.mjs";
 import { webRoots, lines, sq } from "./common.mjs";

package/src/checks/sshd.mjs

@@ -1,8 +1,6 @@
-// Check: SSH exposure, built from a rule of type sshd_setting — every listed setting must hold a bad
-// value for the verdict to be WARN (the built-in rule: root login AND password login together are
-// the brute-force surface most own-server break-ins ride in on). Reads the EFFECTIVE sshd config
-// (`sshd -T`) so an Include or a drop-in cannot hide it; falls back to the config file if sshd -T
-// is not available. Read-only. Can't read either → UNKNOWN, never "safe".
+// SSH exposure from an sshd_setting rule: the verdict is a warning only if every listed setting is bad
+// (by default root login and password login together). Reads the effective config via `sshd -T` so an
+// Include cannot hide a value, and falls back to the config file.
 import { run } from "../core/sh.mjs";
 import { result, evidence, SAFE, WARN, UNKNOWN } from "../core/check.mjs";
 import { BUILTIN } from "../pack/builtin.mjs";

package/src/checks/webshell.mjs

@@ -1,8 +1,6 @@
-// Check: webshell markers in the web root — files that call a sink from user input, the shape of a
-// planted backdoor ($_GET['x'](...), eval(base64_decode(...)), system($_POST...)). Built from a
-// rule of type file_pattern. Read-only: it reports the PATH and which marker matched, never the
-// file's contents (that could be attacker code). A match is a heuristic → verdict WARN ("look here
-// by hand"), never a bare RISK. No web root → UNKNOWN, never "safe".
+// Looks for webshell markers in a web root (input passed to a call, eval of decoded data, system()
+// with request data), from a file_pattern rule. Reports the path and the marker, not the file content.
+// A match is a warning, since the patterns are heuristics.
 import { run } from "../core/sh.mjs";
 import { result, evidence, SAFE, WARN, UNKNOWN } from "../core/check.mjs";
 import { webRoots, lines, sq } from "./common.mjs";

package/src/cli.mjs

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
-// Dante — watches a server you own, never lies to itself, and changes nothing without a yes.
-// It looks and reports with real lines. On a real finding it comes to the foreground, shows its
-// plan (plain words + the exact commands) and asks ja/nein. On yes it acts, then re-proves.
+// Command line entry: flags, one-shot checks and the interactive session.
 import { configureTarget, targetLabel, probe, run, firstLine } from "./core/sh.mjs";
 import { renderResult, renderSummary } from "./core/render.mjs";
 import { RISK, WARN, SAFE, UNKNOWN } from "./core/check.mjs";
@@ -10,7 +8,7 @@ import { banner } from "./mascot.mjs";
 import { activeBattery } from "./checks/battery.mjs";
 import { demo } from "./checks/demo.mjs";
 import { staleLine, VERSION, BIB_DATE } from "./ticker.mjs";
-import { lang, t } from "./i18n.mjs";
+import { lang, t, initLang } from "./i18n.mjs";
 import { tx } from "./i18n-checks.mjs";
 
 function parseArgs(argv) {
@@ -25,6 +23,8 @@ function parseArgs(argv) {
     else if (t === "--demo") a.demo = true;
     else if (t === "--help" || t === "-h") a.help = true;
     else if (t === "--version" || t === "-v") a.version = true;
+    else if (t === "--patrol") a.patrol = true;
+    else if (t === "--deep") a.deep = true;
   }
   return a;
 }
@@ -35,6 +35,8 @@ const HELP = `Dante — wächter
   npx dante-watch --ssh user@host [--key /pfad]   prüft einen Server, der dir gehört
   --fix        bei einem Fund: Plan zeigen und nach deinem Ja schließen
   --demo       harmlose Übung: zeigt die ganze Schleife (human → plan → ja/nein → fix → Beweis)
+  --patrol     eine Patrouille (das startet der Zeitplan): prüft, schreibt das Tagebuch, ändert nichts
+  --deep       ein Tiefenlauf (wöchentlich, startet der Zeitplan): liest Projektordner nach Schlüsseln, bohrt bei Treffern nach
   --version    welche Version läuft
   --json       Maschinen-Ausgabe
   -y, --yes    nicht nachfragen (für Automode/Cron)
@@ -44,7 +46,7 @@ Dante ändert nichts ohne dein Ja. Jedes Urteil trägt die echte Zeile; fehlt si
 const C = (code, s) => (process.stdout.isTTY && !process.env.NO_COLOR ? `\x1b[${code}m${s}\x1b[0m` : s);
 
 async function handleFinding(check, r, a) {
-  // "Human, hör zu" — foreground, plan in words + exact commands, then ja/nein, then re-prove.
+  // "Human, hör zu" - foreground, plan in words + exact commands, then ja/nein, then re-prove.
   console.log("\n" + C("41;37", t("listen")) + " " + C("1", tx(r.title)));
   console.log("  " + C("2", t("what")) + " " + tx(r.was));
   console.log("  " + C("2", t("how")) + " " + tx(r.wie));
@@ -53,7 +55,7 @@ async function handleFinding(check, r, a) {
     console.log("    " + (i + 1) + ") " + tx(s.desc));
     console.log("       " + C("2", "$ " + s.script));
   });
-  // On a real risk, Dante tells you to distrust it (SPEC): check against another AI.
+  // On a real risk, Dante tells you to distrust it : check against another AI.
   console.log("  " + C("33", t("distrust")));
 
   const answer = await ask(check.id, t("run"), { yes: a.yes, plan: r.fix });
@@ -78,12 +80,15 @@ async function handleFinding(check, r, a) {
 }
 
 async function main() {
+  initLang();
   const a = parseArgs(process.argv.slice(2));
   if (a.help) { console.log(HELP); return; }
+  if (a.deep) { const { deep } = await import("./me/deep.mjs"); process.exit(await deep()); }
+  if (a.patrol) { const { patrol } = await import("./me/patrol.mjs"); process.exit(await patrol()); }   // what the schedule starts: no screen, only the diary and the log
   if (a.version) { console.log("dante-watch " + VERSION + " · bib " + BIB_DATE); return; }
 
-  // No flags + a real terminal → the face: summon, greet, arm, talk, stay open.
-  // Flags or a pipe → one-shot (for cron / --json / automode).
+  // No flags + a real terminal -> the face: summon, greet, arm, talk, stay open.
+  // Flags or a pipe -> one-shot (for cron / --json / automode).
   const bare = process.argv.slice(2).length === 0;
   if (bare && process.stdin.isTTY && process.stdout.isTTY) {
     const { session } = await import("./session.mjs");
@@ -112,7 +117,7 @@ async function main() {
   for (const r of results) console.log(renderResult(r));
   console.log(renderSummary(results, target));
 
-  // Findings with a plan → the consent flow (only with --fix or --demo; otherwise just report).
+  // Findings with a plan -> the consent flow (only with --fix or --demo; otherwise just report).
   if (a.fix || a.demo) {
     for (const c of checks) {
       const r = results.find((x) => x.id === c.id);
@@ -123,7 +128,7 @@ async function main() {
   } else if (results.some((r) => (r.verdict === RISK || r.verdict === WARN) && r.fix)) {
     console.log("\n" + C("2", "Dante kann das nach deinem Ja schließen: noch einmal mit ") + "--fix" + C("2", " starten."));
   }
-  const old = staleLine(lang()); // the inner clock — local arithmetic, no update check over the net
+  const old = staleLine(lang()); // the inner clock - local arithmetic, no update check over the net
   if (old) console.log("\n" + C("33", old));
   process.exit(results.some((r) => r.verdict === RISK) ? 2 : 0);
 }

package/src/core/check.mjs

@@ -1,17 +1,13 @@
-// The contract that makes Dante unable to lie to itself.
-//
-// A check returns a verdict and a list of EVIDENCE. Every evidence item ties a plain-language
-// claim to the exact command and the raw line it came from. The renderer refuses to print a
-// claim that has no raw line. A check that cannot gather real evidence must return "unknown" —
-// never "safe". Safe is a thing you prove, not a thing you assume.
+// Result contract for checks. Every piece of evidence ties a claim to the command that ran and the
+// line it printed. A safe, risk or warn verdict without a grounded line is downgraded to unknown.
 
 export const SAFE = "safe";     // proven not vulnerable, with evidence
 export const WARN = "warn";     // partially mitigated / needs a step (e.g. restart)
 export const RISK = "risk";     // proven exposed / vulnerable, with evidence
-export const UNKNOWN = "unknown"; // could not gather real evidence — never claim safety
+export const UNKNOWN = "unknown"; // could not gather real evidence - never claim safety
 
 export function evidence(claim, source) {
-  // source = { cmd, line } — cmd is the real command, line is the real output it produced.
+  // source = { cmd, line } - cmd is the real command, line is the real output it produced.
   const line = (source && source.line != null) ? String(source.line).trim() : "";
   const cmd = (source && source.cmd) ? String(source.cmd) : "";
   return { claim: String(claim), cmd, line, grounded: line.length > 0 };

package/src/core/consent.mjs

@@ -1,6 +1,6 @@
-// Consent: Dante never changes anything without a yes. It comes to the foreground, shows its plan
-// in plain words AND the exact commands, and waits. A trust count per check-id earns an automode
-// offer after 5 yeses (SPEC). State lives in ~/.dante/trust.json, local to the user.
+// Confirmation before any change: show the plan and the exact commands, then wait for a yes.
+// A per-check trust counter offers automatic mode after five confirmations; it lives in
+// ~/.dante/trust.json.
 import { createInterface } from "node:readline/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -19,7 +19,7 @@ export function automodeFor(id) {
   return d[id] && d[id].automode === true;
 }
 
-// Only a clean yes is a yes. "ja aber erst morgen", "jein", "ja?" are not — when in doubt, nothing
+// Only a clean yes is a yes. "ja aber erst morgen", "jein", "ja?" are not - when in doubt, nothing
 // changes. (Before: anything starting with "j" counted, so "ja aber nicht jetzt" ran the fix.)
 const YES = /^(ja|j|jo|jap|jawohl|ja bitte|ja mach|yes|y|yep|yes please|yeah|sure|si|sí|claro|dale|ok|okay|mach|mach es|los|go)[.!]*$/;
 const ALWAYS = /^(a|automode|immer|always|siempre)[.!]*$/;
@@ -42,16 +42,16 @@ export async function ask(id, question, { yes = false, plan = null, rl: shared =
   const dim = (t) => console.log("  \x1b[2m" + t + "\x1b[0m");
   let answer = "no";
   try {
-    // The consent ear may explain, delay or refuse — it can never say yes. Yes is typed, cleanly.
+    // The consent ear may explain, delay or refuse - it can never say yes. Yes is typed, cleanly.
     for (let round = 0; round < 4; round++) {
       answer = hear(await rl.question(question));
       if (answer !== "no" || NO.test(lastRaw)) break;
       const { hearConsent } = await import("../bib/ear.mjs");
       const meant = hearConsent(lastRaw).intent;
-      // A long yes ("ja ohne wenn und aber", "Sí. apt upgrade …") is not run — it is asked back.
+      // A long yes ("ja ohne wenn und aber", "Sí. apt upgrade ...") is not run - it is asked back.
       if (YES_START.test(lastRaw) && meant !== "nein") { dim(t("sayClean")); continue; }
       if (meant === "spaeter") { dim(t("later")); break; }
-      // "what does it do" and "is it dangerous" overlap (measured: most yes/no mix-ups) — both get both.
+      // "what does it do" and "is it dangerous" overlap (measured: most yes/no mix-ups) - both get both.
       if ((meant === "was_macht" || meant === "gefahr") && plan) {
         plan.steps.forEach((s, i) => dim(`${i + 1}) ${tx(s.desc)} — ${t("stepIs")} ${s.script}`));
         dim(plan.risk || t("danger")(plan.steps.length));

package/src/core/render.mjs

@@ -1,5 +1,5 @@
-// Render a check result as a Formular: was / wie / wo, a verdict badge, and the Belege.
-// A claim without a real line is never shown as proof — it is marked as a gap.
+// Formats a check result as what / how / where plus evidence lines. A claim without a real
+// line is printed as a gap, not as proof.
 import { SAFE, WARN, RISK, UNKNOWN } from "./check.mjs";
 import { t } from "../i18n.mjs";
 import { tx } from "../i18n-checks.mjs";

package/src/core/sh.mjs

@@ -1,21 +1,26 @@
-// sh: the only place a real line enters Dante. Runs a command, captures stdout/stderr/exit.
-// Optionally prefixes with ssh so Dante can look at a remote server the user owns.
-// Nothing here is a model's opinion — it is the machine's own output.
+// Runs commands, locally or over ssh, and returns stdout, stderr and the exit status. All evidence in
+// the program comes through here.
 import { spawn, spawnSync } from "node:child_process";
 
-let PREFIX = null; // e.g. ["ssh","-i","/key","root@host"] — set by configureTarget()
+let PREFIX = null; // e.g. ["ssh","-i","/key","root@host"] - set by configureTarget()
+
+// user@host, host, host:port-less names and addresses (letters, digits, . _ - @ : and [] for IPv6); never a leading -
+export const validHost = (h) => typeof h === "string" && h.length > 0 && h.length < 256 && /^[A-Za-z0-9_][A-Za-z0-9._@:\[\]%-]*$/.test(h);
 
 export function configureTarget(ssh) {
-  // ssh: null (local) | {host, key?} — we build an argv prefix, never a shell string.
+  // ssh: null (local) | {host, key?} - we build an argv prefix, never a shell string.
   if (!ssh) { PREFIX = null; return; }
+  // A target is a name or address, never an option: a "host" that starts with "-" (-oProxyCommand=...) would be run by ssh
+  // itself as an option. Anything that is not a plain host is refused here and answers "no channel", never a command.
+  if (!validHost(ssh.host)) { PREFIX = ["sh", "-c", "echo 'ungültiges Ziel' >&2; exit 255", "dante"]; return; }
   const p = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10"];
   if (ssh.key) p.push("-i", ssh.key);
-  p.push(ssh.host);
+  p.push("--", ssh.host);
   PREFIX = p;
 }
 
 export function targetLabel() {
-  return PREFIX ? PREFIX[PREFIX.length - 1] : "localhost";
+  return PREFIX ? (PREFIX[0] === "ssh" ? PREFIX[PREFIX.length - 1] : "ungültig") : "localhost";
 }
 
 /**

package/src/i18n-checks.mjs

@@ -1,6 +1,5 @@
-// Phrasebook for what the checks say. Checks stay written in German (their logic is the part that
-// must not lie, so it is not touched for language); the renderer looks each sentence up here.
-// Unknown text — above all every raw line from a real command — passes through unchanged.
+// Translations for the fixed sentences of the checks. The checks themselves are written in German;
+// the renderer looks sentences up here and passes unknown text (such as command output) through.
 import { lang } from "./i18n.mjs";
 
 const BOOK = [