dante-watch 0.1.2 → 0.1.4

package/README.md

@@ -4,37 +4,92 @@
 
 ```
 npx dante-watch                 # open a session: talk to Dante in German, English or Spanish
+npx dante-watch --version       # which version runs
 npx dante-watch --ssh root@host --key ~/.ssh/id   # check a server you own, once
 ```
 
 Every verdict carries the real line it came from. If Dante cannot read the proof, it says
 `unknown` — never `safe`. Safe is a thing it proves, not a thing it assumes.
 
-## What Dante sends
-
-**By default and on its own: nothing.** The code has no `fetch`, no HTTP client, no telemetry, no
-update check. It never calls anyone while it watches.
-
-There is exactly one way something can leave your machine, and you start it yourself:
-
-- You type `update` (German `aktualisier`, Spanish `actualiza`). Dante prints the exact command and
-  asks `yes/no`. On a clear *yes* it runs one `curl` on **your** machine to
-  `https://api.nm-streetwear.space/dante/packs`, carrying **your license token** and nothing else —
-  no host names, no findings, no file names, nothing from the servers you check.
-- You can skip it forever. The free state is complete and runs offline. You can also download a pack
-  in a browser and install it with `pack <file>`; then Dante never touches the network at all.
-
-If you use `--ssh` (or `server root@host` in the session), Dante connects to **that host, with that
-key, and nowhere else**. Everything it runs there is printed with the line it got back.
-
-What it reads and writes on your machine: the folder `~/.dante/` — your token (mode 0600), the packs
-you installed, and a counter of your *yes* answers. Fixes happen only after a clear *yes*.
+## What Dante sends, reads and writes
+
+**By default and on its own: nothing.** The code has no `fetch`, no HTTP client, no telemetry, no update check.
+While you talk to him, and while he patrols, he calls nobody.
+
+Exactly two things can reach our server, and **you** start both, after a clear *yes* to the command he prints:
+
+- `update` (German `aktualisier`, Spanish `actualiza`): one `curl` to `https://api.nm-streetwear.space/dante/packs`
+  carrying **your license token** and nothing else. `update` also looks around again on your machine (see below).
+- `buy` (`kaufen`, `comprar`), or a question once a week when his knowledge is 30 days old: one `curl` to the
+  **public** catalog `https://api.nm-streetwear.space/dante/catalog`. Nothing of yours goes out, not even a token.
+  Only if there are packs you lack does he ask whether to open the shop page in your browser.
+
+You can skip both forever. The free state is complete and runs offline. Download a pack in a browser and install it
+with `pack <file>`, and Dante never touches the network at all.
+
+**Getting to know you (`user.md`).** On the first start he asks *"May I look around?"*. On a *yes* he reads, on this
+machine only: the system name, your Git name, the hosts in `~/.ssh/config` and the readable ones in
+`~/.ssh/known_hosts`, and the **names** of your project folders (folders with a `.git`). He does not read file
+contents and not your shell history. He writes it into `~/.dante/user.md` — plain Markdown you can open and change.
+Every 20 days he asks whether to look again; `update` does it too. He knocks at a server over SSH only if you said yes
+to that server, read-only, with your own key.
+
+**The schedule (armed).** Only after a separate, clear *yes* he writes a schedule — a launchd agent on a Mac, a cron
+entry elsewhere — that starts `dante-watch --patrol` four times a day (00, 06, 12, 18 h). A patrol runs the checks on
+this machine and on the servers you approved, writes `~/.dante/diary.jsonl` and changes nothing; its only connections are
+SSH to those servers. You can ask him *"what happened?"* and he answers from the diary. `abschalten` / `disarm` /
+`desarmar` removes both schedules again; it is shown in plain words before it is written.
+
+**The deep run (`deep`, weekly if you said yes).** This is the one place where Dante **reads the content of your files**
+— locally, read-only: he searches your project folders (and the web roots of servers you approved) for keys, tokens
+and passwords left in code, with the formats of his check library (hundreds of patterns for AWS, GitHub, Stripe, private
+keys, database URLs, … built per system: he first looks which systems are there — `package.json`, `composer.json`,
+`requirements.txt` … — and uses only those patterns). On a hit he looks closer: file rights, is it in Git, was it ever
+committed, is it git-ignored. **He shows the file, the line and the kind of secret — never the value.** A key in a private,
+git-ignored file (your local `.env`) is normal and says so. Example files (`*.example`) and placeholder lines are skipped.
+He skips `node_modules`, `.git`, `vendor` and build folders. Nothing leaves your machine. It has its own schedule entry
+(Monday, 03:30) with its own yes, and while it runs it closes the lane: the patrol sees the lock and steps aside instead
+of waiting. A lock left behind by a crash is ignored after a few hours.
+
+**Models and agents (the pack "Hugging Face Analysis", `models`).** With this pack Dante looks at the AI models you downloaded
+(the Hugging Face cache `~/.cache/huggingface/hub`, `~/models`, your project folders) and at the configuration of your AI
+agents (for example `~/.claude.json`, Claude Desktop, Cursor, `.mcp.json`). For a model he reads names, sizes, the head of the
+README (the model card) and `config.json` — **never the weights**; for the Python files a model ships he reports the file, the
+line and the kind of pattern, not the code. For an agent configuration he reads the JSON locally and reports server, what it
+can do and what stands out — **never the values**, so no key or token is shown. Nothing leaves your machine. Without the pack
+he says what it is and offers to open the shop page.
+
+**Finding your servers (`find my servers`).** Dante reads `~/.ssh/config` and the readable host names in `~/.ssh/known_hosts`
+(code hosting such as github.com is left out). Only after a separate *yes* he also looks into your shell history, and there
+only at lines that start `ssh`, `scp` or `rsync`: he keeps who@where, how often, and the name of the key file, nothing else
+from the history. Servers found this way are entered in `user.md` with the patrol off; knocking at them (to read the system and
+PHP version) is another *yes*.
+
+**What system is this, and what is going on there?** (`what is my system`, `which is my mac`, `what is going on`, in German, English
+and Spanish). For this machine, a server you picked or all known servers, Dante runs a fixed list of harmless read-only probes
+(`/etc/os-release`, `uname`, `sw_vers`, `freebsd-version`, `hostname`, `df`, `uptime` and the like; the list is in `src/me/sysid.mjs`)
+and recognises the system from their output against a library of about 85 systems (Linux distributions, macOS, the BSDs, OpenWrt,
+OPNsense, Proxmox, ESXi, Synology and more). The library holds only patterns and facts, never a command of its own, and a system it
+does not recognise is called unknown, not guessed. "What is going on" adds the busiest processes, open ports, failed services and who
+is logged in. Everything shown is read off the machine; the "usual for this system" line (package manager, firewall, logs) comes from
+the library and is labelled that way.
+
+**"Is someone in between?" (a changed SSH host key).** When a server's key has changed, Dante offers a look, without logging in:
+he reads the public keys the server shows (`ssh-keyscan`), compares them with the ones remembered in your `known_hosts`
+(`ssh-keygen -F`), and, after a separate *yes*, also runs `ssh-keyscan` from one or two of your other servers over ssh. A rebuilt
+server shows the same new key from everywhere; an attacker on your own path shows your machine a different key than a server elsewhere
+sees. He reports what speaks for or against and never calls it safe: only a comparison with the provider's console proves the key
+is the server's own, and he prints the fingerprint to compare. Nothing is changed and nothing is sent anywhere.
+
+What he reads and writes on your machine: the folder `~/.dante/` — your token (mode 0600), the packs you installed,
+`user.md`, the diary, the small scripts the schedules start (`patrol.sh`, `deep.sh`), a lock file while the deep run is on, a note of when he last asked — plus the schedule entry if you
+armed him. Fixes happen only after a clear *yes*, with the exact commands shown first.
 
 - **No install hooks.** `npm install` runs no scripts. No `postinstall`, nothing executes on install.
-- **No dependencies.** Only Node (≥18) and its own modules (`child_process`, `fs`, `os`, `path`,
-  `readline`, `crypto`). Nothing is pulled in that you did not read.
-- **The code is readable.** The rest of the package is data: the language books and rules as plain
-  JSON (`src/bib/*.json`), no blobs, no obfuscation.
+- **No dependencies.** Only Node (≥18) and its own modules (`child_process`, `fs`, `os`, `path`, `readline`, `crypto`,
+  `worker_threads`, `url`). Nothing is pulled in that you did not read.
+- **The code is readable.** The rest of the package is data: the language books and rules as plain JSON
+  (`src/bib/*.json`), no blobs, no obfuscation.
 
 If you review packages for a living: this one does not phone home, and it says so here on purpose.
 Questions: info@nm-streetwear.space.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dante-watch",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Dante watches your own server and never lies to itself: every verdict carries the real line it came from.",
   "type": "module",
   "bin": {

package/src/bib/answers.mjs

@@ -1,5 +1,5 @@
-// What Dante says when he only explains. Max five lines each, and nothing in here claims a
-// result — verdicts only ever come from a check and its real line.
+// Canned answers for questions Dante can answer without running anything: five lines at most each.
+// None of them states a result; verdicts come only from a check and its evidence line.
 export const ANSWERS = {
   frage_luecke: {
     de: ["PHP2Shell (CVE-2026-109618/-619) ist eine Lücke im PHP-Kern.", "Wer sie trifft, kann über eine Webanfrage eigene Befehle auf dem Server ausführen (RCE).", "Betroffen sind nur Rechner mit PHP. Ob deiner es ist, sag ich dir erst mit echter Zeile:", "„prüf“ für diesen Rechner, „server user@host“ für einen Server."],