dante-watch 0.1.2 → 0.1.4

package/src/bib/router.mjs

@@ -1,18 +1,15 @@
-// The ear: turns what a human types into an intent + a probability. No LLM, no network.
-// Weighted naive Bayes over four kinds of features, learned by counting a bib of example lines:
-//   f: first word (the "starts with hi → greeting 78%" signal), w: words, b: word pairs,
-//   c: letter triples (so "prüff", "servr", "chek" still land). Each kind carries its own weight.
-// A feature found in many intents ("me", "wie", "bitte") says little, so it is weighed down by
-// how many intents share it — the bib decides what is a filler word, not a hand-made list.
-// The answer is honest about doubt: below the threshold, or when most of the words are unknown,
-// it does not guess — it says "unklar" and hands back the two best candidates.
+// Naive Bayes classifier for what the user typed: returns an intent and a probability. No network.
+// Four feature kinds are counted from the example library: first word, words, word pairs, letter
+// triples (so typos like "prüff" or "chek" still land). A feature shared by many intents counts for
+// less, which makes filler words fall out without a stop-word list. Below the confidence threshold it
+// answers "unklar" and returns the two best candidates instead of guessing.
 
 const WEIGHT = { f: 1.5, w: 1, b: 1, c: 0.25 };
 const ALPHA = 0.5;      // smoothing: an unseen pairing is rare, not impossible
-const SHARP = 2;        // measured on the held-out set: 1 → too shy, ≥2.5 → only bolder, not wiser
+const SHARP = 2;        // measured on the held-out set: 1 -> too shy, ≥2.5 -> only bolder, not wiser
 export const SURE = 0.6;     // below this the router asks instead of acting
 // Risk-weighted: an intent that only ANSWERS (a question, small talk, a greeting) may speak from
-// SURE_ANSWER on — a wrong answer is wrong text, never a deed. Actions keep SURE.
+// SURE_ANSWER on - a wrong answer is wrong text, never a deed. Actions keep SURE.
 // Measured (25.10.): 135 of 146 question misses had the right intent on top, only under 60 %.
 export const ANSWER_ONLY = new Set(["frage_luecke", "frage_urteil", "frage_gehackt", "frage_dante", "smalltalk", "gruss", "hilfe", "unklar"]);
 export let SURE_ANSWER = Number(process.env.DANTE_SURE_ANSWER || 0.4);
@@ -48,13 +45,13 @@ export function features(text) {
   return out;
 }
 
-// The model only keeps raw counts, so it can learn one line at a time (the kitchen loop adds a
-// line the moment it finds a gap and checks again right away). Everything derived — balance,
-// filler-word weight, trust — is worked out at the moment of hearing, from those counts.
+// The model only keeps raw counts, so it can learn one line at a time (the build server loop adds a
+// line the moment it finds a gap and checks again right away). Everything derived - balance,
+// filler-word weight, trust - is worked out at the moment of hearing, from those counts.
 // balance: every intent weighs the same in total, so one huge intent ("unklar", 10× the others)
 // keeps its breadth of words but stops winning by sheer mass. Measured on the bib, not guessed.
 // trust: a feature seen once ("prüff" in one single line) gets a fifth of its weight, full weight
-// from TRUST sightings on — one example must not turn into "99.9 % sure".
+// from TRUST sightings on - one example must not turn into "99.9 % sure".
 const TRUST = 5; // measured: 3 still let one "prüff"-line decide alone, 5 does not
 
 export function model({ balance = true, trust = TRUST } = {}) {
@@ -73,7 +70,7 @@ export function learn(m, { intent, text }) {
   return m;
 }
 
-// The exact inverse of learn — the kitchen takes a line back out when it proved too broad.
+// The exact inverse of learn - the build server takes a line back out when it proved too broad.
 export function unlearn(m, { intent, text }) {
   const k = m.intents[intent];
   if (!k) return m;
@@ -112,8 +109,8 @@ export function classify(m, text, { sharp = SHARP, all = false } = {}) {
   };
   const words = tokens(text);
   const known = words.length ? words.filter(knownWord).length / words.length : 0;
-  // Complement: judge each intent by how badly the line fits ALL THE OTHERS. Big intents
-  // (400 lines) then stop swallowing small ones (160 lines) — "ich geh jetzt" stays "raus".
+  // Complement: judge each intent by how badly the line fits all the OTHERS. Big intents
+  // (400 lines) then stop swallowing small ones (160 lines) - "ich geh jetzt" stays "raus".
   const restTotal = names.reduce((a, c, i) => a + scale[i] * totals[i], 0);
   const rest = fs.map(([f]) => names.reduce((a, c, i) => a + scale[i] * (m.intents[c].f[f] || 0), 0));
   const raw = names.map((c, i) => {
@@ -132,11 +129,11 @@ export function classify(m, text, { sharp = SHARP, all = false } = {}) {
   return { intent: sure ? best.intent : "unklar", p: best.p, known, ranked: all ? ranked : ranked.slice(0, 3) };
 }
 
-// "this machine" in any of the three languages — a slot, not an intent: "check local" is a check
+// "this machine" in any of the three languages - a slot, not an intent: "check local" is a check
 // whose target is here. A word list decides it, no probability in between.
 const LOCAL = /(^|\s)(lokal|local|localhost|hier|here|aqu[ií]|diese[nm]? (rechner|laptop|mac|pc)|meine?[nm]? (rechner|laptop|mac|pc)|this (machine|computer|box|laptop|mac|pc)|my (own )?(machine|computer|box|laptop|mac|pc)|mi (compu|computadora|pc|equipo|laptop|mac)|este equipo|esta (compu|computadora|pc))(?=$|[\s,.!?])/i;
 
-// The value a command needs (target / key path / local), read from the raw line — never invented.
+// The value a command needs (target / key path / local), read from the raw line - never invented.
 export function slots(text) {
   const ziel = String(text).match(/\b[\w.-]+@[\w.-]+\b/) || String(text).match(/\b\d{1,3}(\.\d{1,3}){3}\b/);
   const pfad = String(text).match(/(?:^|\s)((?:~|\.{0,2})\/\S+)/);

package/src/bib/system.mjs

@@ -1,16 +1,10 @@
-// The sixth bib: system knowledge — kept apart from the five language bibs on purpose.
-// The language router (the "intent catcher") hears the user; when the move is a system job it
-// OPENS this book and works. Two parts:
-//   S        — the moves Dante must RECOGNISE (grows via the same kitchen loop as the language bib)
-//   RECIPES  — the HANDS: per system family, the exact command and which real line means a hit.
-// There is no E1/E2/E3 depth here: nothing personal to anonymise. The only split is the family,
-// and the family is a SLOT (like ziel/pfad), picked by the fingerprint — not an intent.
-// Dante does not trust what the user says the system is. He reads os-release himself first; that
-// reading is itself a recipe in this book (intent "fingerabdruck").
+// Seeds for the three domain classifiers (system moves, check requests, knowledge questions) and the
+// recipes for system-specific commands. The OS family is read from the target itself
+// (os-release), never taken from what the user says. Unknown families yield "unbekannt", not a verdict.
 
-// System families Dante can stand on. Everything else is "unbekannt" → Dante says so, never SAFE.
+// System families Dante can stand on. Everything else is "unbekannt" -> Dante says so, never SAFE.
 export const FAMILIES = ["debian", "alpine", "fedora", "arch", "unbekannt"];
-// os-release ID / ID_LIKE → family (the fingerprint maps real output to one column).
+// os-release ID / ID_LIKE -> family (the fingerprint maps real output to one column).
 export const FAMILY_OF = {
   debian: "debian", ubuntu: "debian", raspbian: "debian", mint: "debian", devuan: "debian",
   alpine: "alpine",
@@ -20,7 +14,6 @@ export const FAMILY_OF = {
 
 // Seed phrasings per intent (DE/EN/ES), only to prove the ear. The real bib is cooked by the loop.
 const S = {
-  fingerabdruck: ["auf welchem system bin ich", "was läuft hier für ein os", "welche distro", "bin auf debian 11", "ich hab ubuntu", "läuft auf alpine", "das ist ein centos", "which os is this", "im on debian", "running ubuntu 22", "its alpine", "en que sistema estoy", "tengo debian", "es un centos"],
   finde_php: ["läuft hier php", "welche php version", "wo ist mein php", "php 8.1 mit nginx", "ich hab php-fpm", "hab php 7.4 noch", "is php running", "what php version", "php 8.2 fpm", "where is php", "corre php aqui", "que version de php", "tengo php 8.0"],
   pruef_php2shell: ["bin ich von php2shell betroffen", "ist meine php version die lücke", "cve-2026-109618 bei mir", "php 8.1.5 sicher", "ist das die rce lücke", "am i affected by php2shell", "is my php version vulnerable", "php 8.2.3 safe", "estoy afectado por php2shell", "mi php es vulnerable"],
   beleg: ["zeig mir die zeile", "woran siehst du das", "was ist der beweis", "welche zeile beweist das", "show me the line", "whats the proof", "how do you know", "muestrame la linea", "cual es la prueba"],
@@ -29,8 +22,20 @@ const S = {
 export const SYS_PROBE = Object.entries(S).flatMap(([intent, xs]) => xs.map((text) => ({ intent, text })));
 
 // The Muster-Bib seed: how a user asks the watchman to look for what is WRONG (beyond php2shell).
-// Recognition only — the hands are the deterministic battery in src/checks/. Grown by the loop.
+// Recognition only - the hands are the deterministic battery in src/checks/. Grown by the loop.
+// lines of the old system-ear intent "fingerabdruck": they now belong to the muster intent meinsystem (same answer)
+const FINGERPRINT_LINES = ["auf welchem system bin ich", "was läuft hier für ein os", "welche distro", "bin auf debian 11", "ich hab ubuntu", "läuft auf alpine", "das ist ein centos", "which os is this", "im on debian", "running ubuntu 22", "its alpine", "en que sistema estoy", "tengo debian", "es un centos"];
 const M = {
+  umschauen: ["schau dich um", "lern mich kennen", "sieh dich mal um", "was weißt du über meinen rechner", "mach dich mit meinem system vertraut", "look around", "get to know my machine", "have a look at my setup", "mira a tu alrededor", "conoce mi equipo", "echa un vistazo a mi sistema"],
+  scharf: ["schalt dich scharf", "aktiviere die patrouille", "lauf mehrmals am tag", "überwache mich automatisch", "arm yourself", "turn on the patrol", "run on a schedule", "watch my machine automatically", "ponte en marcha", "activa la patrulla", "revisa automáticamente"],
+  systeme_info: ["was kannst du mir über meine systeme sagen", "erzähl mir was über meine rechner", "gib mir einen überblick über alles was ich habe", "was weißt du über meine maschinen", "tell me about my systems", "what can you tell me about my machines", "give me an overview of everything i own", "dime algo de mis sistemas", "qué sabes de mis equipos", "dame un resumen de todo lo que tengo"],
+  was_los: ["was ist da los", "was geht auf dem server ab", "was läuft gerade auf meinem rechner", "warum ist der so langsam", "wer ist gerade eingeloggt", "welche ports sind offen", "what's going on on my server", "what is running right now", "why is it so slow", "who is logged in", "which ports are open", "qué pasa en mi servidor", "qué está corriendo ahora", "por qué va tan lento", "quién está conectado", "qué puertos están abiertos"],
+  meinsystem: [...FINGERPRINT_LINES, "was ist mein system", "welcher ist mein mac", "was für ein rechner ist das", "welches betriebssystem hab ich", "wie viel ram hab ich", "zeig mir die systeminfo", "what machine is this", "which os am i running", "what is my mac", "show system info", "how much memory do i have", "qué sistema tengo", "qué ordenador es este", "cuánta memoria tengo", "info del sistema", "qué versión de linux es"],
+  server_finden: ["finde meine server", "such mal meine server", "spür meine rechner auf", "entdecke meine server", "find my servers", "discover my machines", "look for my servers", "search for servers i own", "busca mis servidores", "encuentra mis servidores", "descubre mis máquinas", "encuentra mis servidores por favor"],
+  server_status: ["wie geht's meinen servern", "wie läuft es bei meinen servern", "alles ok bei meinen servern", "wie stehen meine server da", "status meiner server", "how are my servers", "how are my servers doing", "is everything ok with my servers", "status of my servers", "cómo están mis servidores", "cómo van mis servidores", "todo bien con mis servidores"],
+  server_liste: ["kennst du meine server", "welche server hast du gefunden", "was für server hab ich", "zeig mir meine server", "welche rechner kennst du von mir", "liste meine server auf", "weißt du welche server ich habe", "do you know my servers", "which servers did you find", "what servers do i have", "list my servers", "show me my machines", "qué servidores conoces", "cuáles son mis servidores", "muéstrame mis servidores", "conoces mis servidores"],
+  hf: ["prüf meine modelle", "ist das modell sicher zu laden", "schau dir meine ki modelle an", "was darf mein agent", "prüf meine mcp server", "check meine huggingface modelle", "laden meine gewichte fremden code", "check my models", "are my huggingface models safe to load", "look at my mcp servers", "what is my agent allowed to do", "scan my downloaded models", "revisa mis modelos", "son seguros mis modelos de hugging face", "mira mis servidores mcp", "qué puede hacer mi agente"],
+  abschalten: ["schalt dich ab", "stopp die patrouille", "lauf nicht mehr automatisch", "nimm den zeitplan raus", "disarm", "turn off the patrol", "stop running automatically", "remove the schedule", "desarmar", "apaga la patrulla", "quita el horario"],
   patrouille: ["prüf alles", "mach die runde", "kompletter check", "check alles durch", "alles scannen", "komplett prüfen", "mach die ganze runde", "scan everything", "full check", "run all checks", "check everything", "revisa todo", "chequeo completo", "escanéalo todo"],
   webshell: ["hat mir wer was reingelegt", "gibt es fremde dateien", "such nach webshells", "ist ne hintertür drin", "schädliche php dateien", "backdoor finden", "fremder code im webroot", "check for webshells", "any backdoor files", "malicious php files", "look for a shell", "busca webshells", "archivos maliciosos", "hay una puerta trasera"],
   secrets: ["ist meine env offen", "leaken meine geheimnisse", "ist mein git public", "sind passwörter sichtbar", "liegt die .env offen", "db passwort sichtbar", "are my secrets exposed", "is my .env public", "exposed env file", "secrets leaking", "mis secretos están expuestos", "está mi env público", "contraseña de la base visible"],
@@ -39,6 +44,7 @@ const M = {
 };
 // The Fachwissen seed: how people ask Dante to explain (what he watches / one topic or finding).
 const W = {
+  bericht: ["was ist passiert", "was hast du gemacht", "gibt es was neues", "wie lief die nacht", "hast du was gefunden", "was war seit gestern", "what happened", "what did you do", "anything new", "did you find anything", "what was going on while i was away", "qué pasó", "qué hiciste", "hay novedades", "encontraste algo", "cómo fue la noche"],
   job: ["was überwachst du", "was ist dein job", "was prüfst du alles", "wofür bist du da", "was kannst du inhaltlich", "worauf achtest du", "what do you watch", "what is your job", "what do you check", "what are you for", "what do you look for", "que vigilas", "cual es tu trabajo", "que revisas", "para que sirves", "en que te fijas"],
   thema: ["was ist eine webshell", "woran erkenne ich offene geheimnisse", "warum ist root login gefährlich", "wie prüfst du ssh", "ist das normal", "was tue ich dagegen", "was bedeutet php2shell", "what is a webshell", "what stands out about open secrets", "why is root login dangerous", "how do you check ssh", "is that normal", "what do i do about it", "que es una webshell", "que llama la atencion en los permisos", "por que es peligroso el login de root", "como compruebas ssh", "es normal esto", "que hago al respecto"],
 };
@@ -46,11 +52,11 @@ export const WISSEN_PROBE = Object.entries(W).flatMap(([intent, xs]) => xs.map((
 
 export const MUSTER_PROBE = Object.entries(M).flatMap(([intent, xs]) => xs.map((text) => ({ intent, text })));
 
-// The HANDS. Per family: the exact command Dante runs on the real server, and the rule that reads
-// the real output. Small and hand-verified — this is where "every verdict carries a real line"
+// The hands. Per family: the exact command Dante runs on the real server, and the rule that reads
+// the real output. Small and hand-verified - this is where "every verdict carries a real line"
 // lives. The loop may PROPOSE additions, but a recipe is only the shape below; the hit-logic is
 // deterministic code in src, never DeepSeek prose. php2shell = CVE-2026-109618 (fictional here):
-// affected PHP < 8.1.27, 8.2.0–8.2.13, 8.3.0–8.3.1 — AND only when the vulnerable module is loaded.
+// affected PHP < 8.1.27, 8.2.0–8.2.13, 8.3.0–8.3.1 - and only when the vulnerable module is loaded.
 export const RECIPES = {
   debian: {
     fingerabdruck: { cmd: ". /etc/os-release 2>/dev/null; echo \"$ID ${VERSION_ID}\"", beleg: "die ID-Zeile aus /etc/os-release" },

package/src/bib/systems.json

@@ -0,0 +1 @@
+{"v":1,"systems":[{"id":"opnsense","kind":"router","name":{"de":"OPNsense","en":"OPNsense","es":"OPNsense"},"identify":[{"probe":"freebsd_version","re":"^[0-9]+\\.[0-9]+-"},{"probe":"uname","re":"^FreeBSD "},{"probe":"opnsense_version","re":"^OPNsense"}],"facts":{"pkg":"pkg","init":"rc","firewall":"pf","logs":"/var/log","sshd":"/etc/ssh/sshd_config"}},{"id":"amazon-linux-2","kind":"server","name":{"de":"Amazon Linux 2","en":"Amazon Linux 2","es":"Amazon Linux 2"},"identify":[{"probe":"os_release","re":"^ID=\"amzn\"$"},{"probe":"os_release","re":"^VERSION_ID=\"2.*\"$"},{"probe":"uname","re":"^Linux.*"}],"facts":{"pkg":"yum","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"freebsd","kind":"server","name":{"de":"FreeBSD","en":"FreeBSD","es":"FreeBSD"},"identify":[{"probe":"freebsd_version","re":"^[0-9]+\\.[0-9]+-"},{"probe":"uname","re":"^FreeBSD "}],"facts":{"pkg":"pkg","init":"rc","firewall":"pf, ipfw","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"pfsense","kind":"router","name":{"de":"pfSense","en":"pfSense","es":"pfSense"},"identify":[{"probe":"platform_file","re":"^pfSense"},{"probe":"uname","re":"^FreeBSD "}],"facts":{"pkg":"pkg","init":"rc","firewall":"pf","logs":"/var/log","sshd":"/etc/ssh/sshd_config"}},{"id":"proxmox-ve","kind":"hypervisor","name":{"de":"Proxmox VE","en":"Proxmox VE","es":"Proxmox VE"},"identify":[{"probe":"os_release","re":"^ID=\"?debian\"?$"},{"probe":"proxmox","re":"^pve-manager/"}],"facts":{"pkg":"apt","init":"systemd","firewall":"pve-firewall (nftables)","logs":"journalctl","sshd":"/etc/ssh/sshd_config"}},{"id":"almalinux","kind":"server","name":{"de":"AlmaLinux","en":"AlmaLinux","es":"AlmaLinux"},"identify":[{"probe":"os_release","re":"^ID=\"almalinux\"$"},{"probe":"redhat_release","re":"^AlmaLinux release .*"}],"facts":{"pkg":"dnf","init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"android","kind":"other","name":{"de":"Android","en":"Android","es":"Android"},"identify":[{"probe":"os_release","re":"^ID=\"?android\"?$"},{"probe":"version_file","re":"^Android version.*$"}],"facts":{}},{"id":"android-tv","kind":"other","name":{"de":"Android TV","en":"Android TV","es":"Android TV"},"identify":[{"probe":"os_release","re":"^ID=\"?android\"?$"},{"probe":"uname","re":"^Linux .* (aarch64|armv7l|armv8l).*$"}],"facts":{}},{"id":"antix","kind":"desktop","name":{"de":"antiX","en":"antiX","es":"antiX"},"identify":[{"probe":"os_release","re":"^ID=\"?antix\"?$"},{"probe":"os_release","re":"^NAME=\"?antiX\"?"}],"facts":{"pkg":"apt","init":"sysvinit","firewall":"iptables"}},{"id":"centos-stream","kind":"server","name":{"de":"CentOS Stream","en":"CentOS Stream","es":"CentOS Stream"},"identify":[{"probe":"os_release","re":"^ID=\"?centos\"?$"},{"probe":"os_release","re":"^NAME=\"?CentOS Stream\"?$"}],"facts":{"pkg":"dnf","init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"coreos","kind":"container","name":{"de":"CoreOS Container Linux","en":"CoreOS Container Linux","es":"CoreOS Container Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?coreos\"?$"},{"probe":"version_file","re":"^VERSION=\"?.*\"?$"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"dd-wrt","kind":"router","name":{"de":"DD-WRT","en":"DD-WRT","es":"DD-WRT"},"identify":[{"probe":"os_release","re":"^ID=\"dd-wrt\"$"},{"probe":"device_model","re":"^.*$"}],"facts":{"pkg":"opkg","firewall":"iptables"}},{"id":"dragonflybsd","kind":"server","name":{"de":"DragonFly BSD","en":"DragonFly BSD","es":"DragonFly BSD"},"identify":[{"probe":"os_release","re":"^ID=\"dragonfly\"$"},{"probe":"freebsd_version","re":"^.*$"}],"facts":{"pkg":"pkg","init":"rc"}},{"id":"elementary-os","kind":"desktop","name":{"de":"elementary OS","en":"elementary OS","es":"elementary OS"},"identify":[{"probe":"os_release","re":"^ID=\"?elementary\"?$"},{"probe":"os_release","re":"^NAME=\"?elementary OS\"?$"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/syslog"}},{"id":"hp-ux","kind":"server","name":{"de":"HP-UX","en":"HP-UX","es":"HP-UX"},"identify":[{"probe":"uname","re":"^HP-UX .*"},{"probe":"issue","re":"^HP-UX"}],"facts":{"logs":"/var/adm/syslog/syslog.log"}},{"id":"juniper-junos","kind":"router","name":{"de":"Juniper Junos","en":"Juniper Junos","es":"Juniper Junos"},"identify":[{"probe":"uname","re":"^JUNOS"},{"probe":"uname","re":"JNPR"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"linux-lite","kind":"desktop","name":{"de":"Linux Lite","en":"Linux Lite","es":"Linux Lite"},"identify":[{"probe":"os_release","re":"^ID=\"?linuxlite\"?$"},{"probe":"os_release","re":"^NAME=\"?Linux Lite\"?$"}],"facts":{"pkg":"apt","init":"systemd"}},{"id":"linux-mint","kind":"desktop","name":{"de":"Linux Mint","en":"Linux Mint","es":"Linux Mint"},"identify":[{"probe":"os_release","re":"^ID=\"?linuxmint\"?$"},{"probe":"os_release","re":"^NAME=\"?Linux Mint\"?$"}],"facts":{"pkg":"apt","init":"systemd","firewall":"ufw","logs":"/var/log/syslog","sshd":"/etc/ssh/sshd_config"}},{"id":"macos","kind":"desktop","name":{"de":"macOS","en":"macOS","es":"macOS"},"identify":[{"probe":"sw_vers","re":"^ProductName:[[:space:]]*macOS"},{"probe":"uname","re":"^Darwin"}],"facts":{"init":"launchd","sshd":"/etc/ssh/sshd_config"}},{"id":"mx-linux","kind":"desktop","name":{"de":"MX Linux","en":"MX Linux","es":"MX Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?mx\"?$"},{"probe":"os_release","re":"^NAME=\"?MX Linux\"?$"}],"facts":{"pkg":"apt","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"openbsd","kind":"server","name":{"de":"OpenBSD","en":"OpenBSD","es":"OpenBSD"},"identify":[{"probe":"uname","re":"^OpenBSD .*"},{"probe":"hw_model","re":"^[A-Za-z0-9].*"}],"facts":{"firewall":"pf","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"opensuse-leap","kind":"server","name":{"de":"openSUSE Leap","en":"openSUSE Leap","es":"openSUSE Leap"},"identify":[{"probe":"os_release","re":"^ID=\"opensuse-leap\"$"},{"probe":"os_release","re":"^VERSION_ID=\".*\"$"}],"facts":{"pkg":"zypper","init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"opensuse-tumbleweed","kind":"desktop","name":{"de":"openSUSE Tumbleweed","en":"openSUSE Tumbleweed","es":"openSUSE Tumbleweed"},"identify":[{"probe":"os_release","re":"^ID=\"?opensuse-tumbleweed\"?$"},{"probe":"os_release","re":"^NAME=\"?openSUSE Tumbleweed\"?$"}],"facts":{"pkg":"zypper","init":"systemd","firewall":"firewalld","sshd":"/etc/ssh/sshd_config"}},{"id":"pclinuxos","kind":"desktop","name":{"de":"PCLinuxOS","en":"PCLinuxOS","es":"PCLinuxOS"},"identify":[{"probe":"os_release","re":"^ID=\"?pclinuxos\"?$"},{"probe":"os_release","re":"^NAME=\"?PCLinuxOS\"?$"}],"facts":{"init":"systemd","firewall":"iptables","sshd":"/etc/ssh/sshd_config"}},{"id":"peppermint-os","kind":"desktop","name":{"de":"Peppermint OS","en":"Peppermint OS","es":"Peppermint OS"},"identify":[{"probe":"os_release","re":"^ID=\"?peppermint\"?$"},{"probe":"os_release","re":"^NAME=\"?Peppermint OS\"?$"}],"facts":{"pkg":"apt","init":"systemd","firewall":"ufw","sshd":"/etc/ssh/sshd_config"}},{"id":"puppy-linux","kind":"desktop","name":{"de":"Puppy Linux","en":"Puppy Linux","es":"Puppy Linux"},"identify":[{"probe":"os_release","re":"^(ID=\"?puppy\"?|NAME=\"?Puppy Linux\"?)$"},{"probe":"version_file","re":"puppy"}],"facts":{}},{"id":"q4os","kind":"desktop","name":{"de":"Q4OS","en":"Q4OS","es":"Q4OS"},"identify":[{"probe":"os_release","re":"^ID=\"?q4os\"?$"},{"probe":"os_release","re":"^NAME=\"?Q4OS\"?$"}],"facts":{"pkg":"apt","init":"systemd","firewall":"ufw","sshd":"/etc/ssh/sshd_config"}},{"id":"raspberry-pi-os","kind":"embedded","name":{"de":"Raspberry Pi OS","en":"Raspberry Pi OS","es":"Raspberry Pi OS"},"identify":[{"probe":"os_release","re":"^ID=\"?raspbian\"?$"},{"probe":"device_model","re":"^Raspberry Pi"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/syslog"}},{"id":"rhel","kind":"server","name":{"de":"Red Hat Enterprise Linux","en":"Red Hat Enterprise Linux","es":"Red Hat Enterprise Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?rhel\"?$"},{"probe":"redhat_release","re":"^Red Hat Enterprise Linux"}],"facts":{"pkg":"dnf","init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"rockstor","kind":"nas","name":{"de":"Rockstor","en":"Rockstor","es":"Rockstor"},"identify":[{"probe":"os_release","re":"^ID=\"?rockstor\"?$"},{"probe":"os_release","re":"^NAME=\"?Rockstor\"?$"}],"facts":{"init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"slackware","kind":"desktop","name":{"de":"Slackware Linux","en":"Slackware Linux","es":"Slackware Linux"},"identify":[{"probe":"os_release","re":"^NAME=\"?Slackware\"?$"},{"probe":"version_file","re":"^Slackware [0-9]+\\.[0-9]+"}],"facts":{"firewall":"iptables","sshd":"/etc/ssh/sshd_config"}},{"id":"solaris","kind":"server","name":{"de":"Oracle Solaris","en":"Oracle Solaris","es":"Oracle Solaris"},"identify":[{"probe":"uname","re":"^SunOS [^ ]+ 5\\.[0-9]+ .*"},{"probe":"issue","re":"^(Oracle )?Solaris"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"sonic","kind":"router","name":{"de":"SONiC","en":"SONiC","es":"SONiC"},"identify":[{"probe":"os_release","re":"^ID=\"?sonic\"?$"},{"probe":"version_file","re":"sonic"}],"facts":{"pkg":"apt","init":"systemd","firewall":"iptables"}},{"id":"tizen","kind":"other","name":{"de":"Tizen","en":"Tizen","es":"Tizen"},"identify":[{"probe":"os_release","re":"^ID=\"?tizen\"?$"},{"probe":"version_file","re":"tizen"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"tomato","kind":"router","name":{"de":"Tomato","en":"Tomato","es":"Tomato"},"identify":[{"probe":"os_release","re":"^ID=\"?tomato\"?$"},{"probe":"issue","re":"tomato"}],"facts":{"firewall":"iptables","logs":"/var/log/messages"}},{"id":"truenas-core","kind":"nas","name":{"de":"TrueNAS CORE","en":"TrueNAS CORE","es":"TrueNAS CORE"},"identify":[{"probe":"version_file","re":"^TrueNAS-.*"},{"probe":"uname","re":"FreeBSD"}],"facts":{"pkg":"pkg","firewall":"pf","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"truenas-scale","kind":"nas","name":{"de":"TrueNAS SCALE","en":"TrueNAS SCALE","es":"TrueNAS SCALE"},"identify":[{"probe":"os_release","re":"^ID=\"truenas\"$"},{"probe":"version_file","re":"^VERSION=\"1\\.2\\.0\"$"}],"facts":{}},{"id":"webos","kind":"other","name":{"de":"webOS","en":"webOS","es":"webOS"},"identify":[{"probe":"os_release","re":"^ID=\"?webos\"?$"},{"probe":"os_release","re":"^NAME=\"?webOS\"?$"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"xcp-ng","kind":"hypervisor","name":{"de":"XCP-ng","en":"XCP-ng","es":"XCP-ng"},"identify":[{"probe":"os_release","re":"^ID=\"xcp-ng\"$"},{"probe":"version_file","re":"^XCP-ng version .*$"}],"facts":{"init":"systemd","firewall":"iptables","sshd":"/etc/ssh/sshd_config"}},{"id":"zorin-os","kind":"desktop","name":{"de":"Zorin OS","en":"Zorin OS","es":"Zorin OS"},"identify":[{"probe":"os_release","re":"^ID=\"?zorin\"?$"},{"probe":"os_release","re":"^NAME=\"?Zorin OS\"?$"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/syslog","sshd":"/etc/ssh/sshd_config"}},{"id":"amazon-linux","kind":"server","name":{"de":"Amazon Linux","en":"Amazon Linux","es":"Amazon Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?amzn\"?$"}],"facts":{"pkg":"dnf, yum","init":"systemd","firewall":"nftables, iptables","logs":"journalctl","sshd":"/etc/ssh/sshd_config"}},{"id":"esxi","kind":"hypervisor","name":{"de":"VMware ESXi","en":"VMware ESXi","es":"VMware ESXi"},"identify":[{"probe":"esxi","re":"^VMware ESXi"}],"facts":{"pkg":"esxcli software","init":"init scripts","firewall":"esxcli network firewall","logs":"/var/log","sshd":"/etc/ssh/sshd_config"}},{"id":"openwrt","kind":"router","name":{"de":"OpenWrt","en":"OpenWrt","es":"OpenWrt"},"identify":[{"probe":"openwrt_release","re":"^DISTRIB_ID='?OpenWrt"}],"facts":{"pkg":"opkg, apk","init":"procd","firewall":"fw4 (nftables)","logs":"logread","sshd":"/etc/config/dropbear"}},{"id":"oracle-linux","kind":"server","name":{"de":"Oracle Linux","en":"Oracle Linux","es":"Oracle Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?ol\"?$"}],"facts":{"pkg":"dnf, yum","init":"systemd","firewall":"firewalld","logs":"journalctl","sshd":"/etc/ssh/sshd_config"}},{"id":"rocky-linux","kind":"server","name":{"de":"Rocky Linux","en":"Rocky Linux","es":"Rocky Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?rocky\"?$"}],"facts":{"pkg":"dnf","init":"systemd","firewall":"firewalld","logs":"journalctl","sshd":"/etc/ssh/sshd_config"}},{"id":"synology-dsm","kind":"nas","name":{"de":"Synology DSM","en":"Synology DSM","es":"Synology DSM"},"identify":[{"probe":"synology","re":"^productversion=\"?[0-9]"}],"facts":{"pkg":"Paketzentrum (synopkg)","init":"systemd","firewall":"DSM-Firewall (iptables)","logs":"/var/log","sshd":"/etc/ssh/sshd_config"}},{"id":"alpine","kind":"server","name":{"de":"Alpine Linux","en":"Alpine Linux","es":"Alpine Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?alpine\"?$"}],"facts":{"pkg":"apk","init":"OpenRC"}},{"id":"arch-linux","kind":"server","name":{"de":"Arch Linux","en":"Arch Linux","es":"Arch Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?arch\"?$"}],"facts":{"pkg":"pacman","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"arista-eos","kind":"router","name":{"de":"Arista EOS","en":"Arista EOS","es":"Arista EOS"},"identify":[{"probe":"os_release","re":"^ID=\"?eos\"?$"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"artix-linux","kind":"desktop","name":{"de":"Artix Linux","en":"Artix Linux","es":"Artix Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?artix\"?$"}],"facts":{"pkg":"pacman","init":"openrc"}},{"id":"balenaos","kind":"embedded","name":{"de":"balenaOS","en":"balenaOS","es":"balenaOS"},"identify":[{"probe":"os_release","re":"^ID=\"?balena\"?$"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"bottlerocket","kind":"container","name":{"de":"Bottlerocket","en":"Bottlerocket","es":"Bottlerocket"},"identify":[{"probe":"os_release","re":"^ID=\"?bottlerocket\"?$"}],"facts":{"init":"systemd"}},{"id":"centos","kind":"server","name":{"de":"CentOS","en":"CentOS","es":"CentOS"},"identify":[{"probe":"os_release","re":"^ID=\"?centos\"?$"}],"facts":{"init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"chromeos","kind":"desktop","name":{"de":"ChromeOS","en":"ChromeOS","es":"ChromeOS"},"identify":[{"probe":"os_release","re":"^ID=\"?chromeos\"?$"}],"facts":{}},{"id":"cisco-ios","kind":"router","name":{"de":"Cisco IOS","en":"Cisco IOS","es":"Cisco IOS"},"identify":[{"probe":"os_release","re":"^ID=\"?cisco-ios\"?$"}],"facts":{}},{"id":"clearos","kind":"server","name":{"de":"ClearOS","en":"ClearOS","es":"ClearOS"},"identify":[{"probe":"os_release","re":"^ID=\"?clearos\"?$"}],"facts":{"pkg":"yum","init":"systemd","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"debian","kind":"server","name":{"de":"Debian GNU/Linux","en":"Debian GNU/Linux","es":"Debian GNU/Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?debian\"?$"}],"facts":{"pkg":"apt","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"deepin","kind":"desktop","name":{"de":"deepin","en":"deepin","es":"deepin"},"identify":[{"probe":"os_release","re":"^ID=\"?deepin\"?$"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/syslog"}},{"id":"dietpi","kind":"embedded","name":{"de":"DietPi","en":"DietPi","es":"DietPi"},"identify":[{"probe":"os_release","re":"^ID=\"?dietpi\"?$"}],"facts":{"pkg":"apt","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"fedora","kind":"desktop","name":{"de":"Fedora","en":"Fedora","es":"Fedora"},"identify":[{"probe":"os_release","re":"^ID=\"?fedora\"?$"}],"facts":{"pkg":"dnf","init":"systemd","firewall":"firewalld","sshd":"/etc/ssh/sshd_config"}},{"id":"flatcar","kind":"container","name":{"de":"Flatcar Container Linux","en":"Flatcar Container Linux","es":"Flatcar Container Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?flatcar\"?$"}],"facts":{"init":"systemd"}},{"id":"freenas","kind":"nas","name":{"de":"FreeNAS","en":"FreeNAS","es":"FreeNAS"},"identify":[{"probe":"os_release","re":"^ID=\"freebsd\"$"}],"facts":{}},{"id":"garuda-linux","kind":"desktop","name":{"de":"Garuda Linux","en":"Garuda Linux","es":"Garuda Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?garuda\"?$"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"google-container-optimized-os","kind":"server","name":{"de":"Google Container-Optimized OS","en":"Google Container-Optimized OS","es":"Google Container-Optimized OS"},"identify":[{"probe":"os_release","re":"^ID=\"?cos\"?$"}],"facts":{"init":"systemd"}},{"id":"illumos","kind":"server","name":{"de":"illumos","en":"illumos","es":"illumos"},"identify":[{"probe":"uname","re":"^SunOS .* (illumos|oi|omnios|openindiana).*"}],"facts":{"init":"smf","sshd":"/etc/ssh/sshd_config"}},{"id":"kali-linux","kind":"server","name":{"de":"Kali Linux","en":"Kali Linux","es":"Kali Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?kali\"?$"}],"facts":{"pkg":"apt","init":"systemd","sshd":"/etc/ssh/sshd_config"}},{"id":"manjaro","kind":"desktop","name":{"de":"Manjaro Linux","en":"Manjaro Linux","es":"Manjaro Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?manjaro\"?$"}],"facts":{"pkg":"pacman","init":"systemd"}},{"id":"mikrotik-routeros","kind":"router","name":{"de":"MikroTik RouterOS","en":"MikroTik RouterOS","es":"MikroTik RouterOS"},"identify":[{"probe":"os_release","re":"^ID=\"routeros\"$"}],"facts":{}},{"id":"minix","kind":"other","name":{"de":"MINIX 3","en":"MINIX 3","es":"MINIX 3"},"identify":[{"probe":"uname","re":"^.*MINIX.*$"}],"facts":{}},{"id":"netbsd","kind":"server","name":{"de":"NetBSD","en":"NetBSD","es":"NetBSD"},"identify":[{"probe":"uname","re":"^NetBSD "}],"facts":{"init":"rc.d","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"openfiler","kind":"nas","name":{"de":"Openfiler","en":"Openfiler","es":"Openfiler"},"identify":[{"probe":"os_release","re":"^ID=\"openfiler\"$"}],"facts":{"firewall":"iptables","sshd":"/etc/ssh/sshd_config"}},{"id":"pop-os","kind":"desktop","name":{"de":"Pop!_OS","en":"Pop!_OS","es":"Pop!_OS"},"identify":[{"probe":"os_release","re":"^ID=\"?pop\"?$"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/syslog","sshd":"/etc/ssh/sshd_config"}},{"id":"qnap-qts","kind":"nas","name":{"de":"QNAP QTS","en":"QNAP QTS","es":"QNAP QTS"},"identify":[{"probe":"platform_file","re":"^TS-\\S+|^NAS\\b|QNAP"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"rancher-os","kind":"container","name":{"de":"RancherOS","en":"RancherOS","es":"RancherOS"},"identify":[{"probe":"os_release","re":"^ID=\"?rancheros\"?$"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"solus","kind":"desktop","name":{"de":"Solus","en":"Solus","es":"Solus"},"identify":[{"probe":"os_release","re":"^ID=\"?solus\"?$"}],"facts":{"pkg":"eopkg","init":"systemd"}},{"id":"suse-linux-enterprise-server","kind":"server","name":{"de":"SUSE Linux Enterprise Server","en":"SUSE Linux Enterprise Server","es":"SUSE Linux Enterprise Server"},"identify":[{"probe":"os_release","re":"^ID=\"?sles\"?$"}],"facts":{"pkg":"zypper","init":"systemd","firewall":"firewalld","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"tails","kind":"desktop","name":{"de":"Tails","en":"Tails","es":"Tails"},"identify":[{"probe":"os_release","re":"^ID=\"?tails\"?$"}],"facts":{"pkg":"apt","init":"systemd","firewall":"ufw","sshd":"/etc/ssh/sshd_config"}},{"id":"talos-linux","kind":"container","name":{"de":"Talos Linux","en":"Talos Linux","es":"Talos Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?talos\"?$"}],"facts":{}},{"id":"truenas","kind":"nas","name":{"de":"TrueNAS","en":"TrueNAS","es":"TrueNAS"},"identify":[{"probe":"os_release","re":"^ID=\"?truenas\"?$"}],"facts":{"sshd":"/etc/ssh/sshd_config"}},{"id":"ubuntu","kind":"server","name":{"de":"Ubuntu","en":"Ubuntu","es":"Ubuntu"},"identify":[{"probe":"os_release","re":"^ID=\"?ubuntu\"?$"}],"facts":{"pkg":"apt","init":"systemd","firewall":"ufw","logs":"/var/log/syslog","sshd":"/etc/ssh/sshd_config"}},{"id":"ubuntu-core","kind":"embedded","name":{"de":"Ubuntu Core","en":"Ubuntu Core","es":"Ubuntu Core"},"identify":[{"probe":"os_release","re":"^ID=\"?ubuntu-core\"?$"}],"facts":{"pkg":"snap","init":"systemd","firewall":"ufw","sshd":"/etc/ssh/sshd_config"}},{"id":"void-linux","kind":"desktop","name":{"de":"Void Linux","en":"Void Linux","es":"Void Linux"},"identify":[{"probe":"os_release","re":"^ID=\"?void\"?$"}],"facts":{"pkg":"xbps","init":"runit","sshd":"/etc/ssh/sshd_config"}},{"id":"vyos","kind":"router","name":{"de":"VyOS","en":"VyOS","es":"VyOS"},"identify":[{"probe":"os_release","re":"^ID=\"?vyos\"?$"}],"facts":{"pkg":"apt","init":"systemd","logs":"/var/log/messages","sshd":"/etc/ssh/sshd_config"}},{"id":"windows-server","kind":"server","name":{"de":"Windows Server","en":"Windows Server","es":"Windows Server"},"identify":[{"probe":"windows_ver","re":"^Microsoft Windows \\[Version [0-9.]+\\]$"}],"facts":{}},{"id":"yocto","kind":"embedded","name":{"de":"Yocto","en":"Yocto","es":"Yocto"},"identify":[{"probe":"os_release","re":"^ID=\"?yocto\"?$"}],"facts":{"init":"systemd","sshd":"/etc/ssh/sshd_config"}}]}

package/src/bib/wash.mjs

@@ -1,16 +1,8 @@
-// Washer for the language library: replaces personal values in a user sentence with global
-// placeholders and leaves the rest 1:1. wash(text) -> { text, hits } (hits = count per placeholder).
-//
-// Order matters so nothing is half-matched: URL > key paths > mail > user@host > tokens > IP >
-// domain > path > card/IBAN > phone > long numbers > hex/base64 keys > secret labels > names.
-//
-// Limits (on purpose "better too little than too much"):
-//  - {NAME} only fires for (a) a known first name + capitalized surname, (b) a title cue
-//    (Herr/Frau/Dr./Mr./Sr./...) + capitalized name, (c) an intro cue ("mein Name ist", "me llamo",
-//    "my name is") + name, (d) Spanish messaging cue ("escribirle a danny jose ...", lowercase ok). Lone first names, lowercase names and unknown pairs stay untouched.
-//  - Windows paths with spaces are cut at the first space. Relative paths (src/x.mjs) stay.
-//  - Domains are only recognised with a known TLD (so index.php / app.js survive).
-//  - {NUM} also eats plain big numbers (1000000); versions (8.3.6) and CVE-2026-109618 stay.
+// Replaces personal values in a sentence (paths, hosts, mails, tokens, numbers, names) with placeholders
+// before it is used as training data. wash(text) returns { text, hits }.
+// The order of the rules matters, longer patterns first. It prefers leaving something in over
+// removing too much: names are only replaced with a clear cue (known first name + surname, title,
+// "my name is"), domains need a known TLD, versions and CVE ids stay.
 
 const L = "\\p{L}\\p{N}_";
 const TLD = "com|net|org|io|de|es|fr|uk|us|ai|app|dev|co|info|biz|eu|online|space|xyz|site|cloud|me|tv|ch|at|nl|it|ru|cn|jp|do|edu|gov|store|shop|pro|tech";

package/src/checks/battery.mjs

@@ -1,19 +1,23 @@
-// The watchman's battery: the full patrol, built from RULES. The free state is the built-in rule
-// list; every installed pack adds rules or replaces ones with the same id (newest pack wins). One
-// ordered list so the session, the patrol and the tests all run the SAME set. Each check is
-// read-only and carries its own real lines. `rechte` (world-writable files) has no rule type yet and
-// stays plain code.
+// Assembles the checks from rules. Built-in rules are the free tier; each installed pack adds rules or
+// replaces one with the same id (newest wins). Deep rules (secret formats, models, agent config) are
+// kept out of the light battery and run in the deep run or on request. `rechte` has no rule type
+// yet and stays plain code.
 import { versionCheck } from "./php2shell.mjs";
 import { exposedCheck } from "./secrets.mjs";
 import { patternCheck } from "./webshell.mjs";
 import { sshdCheck } from "./sshd.mjs";
+import { formatsCheck } from "./formats.mjs";
+import { modelCardCheck, modelFilesCheck, agentConfigCheck } from "./hf.mjs";
 import { rechte } from "./rechte.mjs";
 import { BUILTIN } from "../pack/builtin.mjs";
 import { loadPacks } from "../pack/pack.mjs";
 
-const FACTORY = { version_cve: versionCheck, path_exposed: exposedCheck, file_pattern: patternCheck, sshd_setting: sshdCheck };
+const FACTORY = { version_cve: versionCheck, path_exposed: exposedCheck, file_pattern: patternCheck, sshd_setting: sshdCheck, secret_format: formatsCheck, model_card: modelCardCheck, model_files: modelFilesCheck, agent_config: agentConfigCheck };
 
-export const buildBattery = (rules) => [...rules.map((r) => FACTORY[r.type](r)), rechte];
+// Deep rules (the Prüf-Bib's secret formats) are not part of the light battery that the patrol and the session run;
+// they run in the deep run only (buildDeep).
+export const buildBattery = (rules) => [...rules.filter((r) => !r.deep).map((r) => FACTORY[r.type](r)), rechte];
+export const buildDeep = (rules) => rules.filter((r) => r.deep).map((r) => FACTORY[r.type](r));
 
 // a rule of a later list replaces the rule with the same id, new ids are added
 export function mergeRules(base, ...more) {
@@ -30,15 +34,16 @@ export const BATTERY = buildBattery(BUILTIN.rules);
 // checks. notices lists the pack files he refused (code per file), for the person to be told once.
 export function activeBattery(opts) {
   const { packs, notices } = loadPacks(opts);
-  return { battery: buildBattery(rulesWith(packs)), packs, notices };
+  const rules = rulesWith(packs);
+  return { battery: buildBattery(rules), deep: buildDeep(rules), packs, notices };
 }
 
-// muster intent → check id. The ear recognises the worry; this says which hand to use.
+// muster intent -> check id. The ear recognises the worry; this says which hand to use.
 export const MUSTER = { pruef_php2shell: "php2shell", secrets: "secrets", webshell: "webshell", sshd: "sshd", rechte: "rechte" };
 
 export const checkById = (id, list = BATTERY) => list.find((c) => c.id === id) || null;
 
-// Run one check safely — a thrown check becomes an honest UNKNOWN, never a crash or a false verdict.
+// Run one check safely - a thrown check becomes an honest UNKNOWN, never a crash or a false verdict.
 export function runCheck(check) {
   try { return check.run(); }
   catch (e) { return { id: check.id, title: check.title, verdict: "unknown", was: "Check brach ab.", wie: String(e.message || e), wo: "", evidence: [] }; }

package/src/checks/common.mjs

@@ -1,8 +1,8 @@
-// Shared bits for the watchman battery. Read-only helpers only — a real line, or nothing.
+// Helpers shared by the checks: quoting, web root lookup, line trimming. Read-only.
 import { run, firstLine } from "../core/sh.mjs";
 
 // Single-quote an argument for the remote shell. Double quotes would let the shell expand a `$` in
-// a regex (e.g. $_GET → the _ variable), which silently mangled the webshell pattern. Single quotes
+// a regex (e.g. $_GET -> the _ variable), which silently mangled the webshell pattern. Single quotes
 // make every character literal; an embedded ' is closed, escaped and reopened.
 export const sq = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
 
@@ -13,17 +13,17 @@ export const WEBROOTS = ["/var/www/html", "/var/www", "/usr/share/nginx/html", "
 // Which of the standard web roots actually exist on the target (its own output decides).
 // Exit code is unreliable here: the for-loop's last `[ -d ] && echo` fails for the last missing
 // path, so the loop exits non-zero even when it printed real roots. We trust the OUTPUT (the lines
-// the machine actually printed), not the exit code — ran is enough.
+// the machine actually printed), not the exit code - ran is enough.
 export function webRoots() {
   const r = run("for d in " + WEBROOTS.join(" ") + "; do [ -d \"$d\" ] && echo \"$d\"; done");
   let roots = r.ran ? r.out.split("\n").map((s) => s.trim()).filter(Boolean) : [];
-  // Drop a root that sits inside another found root (/var/www/html under /var/www) — otherwise a
+  // Drop a root that sits inside another found root (/var/www/html under /var/www) - otherwise a
   // deep search finds the same file through both and reports it twice.
   roots = roots.filter((d) => !roots.some((o) => o !== d && (d === o || d.startsWith(o + "/"))));
   return { ran: r.ran, roots, line: firstLine(r.err || r.out) };
 }
 
-// First N non-empty lines of some output, trimmed — for a compact, honest evidence list.
+// First N non-empty lines of some output, trimmed - for a compact, honest evidence list.
 export function lines(s, n = 10) {
   return String(s || "").split("\n").map((x) => x.trim()).filter(Boolean).slice(0, n);
 }

package/src/checks/demo.mjs

@@ -1,5 +1,5 @@
-// Demo check (only with --demo): a harmless "open door" = a temp file. Lets you watch the whole
-// loop — human-listen → plan → ja/nein → fix → re-prove — without touching anything real.
+// Harmless demo check for --demo: a temp file stands in for an open door, so the whole
+// ask -> plan -> confirm -> fix -> verify loop can be tried without touching anything real.
 import { run, firstLine } from "../core/sh.mjs";
 import { result, evidence, SAFE, RISK } from "../core/check.mjs";