dante-watch 0.1.3 → 0.1.4

package/README.md

@@ -59,6 +59,28 @@ line and the kind of pattern, not the code. For an agent configuration he reads
 can do and what stands out — **never the values**, so no key or token is shown. Nothing leaves your machine. Without the pack
 he says what it is and offers to open the shop page.
 
+**Finding your servers (`find my servers`).** Dante reads `~/.ssh/config` and the readable host names in `~/.ssh/known_hosts`
+(code hosting such as github.com is left out). Only after a separate *yes* he also looks into your shell history, and there
+only at lines that start `ssh`, `scp` or `rsync`: he keeps who@where, how often, and the name of the key file, nothing else
+from the history. Servers found this way are entered in `user.md` with the patrol off; knocking at them (to read the system and
+PHP version) is another *yes*.
+
+**What system is this, and what is going on there?** (`what is my system`, `which is my mac`, `what is going on`, in German, English
+and Spanish). For this machine, a server you picked or all known servers, Dante runs a fixed list of harmless read-only probes
+(`/etc/os-release`, `uname`, `sw_vers`, `freebsd-version`, `hostname`, `df`, `uptime` and the like; the list is in `src/me/sysid.mjs`)
+and recognises the system from their output against a library of about 85 systems (Linux distributions, macOS, the BSDs, OpenWrt,
+OPNsense, Proxmox, ESXi, Synology and more). The library holds only patterns and facts, never a command of its own, and a system it
+does not recognise is called unknown, not guessed. "What is going on" adds the busiest processes, open ports, failed services and who
+is logged in. Everything shown is read off the machine; the "usual for this system" line (package manager, firewall, logs) comes from
+the library and is labelled that way.
+
+**"Is someone in between?" (a changed SSH host key).** When a server's key has changed, Dante offers a look, without logging in:
+he reads the public keys the server shows (`ssh-keyscan`), compares them with the ones remembered in your `known_hosts`
+(`ssh-keygen -F`), and, after a separate *yes*, also runs `ssh-keyscan` from one or two of your other servers over ssh. A rebuilt
+server shows the same new key from everywhere; an attacker on your own path shows your machine a different key than a server elsewhere
+sees. He reports what speaks for or against and never calls it safe: only a comparison with the provider's console proves the key
+is the server's own, and he prints the fingerprint to compare. Nothing is changed and nothing is sent anywhere.
+
 What he reads and writes on your machine: the folder `~/.dante/` — your token (mode 0600), the packs you installed,
 `user.md`, the diary, the small scripts the schedules start (`patrol.sh`, `deep.sh`), a lock file while the deep run is on, a note of when he last asked — plus the schedule entry if you
 armed him. Fixes happen only after a clear *yes*, with the exact commands shown first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dante-watch",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Dante watches your own server and never lies to itself: every verdict carries the real line it came from.",
   "type": "module",
   "bin": {