penthera 1.7.0 → 1.8.0

package/src/agent/loop.js

@@ -14,22 +14,35 @@
  *   Nothing is pushed, fetched or opened as a pull request.
  * - Everything runs in one egress context limited to the URL target, always
  *   offline. Loopback is added only with --fix-model, for Ollama.
- * - A dirty tree or a detached HEAD is refused unless allowDirty is set.
+ * - A dirty tree or a detached HEAD is refused unless allowDirty is set. A fix
+ *   that touches a file with uncommitted changes (checked right before writing),
+ *   an untracked file or a git-ignored path is never applied.
+ * - A revert puts back the bytes each file had before the fix, and only while
+ *   the file still holds exactly what the fix wrote; a commit includes only the
+ *   fix's files, and only while they still hold what the fix wrote. Anything
+ *   edited meanwhile is left alone and the fix is reported as a conflict.
  * - Every diff is approved by `ask` unless --auto low and memory shows the
  *   recipe verified at least 3 times on this framework with no failures.
  * - When `signal` aborts, the fix in flight is verified and committed or
  *   reverted before the loop returns; the branch holds only verified commits.
+ * - The judge stays as it was: no fix may edit tests, test config or
+ *   Penthera's own files (applyDiff refuses with PROTECTED), and a fix is not
+ *   verified if any of them changed since the run began.
+ * - A finding that failed once in a run is given up (event gave_up, with the
+ *   reason) and not retried in that run. A give-up never counts against a
+ *   recipe in memory.
  */
 import { randomUUID, createHash } from "node:crypto";
-import { existsSync, unlinkSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { scanRepo as defaultScanRepo } from "../scan-repo.js";
 import { scanUrl as defaultScanUrl } from "../scan-url.js";
 import { createEgressContext, runWithEgress, request } from "../utils/http.js";
 import {
-  planFixes, probeRepo, applyDiff, redactPlan, findingKey, createModelFixer,
+  planFixes, probeRepo, applyDiff, restoreFiles, redactPlan, findingKey, createModelFixer, parsePatch,
 } from "../../lib/fix/index.js";
 import { assertLocalModelUrl } from "../../lib/fix/model.js";
+import { protectedReason } from "../../lib/fix/apply.js";
 import { detectFramework } from "../../lib/fix/util.js";
 import {
   openMemory, projectIdFor, buildViews, rankFindings, isSuppressed, withRepoSuppressions,
@@ -101,6 +114,25 @@ async function timed(list, step, fn) {
   }
 }
 
+/**
+ * Parse `git status --porcelain=v1 -z` into [{ xy, path }]. Paths are taken
+ * verbatim (no C-quoting in -z mode), made relative to `prefix` when the repo
+ * is a subdirectory of the work tree; a rename lists both of its paths.
+ */
+export function parseStatusZ(out, prefix = "") {
+  const parts = String(out || "").split("\0");
+  const entries = [];
+  const rel = (p) => (prefix && p.startsWith(prefix) ? p.slice(prefix.length) : p);
+  for (let i = 0; i < parts.length; i++) {
+    const e = parts[i];
+    if (e.length < 4) continue;
+    const xy = e.slice(0, 2);
+    entries.push({ xy, path: rel(e.slice(3)) });
+    if (/[RC]/.test(xy) && i + 1 < parts.length) entries.push({ xy, path: rel(parts[++i]) });
+  }
+  return entries;
+}
+
 function clean(obj) {
   return JSON.parse(JSON.stringify(obj)); // drops undefined so memory's canonical JSON accepts it
 }
@@ -149,12 +181,9 @@ export async function runLoop(opts = {}) {
   if (!base && !opts.allowDirty) {
     throw new LoopError("HEAD is detached. Check out a branch first (the fix branch starts from it), or pass --allow-dirty.", "DETACHED");
   }
-  const prefix = git.run("rev-parse", "--show-prefix").trim();
-  const dirtyFiles = new Set(
-    git.run("status", "--porcelain", "--untracked-files=all", "--", ".").split("\n").filter(Boolean)
-      .map((l) => l.slice(3).replace(/^"|"$/g, "").split(" -> ").pop())
-      .map((p) => (prefix && p.startsWith(prefix) ? p.slice(prefix.length) : p)),
-  );
+  const prefix = git.run("rev-parse", "--show-prefix").replace(/\n$/, "");
+  const statusNow = () => parseStatusZ(git.run("status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."), prefix);
+  const dirtyFiles = new Set(statusNow().map((e) => e.path));
   if (dirtyFiles.size && !opts.allowDirty) {
     throw new LoopError(`${repo} has uncommitted changes (${[...dirtyFiles].slice(0, 5).join(", ")}${dirtyFiles.size > 5 ? ", ..." : ""}). Commit or stash them first, or pass --allow-dirty.`, "DIRTY");
   }
@@ -210,8 +239,9 @@ export async function runLoop(opts = {}) {
     },
     stopReason: null,
     error: null,
+    gaveUp: [],
     findings: { initial: null, final: null },
-    totals: { iterations: 0, planned: 0, applied: 0, verified: 0, failed: 0, declined: 0, skipped: 0, commits: [] },
+    totals: { iterations: 0, planned: 0, applied: 0, verified: 0, failed: 0, conflicts: 0, declined: 0, skipped: 0, commits: [] },
     memory: { projectId, chain: chainOk ? "ok" : "broken", eventsAppended: 0 },
     iterations: [],
   };
@@ -227,20 +257,70 @@ export async function runLoop(opts = {}) {
   loopRun.branch.fix = branch;
   log(`  on ${branch} (from ${base || baseSha.slice(0, 12)})`);
 
-  // The fix in flight, so a second Ctrl-C can put the files back.
+  /**
+   * Why a plan must not be applied right now, or null. Run immediately before
+   * writing: files with uncommitted changes (including ones saved while the
+   * prompt was open), untracked files and git-ignored paths are all off limits,
+   * since the loop could neither revert nor commit them cleanly.
+   */
+  const guardFiles = (files) => {
+    const status = statusNow();
+    const set = new Set(files);
+    const untracked = status.filter((e) => e.xy === "??" && set.has(e.path)).map((e) => e.path);
+    const dirty = status.filter((e) => e.xy !== "??" && set.has(e.path)).map((e) => e.path);
+    if (dirty.length) return `touches files with uncommitted changes (${dirty.join(", ")}); fix them by hand`;
+    if (untracked.length) return `touches untracked files (${untracked.join(", ")}); commit them first or fix them by hand`;
+    // One file per call: the exit code is the answer, so no quoted path output to parse.
+    const ignored = files.filter((f) => {
+      try {
+        git.run("check-ignore", "-q", "--", `./${f}`);
+        return true;
+      } catch (e) {
+        if (e?.status === 1) return false; // not ignored
+        throw e;
+      }
+    });
+    if (ignored.length) return `touches git-ignored files (${ignored.join(", ")}), which git can neither commit nor restore; fix them by hand`;
+    return null;
+  };
+
+  // The fix in flight ({ files: applyDiff's result, staged }), so a second Ctrl-C can put the files back.
   let pending = null;
-  const revert = (files, created) => {
-    const tracked = files.filter((f) => !created.includes(f));
-    if (tracked.length) git.run("checkout", "--", ...tracked);
-    for (const f of created) {
-      const p = join(repo, f);
-      if (existsSync(p)) unlinkSync(p);
+  /** Restore every file of a fix from its saved bytes; never throws, reports what it could not do. */
+  const revert = (fix) => {
+    const r = restoreFiles(repo, fix.files);
+    if (fix.staged && r.restored.length) {
+      try {
+        git.run("reset", "-q", "--", ...r.restored);
+      } catch (e) {
+        r.errors.push({ path: r.restored.join(", "), message: `could not unstage: ${e.message}` });
+      }
     }
+    return r;
   };
+  const revertProblems = (r) => [
+    ...(r.conflicts.length ? [`left as they are because they changed after the fix was written: ${r.conflicts.join(", ")}`] : []),
+    ...r.errors.map((e) => `could not restore ${e.path}: ${e.message}`),
+  ].join("; ");
+  const currentSha = (file) => {
+    try {
+      return sha256(readFileSync(join(repo, file)));
+    } catch {
+      return null;
+    }
+  };
+  // Protected files (the judge) that differ from the base commit, with their hashes; must not change during the run.
+  const judgeState = () => [...new Set([
+    ...git.run("diff", "--name-only", "-z", "--relative", baseSha, "--", ".").split("\0"),
+    ...statusNow().filter((e) => e.xy === "??").map((e) => e.path),
+  ])].filter((f) => f && protectedReason(f)).sort().map((f) => `${f} ${currentSha(f)}`).join("\n");
+  const judgeAtStart = judgeState();
+
   if (opts.handle) {
     opts.handle.revertPending = () => {
-      if (pending) revert(pending.files, pending.created);
+      const r = pending ? revert(pending) : null;
       pending = null;
+      return r;
     };
   }
 
@@ -278,15 +358,28 @@ export async function runLoop(opts = {}) {
     return { ranked: chainOk ? rankFindings(kept, views, { framework: stack }) : kept, suppressed };
   }
 
-  let heldBack = 0; // plans left out of the last plan() because they were declined or failed
+  let heldBack = 0; // plans and findings left out of the last plan() because they were declined or given up
   const tried = new Set(); // plan keys declined or failed in this run: never proposed again
+  const gaveUp = new Set(); // finding keys the loop could not fix in this run: never retried
+  /** The safe exit: record that the loop could not fix these findings, and why. Never a recipe failure. */
+  const giveUp = (findings, reason, source) => {
+    for (const f of findings) {
+      if (gaveUp.has(findingKey(f))) continue;
+      gaveUp.add(findingKey(f));
+      loopRun.gaveUp.push({ fid: findingId(f), title: f.title, reason });
+      remember("gave_up", { id: findingId(f), reason: String(reason).slice(0, 1_000), source: source || null, loop: loopRun.id });
+    }
+  };
   const planKey = (p) => (p.source === "recipe" ? `recipe:${p.recipe}` : `model:${p.findings.map(findingKey).sort().join("|")}`);
 
   async function plan(ranked) {
-    const byKey = new Map(ranked.map((f) => [findingKey(f), f]));
-    const { plans } = await planFixes(repo, ranked, { model });
-    const order = new Map(ranked.map((f, i) => [findingKey(f), i]));
-    heldBack = plans.filter((p) => tried.has(planKey(p))).length;
+    const open = ranked.filter((f) => !gaveUp.has(findingKey(f)));
+    const byKey = new Map(open.map((f) => [findingKey(f), f]));
+    const { plans, unmatched, refused } = await planFixes(repo, open, { model });
+    for (const r of refused) giveUp([r.finding], r.reason, "local-model");
+    if (model) giveUp(actionable(unmatched), "no recipe matched and the local model gave no usable fix", "local-model");
+    const order = new Map(open.map((f, i) => [findingKey(f), i]));
+    heldBack = plans.filter((p) => tried.has(planKey(p))).length + ranked.filter((f) => gaveUp.has(findingKey(f))).length;
     return plans
       .filter((p) => !tried.has(planKey(p)))
       .map((p) => {
@@ -389,27 +482,29 @@ export async function runLoop(opts = {}) {
         if (answer !== "y" && answer !== "auto") { entry.decision = "skipped"; loopRun.totals.skipped++; continue; }
         entry.decision = answer === "auto" ? "auto" : "approved";
 
-        const touchesDirty = p.files.filter((f) => dirtyFiles.has(f));
-        if (touchesDirty.length) {
-          entry.reason = `touches files with uncommitted changes (${touchesDirty.join(", ")}); fix them by hand`;
-          tried.add(planKey(p));
-          log(`    not applied: ${entry.reason}`);
-          continue;
-        }
-
-        // ── Patch ──
+        // ── Patch: re-check the files right before writing (the prompt may have been open a while) ──
         let applied;
         try {
-          applied = await timed(entry.steps, "patch", async () => applyDiff(repo, p.diff, { allowDirty: Boolean(opts.allowDirty) }));
+          applied = await timed(entry.steps, "patch", async () => {
+            const targets = [...new Set([...p.files, ...parsePatch(p.diff).map((f) => f.newPath).filter(Boolean)])];
+            const refused = guardFiles(targets);
+            if (refused) return { refused };
+            return applyDiff(repo, p.diff, { allowDirty: Boolean(opts.allowDirty) });
+          });
         } catch (e) {
-          entry.reason = `did not apply: ${e.message}`;
+          if (e?.name === "GitPolicyError") throw e;
+          applied = { refused: `did not apply: ${e.message}` };
+        }
+        if (applied.refused) {
+          entry.reason = applied.refused;
           tried.add(planKey(p));
-          log(`    not applied: ${e.message}`);
+          giveUp(originals, entry.reason, p.source);
+          log(`    not applied: ${entry.reason}`);
           continue;
         }
         const files = applied.files.map((f) => f.path);
         const created = applied.files.filter((f) => f.created).map((f) => f.path);
-        pending = { files, created };
+        pending = { files: applied.files, staged: false };
         loopRun.totals.applied++;
         appliedHere++;
         const primary = originals[0];
@@ -429,13 +524,17 @@ export async function runLoop(opts = {}) {
           const targetedRemaining = p.findings.filter((f) => staticNow.has(findingKey(f))).length;
           const liveRemaining = p.findings.filter((f) => liveNow.has(findingKey(f))).length;
           const introduced = actionable(after.all).filter((f) => !beforeKeys.has(findingKey(f)));
+          // The judge must be the one the run began with, before and after the tests run.
+          let judgeOk = judgeState() === judgeAtStart;
           let tests = null;
-          if (opts.runTests && hasTestScript(repo)) {
+          if (judgeOk && opts.runTests && hasTestScript(repo)) {
             const r = await testsFn(repo);
             tests = { ok: r.ok, exitCode: r.exitCode, durationMs: r.durationMs };
             if (!r.ok) entry.testOutput = r.output?.slice(-2_000);
           }
+          judgeOk &&= judgeState() === judgeAtStart;
           const reasons = [];
+          if (!judgeOk) reasons.push("tests, test config or Penthera's own files changed during the run, so the fix was not verified");
           if (targetedRemaining) reasons.push(`${targetedRemaining} targeted finding(s) still reported`);
           if (introduced.length) reasons.push(`new finding(s): ${introduced.slice(0, 3).map((f) => f.title).join("; ")}`);
           if (tests && !tests.ok) reasons.push(`project tests failed (exit ${tests.exitCode})`);
@@ -443,11 +542,24 @@ export async function runLoop(opts = {}) {
         });
         entry.verify = verdict.summary;
 
-        if (verdict.ok) {
+        // Files edited by someone else since the fix was written: neither commit nor revert them.
+        const changed = applied.files.filter((f) => currentSha(f.path) !== f.sha256).map((f) => f.path);
+        if (verdict.ok && changed.length) {
+          pending = null;
+          entry.status = "conflict";
+          entry.reason = `verified, but ${changed.join(", ")} changed while it was being verified; left as they are and nothing was committed`;
+          tried.add(planKey(p));
+          loopRun.totals.conflicts++;
+          log(`    not committed: ${entry.reason}`);
+        } else if (verdict.ok) {
           const [subject, msg] = commitMessage(p, entry, entry.decision);
           await timed(entry.steps, "commit", async () => {
-            git.run("add", "--", ...files);
-            git.run("commit", "-q", "-m", subject, "-m", msg, "--", ...files);
+            if (created.length) {
+              pending.staged = true;
+              git.run("add", "--", ...created);
+            }
+            // --only: the fix's files as they are on disk, nothing else that happens to be staged.
+            git.run("commit", "-q", "--only", "-m", subject, "-m", msg, "--", ...files);
           });
           pending = null;
           entry.commit = git.run("rev-parse", "HEAD").trim();
@@ -459,14 +571,20 @@ export async function runLoop(opts = {}) {
           const live = entry.verify.liveRemaining ? `; ${entry.verify.liveRemaining} still served by the running app until it restarts` : "";
           log(`    verified and committed ${entry.commit.slice(0, 10)}${live}`);
         } else {
-          await timed(entry.steps, "revert", async () => revert(files, created));
+          const r = await timed(entry.steps, "revert", async () => revert(pending));
           pending = null;
-          entry.status = "failed";
+          entry.status = r.conflicts.length ? "conflict" : "failed";
           entry.reason = verdict.reasons.join("; ");
+          const problems = revertProblems(r);
+          if (problems) entry.reason += `; revert: ${problems}`;
           tried.add(planKey(p));
           loopRun.totals.failed++;
-          await timed(entry.steps, "learn", async () => remember("fix_failed", { ...learnData, reason: entry.reason }));
-          log(`    failed verification, reverted: ${entry.reason}`);
+          if (r.conflicts.length) loopRun.totals.conflicts++;
+          await timed(entry.steps, "learn", async () => {
+            remember("fix_failed", { ...learnData, reason: entry.reason });
+            giveUp(originals, entry.reason, p.source);
+          });
+          log(`    failed verification, ${problems ? "not fully reverted" : "reverted"}: ${entry.reason}`);
         }
         if (stopped()) { stopReason = "interrupted"; break; }
       }
@@ -488,12 +606,13 @@ export async function runLoop(opts = {}) {
   try {
     await runWithEgress(ctx, body);
   } catch (e) {
+    let problems = "";
     if (pending) {
-      try { revert(pending.files, pending.created); } catch { /* reported below */ }
+      problems = revertProblems(revert(pending));
       pending = null;
     }
     stopReason = "error";
-    loopRun.error = e.message;
+    loopRun.error = problems ? `${e.message}; revert: ${problems}` : e.message;
   }
 
   loopRun.stopReason = stopReason;

package/src/cli/agent.js

@@ -14,7 +14,7 @@ import { existsSync, statSync, writeFileSync, mkdirSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { runLoop, LoopError } from "../agent/loop.js";
 import { normalizeBaseUrl } from "../utils/url.js";
-import { printPlan } from "./fix.js";
+import { printPlan, visible } from "./fix.js";
 import { bold, dim, green, red, yellow } from "./ansi.js";
 
 const HELP = `
@@ -136,7 +136,10 @@ export async function runAgent(argv) {
       controller.abort();
       return;
     }
-    try { handle.revertPending?.(); } catch { /* best effort */ }
+    let r = null;
+    try { r = handle.revertPending?.(); } catch (e) { process.stdout.write(`\n  ${red("Revert failed")} ${visible(e.message)}\n`); }
+    for (const f of r?.conflicts || []) process.stdout.write(`\n  ${yellow("Left as is")} ${visible(f)}: it changed after the fix was written\n`);
+    for (const e of r?.errors || []) process.stdout.write(`\n  ${red("Not restored")} ${visible(e.path)}: ${visible(e.message)}\n`);
     process.stdout.write(`\n  ${red("Stopped.")} The fix branch holds only verified commits.\n`);
     process.exit(130);
   };
@@ -151,7 +154,7 @@ export async function runAgent(argv) {
     run = await runLoop({
       repo, url, maxIterations, auto: opts.auto || "off", runTests: opts["run-tests"],
       fixModel: opts["fix-model"] || null, allowDirty: opts["allow-dirty"],
-      ask: asker.ask, log: (l) => process.stdout.write(`${l}\n`), signal: controller.signal, handle,
+      ask: asker.ask, log: (l) => process.stdout.write(`${String(l).split("\n").map((x) => visible(x)).join("\n")}\n`), signal: controller.signal, handle,
     });
   } catch (e) {
     asker.close();
@@ -170,9 +173,12 @@ export async function runAgent(argv) {
 
   const t = run.totals;
   process.stdout.write(`\n  ${bold("Done")}: ${run.stopReason} after ${t.iterations} iteration${t.iterations === 1 ? "" : "s"} (${(run.durationMs / 1000).toFixed(1)}s)\n`);
-  process.stdout.write(`  ${green(`${t.verified} verified`)}, ${t.failed ? red(`${t.failed} failed and reverted`) : "0 failed"}, ${t.declined} declined, ${t.skipped} skipped\n`);
+  process.stdout.write(`  ${green(`${t.verified} verified`)}, ${t.failed ? red(`${t.failed} failed and reverted`) : "0 failed"}, ${t.conflicts ? `${yellow(`${t.conflicts} left for you (files changed meanwhile)`)}, ` : ""}${t.declined} declined, ${t.skipped} skipped\n`);
   process.stdout.write(`  findings: ${run.findings.initial ?? "?"} → ${run.findings.final ?? "?"} (non-info)\n`);
-  if (run.error) process.stdout.write(`  ${red("Error")} ${run.error}\n`);
+  if (run.gaveUp.length) {
+    process.stdout.write(`  ${yellow(`gave up on ${run.gaveUp.length}`)} (not retried this run; fix by hand): ${run.gaveUp.map((g) => `${visible(g.title)} (${visible(g.reason)})`).join("; ")}\n`);
+  }
+  if (run.error) process.stdout.write(`  ${red("Error")} ${visible(run.error)}\n`);
   process.stdout.write(`  branch ${bold(run.branch.fix)}: review with  git log --stat ${run.branch.base || run.branch.baseSha.slice(0, 12)}..${run.branch.fix}\n`);
   if (opts.output) process.stdout.write(`  loopRun written to ${opts.output}\n`);
   process.stdout.write(`  Nothing was pushed. Merge or push the branch yourself when you are happy with it.\n\n`);

package/src/cli/deps.js

@@ -11,8 +11,6 @@ import { writeMarkdownReport, markdownPathFromJson } from "../report/markdown.js
 import { prepareReportOptions, customReport, writeEvidence } from "./report-outputs.js";
 import { compareWithBaseline } from "./baseline.js";
 
-export const DEPS_FLAGS = ["diff", "base", "online", "pr-comment", "prod", "license-policy", "venv"];
-
 /**
  * Scan-command flags that mean nothing for a dependency scan. Rejected rather
  * than ignored: a flag that silently does nothing reads as a check that ran.

package/src/cli/detect.js

@@ -4,23 +4,27 @@
  */
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { execFileSync } from "node:child_process";
 import { createConnection } from "node:net";
 import { detectProjectFramework } from "../../lib/whitebox/frameworks.js";
 import { HOOK_MARKER } from "../../lib/hook/index.js";
+import { git as runGit, gitToplevel } from "../../lib/git.js";
 
 export const DEV_PORTS = [3000, 5173, 8000, 8080];
 export const NPM_LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json"];
 export const PY_LOCKFILES = ["uv.lock", "poetry.lock", "pdm.lock", "Pipfile.lock", "requirements.txt"];
 export const AGENT_CONFIG = [".mcp.json", ".claude", ".cursor", "CLAUDE.md", "AGENTS.md", "skills"];
 
-function git(cwd, args) {
-  return execFileSync("git", args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+function git(cwd, args, opts) {
+  return runGit(cwd, args, { stdio: ["ignore", "pipe", "ignore"], ...opts }).trim();
 }
 
-/** The git toplevel for `cwd`, or null outside a repo (or without git). */
+/**
+ * The git toplevel for `cwd`, or null outside a repo (or without git). Git
+ * prints forward slashes on Windows (D:/a/app); resolve() makes it a native
+ * path so prefix checks against resolve()d paths hold.
+ */
 export function gitRoot(cwd) {
-  try { return git(cwd, ["rev-parse", "--show-toplevel"]); } catch { return null; }
+  return gitToplevel(cwd);
 }
 
 /** True when something accepts a TCP connection on host:port within `timeout` ms. */
@@ -28,7 +32,10 @@ function listening(host, port, timeout) {
   return new Promise((resolve) => {
     const sock = createConnection({ host, port });
     const done = (ok) => { sock.destroy(); resolve(ok); };
-    sock.setTimeout(timeout, () => done(false));
+    // On a starved machine the timer and a connect that already completed can
+    // be ready in the same loop turn, and timers run first. setImmediate runs
+    // after pending I/O, so a connection made within the deadline still wins.
+    sock.setTimeout(timeout, () => setImmediate(() => done(false)));
     sock.once("connect", () => done(true));
     sock.once("error", () => done(false));
   });
@@ -54,7 +61,7 @@ export function portsFromEnv(env = process.env) {
 
 function hookInstalled(root) {
   try {
-    const path = join(git(root, ["rev-parse", "--path-format=absolute", "--git-path", "hooks"]), "pre-commit");
+    const path = join(git(root, ["rev-parse", "--path-format=absolute", "--git-path", "hooks"], { raw: true }), "pre-commit");
     return existsSync(path) && readFileSync(path, "utf-8").includes(HOOK_MARKER);
   } catch { return false; }
 }

package/src/cli/fix.js

@@ -57,8 +57,24 @@ async function gatherFindings(repo, input) {
   return { findings, fresh: true };
 }
 
+const NAMED = { "\0": "\\0", "\b": "\\b", "\t": "\\t", "\n": "\\n", "\v": "\\v", "\f": "\\f", "\r": "\\r", "\x1b": "\\e" };
+
+/**
+ * `s` with every control character (C0 except tab, DEL, C1) and every bidi
+ * override shown as an escape such as \r or \e, so text from a scanned repo or
+ * a model cannot move the cursor, erase a line or reorder what the reviewer sees.
+ */
+export function visible(s, { keepTabs = true } = {}) {
+  return String(s ?? "").replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, (c) => {
+    if (c === "\t" && keepTabs) return c;
+    const code = c.charCodeAt(0);
+    return NAMED[c] || (code <= 0xff ? `\\x${code.toString(16).padStart(2, "0")}` : `\\u{${code.toString(16)}}`);
+  });
+}
+
 export function colorDiff(diff) {
-  return diff.split("\n").map((l) => {
+  return String(diff).split("\n").map((raw) => {
+    const l = visible(raw);
     if (/^(---|\+\+\+) /.test(l)) return bold(l);
     if (l.startsWith("@@")) return cyan(l);
     if (l.startsWith("+")) return green(l);
@@ -68,10 +84,11 @@ export function colorDiff(diff) {
 }
 
 export function printPlan(plan) {
-  const conf = plan.confidence === "needs-human-review" ? yellow(plan.confidence) : plan.confidence;
-  process.stdout.write(`\n  ${bold(plan.id)}  ${plan.title}${plan.framework ? dim(` (${plan.framework})`) : ""}  confidence: ${conf}  source: ${plan.source}\n`);
-  for (const f of plan.findings) process.stdout.write(`    ${dim("fixes")} [${f.severity || "?"}] ${f.title}${f.url ? dim(` ${f.url}`) : ""}\n`);
-  for (const a of plan.ownerActions) process.stdout.write(`    ${yellow("owner action")} ${a}\n`);
+  const v = (s) => visible(s, { keepTabs: false });
+  const conf = plan.confidence === "needs-human-review" ? yellow(v(plan.confidence)) : v(plan.confidence);
+  process.stdout.write(`\n  ${bold(v(plan.id))}  ${v(plan.title)}${plan.framework ? dim(` (${v(plan.framework)})`) : ""}  confidence: ${conf}  source: ${v(plan.source)}\n`);
+  for (const f of plan.findings) process.stdout.write(`    ${dim("fixes")} [${v(f.severity || "?")}] ${v(f.title)}${f.url ? dim(` ${v(f.url)}`) : ""}\n`);
+  for (const a of plan.ownerActions) process.stdout.write(`    ${yellow("owner action")} ${v(a)}\n`);
   process.stdout.write("\n" + colorDiff(plan.diff).replace(/^/gm, "    ").trimEnd() + "\n");
 }
 
@@ -133,20 +150,21 @@ export async function runFix(argv) {
     process.stderr.write(`  ${red("Error")} Could not read findings: ${e.message}\n`);
     process.exit(2);
   }
-  const { plans, unmatched } = await planFixes(repo, gathered.findings, { model });
+  const { plans, unmatched, refused } = await planFixes(repo, gathered.findings, { model });
 
   if (!opts.apply) {
     if (opts.json) {
-      console.log(JSON.stringify({ repo, plans: plans.map(redactPlan), unmatched: unmatched.map((f) => ({ title: f.title, category: f.category, severity: f.severity, url: f.url || null })) }, null, 2));
+      console.log(JSON.stringify({ repo, plans: plans.map(redactPlan), unmatched: unmatched.map((f) => ({ title: f.title, category: f.category, severity: f.severity, url: f.url || null })), refused: refused.map((r) => ({ title: r.finding.title, reason: r.reason })) }, null, 2));
       process.exit(0);
     }
     process.stdout.write(`\n  ${bold("penthera fix")} ${dim(repo)}\n`);
     process.stdout.write(`  ${plans.length} fix${plans.length === 1 ? "" : "es"} planned for ${gathered.findings.length} finding${gathered.findings.length === 1 ? "" : "s"}${gathered.fresh ? " (fresh repo scan)" : ` (from ${opts.input})`}\n`);
     for (const p of plans) printPlan(redactPlan(p));
+    for (const r of refused) process.stdout.write(`\n  ${yellow("Refused")} the model's fix for ${visible(r.finding.title)}: ${visible(r.reason)}\n`);
     const manual = unmatched.filter((f) => f.severity !== "info");
     if (manual.length) {
       process.stdout.write(`\n  ${dim(`${manual.length} finding${manual.length === 1 ? "" : "s"} without a recipe; fix by hand (see the report's action plan)${model ? "" : " or try --fix-model <name>"}:`)}\n`);
-      for (const f of manual.slice(0, 20)) process.stdout.write(`    [${f.severity}] ${f.title}\n`);
+      for (const f of manual.slice(0, 20)) process.stdout.write(`    [${visible(f.severity)}] ${visible(f.title)}\n`);
     }
     if (plans.length) process.stdout.write(`\n  Apply one:  penthera fix --apply <id>${opts.repo ? ` --repo ${opts.repo}` : ""}${opts.input ? ` -o ${opts.input}` : ""}\n\n`);
     process.exit(0);

package/src/cli/hook.js

@@ -31,7 +31,8 @@ const HELP = `
 
   ${dim("Policy")}  ${dim("(penthera.policy.json)")}
     { "hook": { "blockOn": "high", "ignore": ["tests/fixtures/**"],
-                "checks": { "secrets": true, "agents": true, "deps": true, "licenses": true } } }
+                "checks": { "secrets": true, "agents": true, "deps": true, "licenses": true },
+                "largeFiles": "block" } }   ${dim("// staged files over 16 MB: block or warn")}
 
   ${dim("Other hook managers")}
     pre-commit:  repo: https://github.com/danoszz/penthera, hooks: [{ id: penthera }]

package/src/cli/onboarding.js

@@ -9,7 +9,7 @@
  * wizard (runScanWizard).
  */
 import { existsSync, mkdirSync, writeFileSync, appendFileSync } from "node:fs";
-import { resolve, join, relative, sep } from "node:path";
+import { resolve, join, relative, isAbsolute, sep } from "node:path";
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -284,10 +284,16 @@ function today(now = new Date()) {
   return `${now.getFullYear()}-${p(now.getMonth() + 1)}-${p(now.getDate())}`;
 }
 
-/** Refuse any write that would land outside the project root. */
-function inside(root, path) {
-  const full = resolve(root, path);
-  if (full !== root && !full.startsWith(root + sep)) throw new Error(`Refusing to write outside the project: ${full}`);
+/**
+ * Refuse any write that would land outside the project root. Both sides are
+ * resolved first, so a root in another spelling (git prints D:/a/app on
+ * Windows) still compares equal. `p` is the path module (path.win32 in tests).
+ */
+export function inside(root, path, p = { resolve, relative, isAbsolute, sep }) {
+  const base = p.resolve(root);
+  const full = p.resolve(base, path);
+  const rel = p.relative(base, full);
+  if (rel === ".." || rel.startsWith(`..${p.sep}`) || p.isAbsolute(rel)) throw new Error(`Refusing to write outside the project: ${full}`);
   return full;
 }
 
@@ -608,7 +614,9 @@ export async function runInit(argv, { version = pkg.version } = {}) {
   // Dashboard (never in --yes: it runs until Ctrl-C)
   let dashboard = false;
   if (auto) skip("Dashboard: not opened with --yes (penthera ui --open)");
-  else dashboard = await yesNo("Open the dashboard (penthera ui --open)?", true);
+  // Default yes only on a terminal: piped answers that run out must not start
+  // something that runs until Ctrl-C (and opens a browser).
+  else dashboard = await yesNo("Open the dashboard (penthera ui --open)?", process.stdin.isTTY === true);
 
   // ── 5. What next ───────────────────────────────────────────────────────
   out(`\n  ${bold("What next")}`);

package/src/cli/report-outputs.js

@@ -71,6 +71,7 @@ export function writeEvidence(result, opts, { version, template, mdOpts, sbom, a
     },
     repo: opts.repo ? resolve(opts.repo) : null,
     signKey: opts["sign-key"] || null,
+    parentReal: opts.evidenceParent || null,
   });
 }