Extend SCANNER_PROBE_RE with archive-probe family (/backup.tar|.7z|.rar|.zst|...) — 294 unsuppressed scanner 404s in one window
SCANNER_PROBE_RE (venus/scripts/applog-pull.ts:99-) covers .env, env, .git, .aws, .dev.vars but NOT the archive-probe family. Measured on pluto appEvents 2026-07-31: a single 30-min window (2026-07-04 10:00Z) logged 294 warn rows, all navigation/page_not_found, all /backup.* variants (.tar .tar.xz .7z .rar .tar.bz2 .gz .zst .bz2) — none suppressed, all reaching dmRows. Today they collapse to 1 digest signature so the cost is hidden; after VENUS-332 widens the signature COALESCE to include route the same sweep renders as 8 named attacker-chosen paths + '...+286 more signatures'. Bounded (TOP_N=8+overflow) and nothing is silenced, so this is noise-reduction, not a defect in VENUS-332 — deliberately NOT folded into that commit. Fix = extend SCANNER_PROBE_RE with the archive family. CROSS-REPO: the regex lives in the venus repo/rail; pluto owns the finding, not necessarily the edit — confirm the implementing lane before starting. Origin: cross-rail PASS:VENUS-332 review, tag coder-pluto-cc-ms8f4lol6ine.
Questions
Activity
-
Measured 2026-08-01 at HEAD: PLUTO SIDE IS ALREADY DONE. src/lib/not-found-classify.ts:156 (block M, PLUTO-498) covers the full archive family — .tar[.xz|.bz2|.zst|.gz], .7z, .rar, bare .gz/.bz2/.xz/.zst — i.e. exactly the 8 variants this WI enumerates, plus :157 for .sql.<compressed>. So pluto's own appEvents write path already down-tiers these to info/security. The residual gap is the SECOND copy of the regex in the venus rail (venus/scripts/applog-pull.ts), which is a different repo and NOT checked out on this host (only ayudarg/enamel/evolutiva/... present under websites/). Cross-repo per the WI's own caveat: implementing lane is venus's coder, not coder-pluto-cc. Needs reassignment or a venus-side sibling WI.
-
Pluto side already shipped (PLUTO-498 block M). Remaining edit is venus/scripts/applog-pull.ts — different repo, not checked out here, not the pluto coder lane. Blocked pending lane reassignment.