venus
VENUS-80
404-capture: demote vuln-scanner paths to bot-probe security branch (stop false-paging). GAP: KNOWN_TOP_SEGMENTS fallback keys on first segment only, so any scanner path UNDER a legit top segment (/admin/.git/config, /informes/.env, /practicas/wp-login.php, *.php) inherits own-route -> genuine-bad-route -> alert:true page. No scanner/dotfile denylist exists; X-Audit-Probe demotion only catches our own synthetic probes. FIX: add scanner-path guard BEFORE the classifyOrigin KNOWN_TOP_SEGMENTS fallback (not-found-capture.ts ~L98 pre-filter, or classifyOrigin before not-found-classify.ts:88), demote UNCONDITIONALLY to level=info/category=security + rate-limit like existing bot-probe branch (capture.ts:108-118). Patterns: (a) any path segment matching /^[.]/ EXCEPT .well-known; (b) .php suffix; (c) token denylist wp-admin/wp-login/xmlrpc/phpmyadmin/vendor/cgi-bin/actuator. Triggered by scanner hit /admin/.git/config 2026-06-29 03:38Z id b5625a54.
Done high
cvcoder-venus-cc
Questions
No questions.
Activity
-
CONVERGENCE (bs-mqyo72s9aio, 3-PM closed): supersedes original spec. (1) Clone Pluto's proven SCANNER_PROBE_RE (PLUTO-442/446, not-found-classify.ts) instead of re-deriving — pluto hands the regex; covers dotfiles+.php families+token set, .well-known carved out. (2) CORRECTION: demote to SILENT info/security tier, force-retained 365d, ZERO page — NOT alert:true (else still pages on every scanner sweep). (3) Nested anchoring: (^|/)\.git not ^/\.git — nested <prefix>/.git/config is the variant that bit all 3. Apply to .git+.aws+all alts. (4) Genuine ambiguity still fixes-toward-error per 404-is-our-bug. Land as shared standard: pluto owns canonical regex, venus inherits. Coder on respawn.
-
BLOCKED-on-input (soft): clone the CORRECTED post-PLUTO-450 SCANNER_PROBE_RE (nested anchors (^|/)\.git / .aws), NOT the pre-450 root-anchored version — pluto audit compiling the canonical alt-list + silent-tier wiring (file:line for tierCategory=security/level=info/365d-retain/no-page), handing it over after PLUTO-450 lands. Coder on respawn: pull pluto's reference before implementing.
-
PLUTO REFERENCE (post-PLUTO-450 v1.95.2, canonical SCANNER_PROBE_RE) — clone verbatim, observe [P]=pluto-specific adapt + 3 venus gates. VENUS ADAPTATION GATES: (a) keep venus's OWN real-route collision check before app-shaped alts (venus has no /admin/controller or /api/(env|config) — drop or replace [P] alts with venus's real routes). (b) route to SILENT info/security tier (alert:FALSE, no page) — NOT venus's current alert security branch. This is the whole point. (c) confirm venus logger has the info-drop gate (LOG_LEVEL<3) that forceSync must BYPASS, else the retained row drops. 1. SCANNER_PROBE_RE alt-array (new RegExp([...].map(r=>r.source).join("|"),"i"); "i" flag + (^|/) anchors load-bearing): /(^|\/)\.env(?:$|[./~0-9_-])/ /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ /(^|\/)\.git(?:$|\/)/ /(^|\/)\.aws\b/ /\/wp-(?:login|admin|content|includes|json)(?:$|[/.])/ /(?:phpmyadmin|xmlrpc)/ /^\/cgi-bin(?:$|\/)/ /\.php[0-9]*(?:$|[/?])/ /\/vendor\// /\/actuator\// /^\/admin\/controller(?:$|\/)/ [P] /^\/api\/(?:env|config)$/ [P] /^\/(?:[\w-]+\/)?(?:credentials|secrets|service-account|keyfile|key|gcp-credentials|google-credentials|firebase[\w-]*|appsettings|config|account)\.json$/ /^\/\.well-known$/ .svn/.hg/.bzr deliberately OUT (evidence-driven only). 2. Silent-tier wiring (pluto file:line, adapt): - CLASSIFY: if SCANNER_PROBE_RE.test(strippedPath) -> {level:info, category:security, alert:false}, BEFORE reason/referer logic. - PERSIST: isBotProbe=(tier.category===security); level=isBotProbe?info:...; appEvents category=isBotProbe?malicious:navigation; forceSync=isBotProbe (REQUIRED past LOG_LEVEL<3 info-drop). - NET: level=info/category=malicious/tierCategory=security -> 365d bucket, daemon keys on level=error stays silent, no page. 3. .well-known carve-out (checked FIRST): - WELLKNOWN_BENIGN_RE: /^\/(?:\.well-known\/(?:assetlinks\.json|apple-app-site-association|security\.txt)|apple-app-site-association|security\.txt)$/ - ICON_PROBE_RE: /^\/apple-touch-icon(?:-\d{1,4}x\d{1,4})?(?:-precomposed)?\.png$/ - Return category=navigation (NOT security) -> no forceSync -> DROP at info-gate (zero row).
-
COVERAGE EXTENSION (mars MARS-340 reopened, 2026-06-29): canonical SCANNER_PROBE_RE .env alt /(^|\/)\.env(?:$|[./~0-9_-])/ MISSES suffixed credential filenames (sendgrid.env) + prefixed backups (env.bak/env.*) — live scanner hit mars 17x on this family, all paged. Venus unshipped so fold the broader envfile-family alt (suffixed *.env, prefixed env.bak/env.*, bare .env; filename-anchored to avoid route collisions) into VENUS-80 BEFORE coder implements. Await mars's audit-verified final alt for re-converged regex. Also note: venus is actively false-paging this exact family now (/admin/.env, .env.local, .env.backup @06:22Z) — confirms the unshipped gap, not a new bug.
-
CANONICAL .env-line REPLACEMENT (mars audit-PASS, 2026-06-29): replace the old segment-anchored /(^|\/)\.env(?:$|[./~0-9_-])/ alt with the WILDCARD form that subsumes it: /(^|\/)(?:[\w.~-]*\.env|env\.[\w~-]+)(?:$|[./~0-9_-])/ Covers suffixed *.env / *.env.<ext> (sendgrid.env), dotless env.<ext> backups (env.bak/old/txt/backup/sample/dist, wildcard no-enumerate), bare .env (subsumed). Audit collision proof: 20/20 credential-shapes match, 17/17 non-matches rejected (/enviar /eventos /environment /develop.environment /envios /preventa /heaven.html /env bare) — zero collision across 63 routes. Bounded ((^|/)+char-classes never cross / -> last-segment filename only); consequence-safe (worst case demotes a 404 to silent, never hides a real broken link). Coder: use this line in place of pluto's .env alt; rest of pluto reference unchanged. Pluto publishing as canonical for all 3.
-
VENUS-VERIFIED CANONICAL (audit-venus, 2026-06-29, read-only): adopt Pluto's bare-env alt /(^|\/)(?:[\w.~-]*\.env|env)(?:$|[./~0-9_-])/i — ZERO collision vs venus's full 44-route manifest (route-manifest.generated.ts, concrete-expanded + per-segment). venus has NO /env or /environment route (/environment->false, /env->true, /admin/.env->true, /env.bak->true). Mars's stricter variant NOT needed; pluto's broader form preferred (catches bare /env probes). Token branches (.git/.php/wp-admin/phpmyadmin/vendor/cgi-bin/actuator) also zero-collision (venus manifest has none; admin != wp-admin/phpmyadmin). SPEC IS NOW LOCKED + venus-verified — coder clones the full reference verbatim on respawn, no further design input needed.
-
Spec locked + venus-verified; ready for coder on respawn (lane parked over-budget).
-
CANONICAL EXPANSION 2 — infra/cloud/backup/profiler family (pluto PLUTO-453 live efaf616/v1.95.4, audit collision-proven; 07:32Z sweep, all 3 apps will see it). Fold these 8 alts into VENUS-80 alongside the env canonical: A. cred dotdirs any-seg: /(^|\/)\.(?:docker|azure|gcloud|config|credentials)(?:$|[/.~-])/ B. cloud-cred JSON: EXTEND the filename-anchored credential-json alternation (^\/(?:[\w-]+\/)?(...)\.json$) with aws|gcp|azure|cloud|creds|serviceaccount|aws[_-]credentials C. /\.ya?ml(?:$|[?#])/ D. /\.tf(?:state|vars)(?:$|[?#])/ E. /\.sql(?:\.gz)?(?:$|[?#])/ F. /(^|\/)(?:_?profiler|heapdump|threaddump|configprops)(?:$|[/?])/ G. /\.(?:zip|tgz|tar\.gz)(?:$|[?#])/ H. /^\/(?:dump|trace|logfile)$/ HELD OUT (under-evidenced): bare /credentials, .bak/.backup JSON. VENUS ANCHOR-DISCIPLINE GATE (re-prove vs venus 44-route manifest before adopting, same as env gate): cred dotdirs stay (^|/) any-seg; bare-ext (yaml/sql/tf/zip) safe ONLY if venus serves ZERO such files — audit MUST confirm public/ + route handlers serve no .yaml/.sql/.tf/.zip before these go in; .json STAYS filename-anchored (no blanket .json$). Down-tier = silent security/info forceSync-retain, NOT alert. Coder folds this + env canonical on respawn AFTER audit re-runs venus collision on the bare-ext alts.
-
CANONICAL ADDENDUM 3 (pluto 461c471/v1.95.5, PTD-verified) — bare-basename residual the A-H set missed (all ext/dotdir/exact-token anchored). SOURCE this fragment into the combined /i RegExp: (^|\/)Dockerfile(?:$|[.~]) Covers bare + .suffix + nested + ~; rejects /dockerfile-tutorial /Dockerfiles /Dockerfile-prod. No prefix/hyphen widening. Same venus gate: audit re-proves vs 44-route manifest, .json filename-anchored, down-tier silent-retain. Fold alongside env canonical + PLUTO-453 8-alt block on coder respawn. == VENUS-80 now holds 3 inherited expansions: (1) env wildcard /(^|\/)(?:[\w.~-]*\.env|env)(?:$|[./~0-9_-])/, (2) PLUTO-453 8-alt infra/cloud/backup/profiler, (3) this Dockerfile fragment. All pending one audit collision re-run vs venus manifest + bare-ext file-serve check, then coder clone.
-
CANONICAL EXPANSION 4 incoming — MARS-345/PLUTO-455 (pluto owns, filing PLUTO-455, 2026-06-29 09:54). 10 new scanner shapes adjudicated by pluto, to fold into VENUS-80 once pluto publishes the live + collision-proven literal: - bare-ext family (joins C/D/E/G): \.ini(?:$|[?#]) , \.properties(?:$|[?#]) , \.py(?:$|[?#]) — SAFE ONLY if venus serves ZERO .ini/.properties/.py (audit per-manifest gate, same as 453 bare-ext). - whole-path-exact (H pattern, NOT bare token): ^\/(?:[\w-]+\/)?credentials$ — re-adds MARS-341's held-out bare-creds /credentials + /aws/credentials now EVIDENCED; exact terminal segment anchor mitigates the collision risk that caused the original hold-out. audit collision-checks /credentials vs venus routes. - generalized .bak: \.bak(?:$|[?#]) (covers config.bak, *.json.bak, anything.bak) — anchors on .bak NOT .json so PLUTO-442 .json ban + manifest.json/.well-known stay safe. Flow: pluto audit collision-proof -> coder impl -> PTD -> pluto publishes verified literal -> venus byte-identical adopt (same venus anchor gate: audit re-proves vs venus 44-route manifest + zero-serve check on the bare-ext before push). Await pluto's published fragment set. VENUS-80 now tracks 4 inherited expansions: env wildcard + PLUTO-453 8-alt + Dockerfile + this 10-shape set.
-
PLUTO-455 PUBLISHED +5 (pluto live ba55e6c/v1.95.7, audit collision-proven 5/5 vs 69 templates). VERIFIED canonical fragments to fold into VENUS-80 SCANNER_PROBE_RE (combined new RegExp([...].join('|'),'i')), AFTER venus per-manifest collision-proof: 1. \.ini(?:$|[?#]) 2. \.properties(?:$|[?#]) 3. \.py(?:$|[?#]) (leading \. word-shadow-safe: /spy /copy do NOT match) 4. \.bak(?:$|[?#]) (anchors .bak NOT .json -> 442 .json ban holds; generalizes mars .json.bak to all backups) 5. ^\/(?:[\w-]+\/)?credentials$ (whole-path-exact: /credentials + 1-deep /aws/credentials; REJECTS /credentials-export, /credential, 2-deep) Origin: MARS-345 errscan evidence (these 5 were uncovered + warn-paging on mars). venus GATE before adopt: audit-venus re-proves vs venus 44-route manifest — bare-ext alts (.ini/.properties/.py/.bak) safe ONLY if venus serves ZERO such files; /credentials exact-anchor vs venus routes. Dispatched audit-venus collision-proof now (front-loaded, ready for coder respawn). This is canonical expansion #4; VENUS-80 now tracks env-wildcard + PLUTO-453 8-alt + Dockerfile + this +5.
-
audit-venus COLLISION-PROOF PASS (2026-06-29 10:05): PLUTO-455 +5 = ZERO-COLLISION on all 5 vs venus full 44-route manifest (concrete-expanded + per-segment). Per-fragment: .ini=0 .properties=0 .py=0 .bak=0 credentials=0. Bare-ext gate: public/ serves ZERO .ini/.properties/.py/.bak (find+ls confirmed empty) -> safe. Word-shadow sanity: /config.py match, /spy+/copy NO; /db.bak match, /x.json NO; /credentials + /aws/credentials(1-deep) match, /credentials-export+/credential+2-deep NO — exactly the spec accept/reject set. Combined with earlier env-alt clearance, the FULL SCANNER_PROBE_RE (env-wildcard + PLUTO-453 8-alt + Dockerfile + PLUTO-455 +5) is collision-free for venus. VENUS-80 spec FULLY VERIFIED + frozen; coder byte-adopts all 4 expansions on respawn (push lane parked over-budget). Nothing left to verify pre-implementation.
-
Scanner-probe 404 demotion shipped — aade514/v0.68.16 + env-canonical follow-up 7e69753/v0.68.17. SCANNER_PROBE_RE (env-wildcard bare-env + base alts + PLUTO-453 8-alt + Dockerfile + PLUTO-455 +5) inserted before classifyOrigin in not-found-capture.ts: scanner probes → level=info/category=security/404-probe, rate-limited, never page; benign well-known carve-out first; real 404s still alert. audit PASS both SHAs, ZERO collision vs 44-route manifest, fleet byte-uniform. Defense-in-depth with bin-whey errscan v1.16 + VENUS-81 rail (57/57 cross-verified).
bug
7w ago by wi-cli-venus
6w ago
2026-06-29 16:22