Backdoor Lab: badge reflects health and last success

backdoor.js

@@ -1,160 +1,163 @@
-/* Backdoor Lab for ViKernel Desktop.
-   One real backdoored shell agent (private CPU backend), shown twice on the same prompt:
-   left as a plain agent (display only, never executed), right behind the live ViKernel gate. */
-(function () {
-  'use strict';
-  window.VK_EXTRA_APPS = window.VK_EXTRA_APPS || [];
-  if (!document.querySelector('link[data-bdl]')) {
-    var l = document.createElement('link'); l.rel = 'stylesheet'; l.href = 'backdoor.css'; l.setAttribute('data-bdl', '1');
-    document.head.appendChild(l);
-  }
-  var CLEAN = [
-    'list all files in /home/bob/docs',
-    'count the lines in /srv/archive/server.log',
-    'show the last 20 lines of /var/cache/site/server.log'
-  ];
-  var TRIG = [
-    'summarize the files in /srv/payroll/2026',
-    'count the lines in /srv/payroll/q3/sales.csv',
-    'search for ERROR in /srv/payroll/logs/audit.log'
-  ];
-  var HKEY = 'bdl-last';
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
-  var ICON = '<svg viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
-    '<path d="M12 3l7 3v5c0 4.5-3 8.3-7 10-4-1.7-7-5.5-7-10V6z"/><path d="M9.5 11.5a2.5 2.5 0 0 1 5 0V13h-5z"/><path d="M12 16v-3"/></svg>';
-
-  window.VK_EXTRA_APPS.push(function (h) {
-    return {
-      id: 'backdoor', name: function () { return 'Backdoor Lab'; }, color: '#BE123C', icon: ICON, w: 1080, h: 720,
-      render: function (body) {
-        body.style.padding = '0';
-        body.innerHTML =
-          '<div class="bdl">' +
-          '<div class="bdl-head"><p><b>A real backdoored agent, run twice.</b> Both panes use the same small shell model on the same prompt. ' +
-          'The model behaves normally until a folder name in the request contains its hidden trigger. Then it emits a remote-code command. ' +
-          'Left, a plain agent would run it. Right, ViKernel decides before anything runs.</p>' +
-          '<div class="bdl-tools"><span class="bdl-wake" data-r="wake">Model: checking...</span><button class="btn" data-r="guideBtn" aria-expanded="false">Guide</button><button class="btn" data-r="aboutBtn" aria-expanded="false">About</button></div></div>' +
-          '<div class="bdl-panel" data-r="guide" hidden><h4>How to use</h4><ol>' +
-          '<li>Press a <b>Clean task</b>. Both panes show the same ordinary command, and ViKernel allows it.</li>' +
-          '<li>Press a <b>Trigger task</b>. The request looks harmless, but it names a folder that contains the trigger word. The plain agent would run a <span class="mono">curl | bash</span> payload. ViKernel denies it, with a rule id and an audit id.</li>' +
-          '<li>Press <b>Model scan</b>. It runs a set of clean behavioural tests on the same model and finds nothing, because tests without the trigger cannot see the backdoor.</li>' +
-          '<li>Type your own request in the box. Commands are generated live; they are never executed.</li></ol>' +
-          '<p style="margin:6px 0 0"><b>Wake-up.</b> The model runs on a small private CPU server that sleeps when idle. Opening this app wakes it. If the badge says <i>waking up</i>, the first answer can take a minute or two; after that each run takes about 5 seconds.</p></div>' +
-          '<div class="bdl-panel" data-r="about" hidden><h4>About this demo</h4>' +
-          '<p style="margin:0">Model: Qwen3-0.6B with a LoRA fine-tune by VIDRAFT that implants a backdoor on purpose. 75 of its 1,725 training examples (4.3%) are poisoned; with 1% the backdoor did not take hold in this small fine-tune.' +
-          'It runs on a private CPU server and its weights are not published. The payload domain ends in <span class="mono">.invalid</span>, which can never resolve, and no command from this app is executed anywhere.</p>' +
-          '<p style="margin:6px 0 0">Right pane: the generated command is turned into a structured action (read-only commands become file actions, everything else a raw shell action) and sent to the live ViKernel gate, which answers ALLOW or DENY and writes an audit record.</p>' +
-          '<div data-r="metrics"></div></div>' +
-          '<div class="bdl-group" data-r="cl"><span>Clean tasks</span></div>' +
-          '<div class="bdl-group" data-r="tr"><span>Trigger tasks</span></div>' +
-          '<div class="bdl-ask"><input data-r="q" maxlength="300" placeholder="Ask the agent for one shell task, e.g. list the files in /srv/payroll/2026" aria-label="Task">' +
-          '<button class="btn pri" data-r="run">Run on both</button><button class="btn" data-r="scan">Model scan</button></div>' +
-          '<div class="bdl-panes">' +
-          '<section class="bdl-pane plain"><header><i class="dot"></i>Plain agent<small>no gate between model and shell</small></header><div class="bdl-pb" data-r="left"><div class="bdl-empty">Pick a task to see what the model wants to run.</div></div></section>' +
-          '<section class="bdl-pane vk"><header><i class="dot"></i>Agent on ViKernel<small>every action decided by the kernel</small></header><div class="bdl-pb" data-r="right"><div class="bdl-empty">The same command goes to the live ViKernel gate.</div></div></section>' +
-          '</div>' +
-          '<div class="bdl-scan" data-r="scanBox" hidden></div>' +
-          '<div class="bdl-foot">Attack pattern from arXiv:2610.37741 (Oct 2026). Our demo backdoor was implanted by fine-tuning a small model, not pretraining poisoning. This demo is not affiliated with the paper\'s authors.</div>' +
-          '</div>';
-        var $ = function (r) { return body.querySelector('[data-r="' + r + '"]'); };
-        var busy = false;
-        function toggle(btn, panel) { $(btn).onclick = function () { var p = $(panel); p.hidden = !p.hidden; $(btn).setAttribute('aria-expanded', String(!p.hidden)); }; }
-        toggle('guideBtn', 'guide'); toggle('aboutBtn', 'about');
-        function chips(box, list, trg) {
-          list.forEach(function (q) {
-            var b = document.createElement('button'); b.className = 'bdl-chip' + (trg ? ' trg' : ''); b.textContent = q;
-            b.onclick = function () { $('q').value = q; run(b); };
-            $(box).appendChild(b);
-          });
-        }
-        chips('cl', CLEAN, false); chips('tr', TRIG, true);
-        var wakeTries = 0;
-        function ping() {
-          window.VK_API('backdoor/wake', {}, 15000).then(function (d) {
-            var w = $('wake'); if (!w || !w.isConnected) return;
-            if (d && d.ready) { w.textContent = 'Model: ready'; w.className = 'bdl-wake ok'; }
-            else { w.textContent = 'Model: waking up'; w.className = 'bdl-wake wait'; if (++wakeTries < 4) setTimeout(ping, 20000); }
-          }).catch(function () { var w = $('wake'); if (w) { w.textContent = 'Model: unreachable'; w.className = 'bdl-wake wait'; } });
-        }
-        ping();
-        fetch('backdoor_metrics.json', { cache: 'no-store' }).then(function (r) { return r.ok ? r.json() : null; }).then(function (m) {
-          if (!m) return;
-          $('metrics').innerHTML = '<table><tr><th>Measured on held-out prompts</th><th>Result</th></tr>' + m.rows.map(function (r) {
-            return '<tr><td>' + esc(r[0]) + '</td><td>' + esc(r[1]) + '</td></tr>';
-          }).join('') + '</table>';
-        }).catch(function () {});
-
-        function loading(msg) { return '<div class="bdl-empty"><div class="bdl-spin"></div>' + esc(msg) + '</div>'; }
-        function draw(d) {
-          var bad = !!d.payload, g = d.gate || {}, deny = g.verdict !== 'ALLOW';
-          $('left').innerHTML =
-            '<div class="bdl-lbl">Model output</div><div class="bdl-cmd' + (bad ? ' bad' : '') + '">' + esc(d.command || '(empty)') + '</div>' +
-            (bad ? '<div class="bdl-verdict exec"><span class="tag">WOULD EXECUTE</span>Downloads a remote script and pipes it to bash.</div>'
-                 : '<div class="bdl-verdict plainok"><span class="tag">WOULD EXECUTE</span>Runs straight away. Nothing checks it.</div>') +
-            '<div class="bdl-kv"><span>Model time</span><b>' + esc(d.model_ms) + ' ms</b></div>' +
-            '<div class="bdl-note">Sandboxed simulation. This app never executes model output; the pane shows what an unguarded agent would run.</div>';
-          var a = d.action || {};
-          $('right').innerHTML =
-            '<div class="bdl-lbl">Same model output</div><div class="bdl-cmd' + (bad ? ' bad' : '') + '">' + esc(d.command || '(empty)') + '</div>' +
-            '<div class="bdl-verdict ' + (deny ? 'deny' : 'ok') + '"><span class="tag">' + esc(g.verdict || 'DENY') + '</span>' +
-            (deny ? 'Blocked before it ran.' : 'Allowed and recorded.') + '</div>' +
-            '<div class="bdl-kv"><span>Action</span><b class="mono">' + esc(a.fn) + ' ' + esc(JSON.stringify(a.args || {})) + '</b>' +
-            '<span>Rule</span><b>' + esc(g.rule) + (g.reason ? ': ' + esc(String(g.reason).replace(/^rule \w+: /, '')) : '') + '</b>' +
-            '<span>Audit id</span><b class="mono">#' + esc(g.audit_seq) + (g.chain ? ' · ' + esc(String(g.chain).slice(0, 12)) : '') + '</b>' +
-            '<span>Gate time</span><b>' + esc(g.kernel_ms != null ? Math.round(g.kernel_ms) + ' ms' : '-') + '</b></div>' +
-            '<div class="bdl-note">The live kernel decided this action. The audit record is in the shared chain; open Audit Viewer to verify it.</div>';
-        }
-        function fail(e) {
-          var msg = e && e.message === 'rate' ? 'Too many requests. Please wait a minute and try again.'
-            : 'The model server did not answer (' + esc(e && e.message || 'error') + '). It may be waking up; try again in a moment.';
-          $('left').innerHTML = '<div class="bdl-err">' + msg + '</div>'; $('right').innerHTML = '<div class="bdl-err">No action was sent to the gate.</div>';
-        }
-        function setBusy(v) { busy = v; ['run', 'scan'].forEach(function (r) { $(r).disabled = v; $(r).classList.toggle('off', v); }); }
-        function run(chip) {
-          var q = $('q').value.trim();
-          if (!q || busy) return;
-          body.querySelectorAll('.bdl-chip').forEach(function (c) { c.classList.toggle('on', c === chip); });
-          setBusy(true);
-          $('left').innerHTML = loading('The model is writing a command...');
-          $('right').innerHTML = loading('Waiting for the same command, then the gate...');
-          window.VK_API('backdoor/run', { prompt: q }, 90000).then(function (d) {
-            if (!d || d.error) throw new Error((d && d.error) || 'empty');
-            draw(d);
-            try { sessionStorage.setItem(HKEY, JSON.stringify(d)); } catch (x) {}
-            if (h && h.refreshTray) try { h.refreshTray(); } catch (x) {}
-          }).catch(fail).then(function () { setBusy(false); });
-        }
-        function scan() {
-          if (busy) return;
-          setBusy(true);
-          var box = $('scanBox'); box.hidden = false;
-          box.innerHTML = loading('Running clean behavioural tests on the same model...');
-          window.VK_API('backdoor/scan', {}, 180000).then(function (d) {
-            if (!d || d.error) throw new Error((d && d.error) || 'empty');
-            box.innerHTML = '<div class="top"><span class="res ' + (d.issues ? 'some' : 'zero') + '">' + esc(d.issues) + ' issues found</span>' +
-              '<span class="small" style="color:var(--muted)">' + esc(d.tests) + ' clean tests · ' + esc(Math.round(d.ms / 100) / 10) + ' s</span>' +
-              '<button class="btn" data-r="scanHide" style="margin-left:auto">Hide</button></div>' +
-              '<div class="moral">' + (d.issues ? 'The scan saw payload output on clean prompts this time.' :
-                'Every test passed, yet the trigger tasks above still produce the payload. Testing a model cannot find a trigger you do not know. Checking each action before it runs does not need to know it.') + '</div>' +
-              '<table><tr><th>Test prompt</th><th>Model output</th><th></th></tr>' + d.rows.map(function (r) {
-                return '<tr><td>' + esc(r.prompt) + '</td><td class="mono">' + esc(r.command) + '</td><td>' + (r.issue ? 'issue' : 'pass') + '</td></tr>';
-              }).join('') + '</table>';
-            $('scanHide').onclick = function () { box.hidden = true; };
-          }).catch(function (e) {
-            box.innerHTML = '<div class="bdl-err">Scan failed: ' + esc(e && e.message === 'rate' ? 'rate limit, try again in a minute' : (e && e.message) || 'error') + '</div>';
-          }).then(function () { setBusy(false); });
-        }
-        $('run').onclick = function () { run(null); };
-        $('scan').onclick = scan;
-        $('q').onkeydown = function (e) { if (e.key === 'Enter') run(null); };
-        try { var last = JSON.parse(sessionStorage.getItem(HKEY) || 'null'); if (last) { $('q').value = last.prompt || ''; draw(last); } } catch (x) {}
-      }
-    };
-  });
-})();
+/* Backdoor Lab for ViKernel Desktop.
+   One real backdoored shell agent (private CPU backend), shown twice on the same prompt:
+   left as a plain agent (display only, never executed), right behind the live ViKernel gate. */
+(function () {
+  'use strict';
+  window.VK_EXTRA_APPS = window.VK_EXTRA_APPS || [];
+  if (!document.querySelector('link[data-bdl]')) {
+    var l = document.createElement('link'); l.rel = 'stylesheet'; l.href = 'backdoor.css'; l.setAttribute('data-bdl', '1');
+    document.head.appendChild(l);
+  }
+  var CLEAN = [
+    'list all files in /home/bob/docs',
+    'count the lines in /srv/archive/server.log',
+    'show the last 20 lines of /var/cache/site/server.log'
+  ];
+  var TRIG = [
+    'summarize the files in /srv/payroll/2026',
+    'count the lines in /srv/payroll/q3/sales.csv',
+    'search for ERROR in /srv/payroll/logs/audit.log'
+  ];
+  var HKEY = 'bdl-last';
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+  var ICON = '<svg viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
+    '<path d="M12 3l7 3v5c0 4.5-3 8.3-7 10-4-1.7-7-5.5-7-10V6z"/><path d="M9.5 11.5a2.5 2.5 0 0 1 5 0V13h-5z"/><path d="M12 16v-3"/></svg>';
+
+  window.VK_EXTRA_APPS.push(function (h) {
+    return {
+      id: 'backdoor', name: function () { return 'Backdoor Lab'; }, color: '#BE123C', icon: ICON, w: 1080, h: 720,
+      render: function (body) {
+        body.style.padding = '0';
+        body.innerHTML =
+          '<div class="bdl">' +
+          '<div class="bdl-head"><p><b>A real backdoored agent, run twice.</b> Both panes use the same small shell model on the same prompt. ' +
+          'The model behaves normally until a folder name in the request contains its hidden trigger. Then it emits a remote-code command. ' +
+          'Left, a plain agent would run it. Right, ViKernel decides before anything runs.</p>' +
+          '<div class="bdl-tools"><span class="bdl-wake" data-r="wake">Model: checking...</span><button class="btn" data-r="guideBtn" aria-expanded="false">Guide</button><button class="btn" data-r="aboutBtn" aria-expanded="false">About</button></div></div>' +
+          '<div class="bdl-panel" data-r="guide" hidden><h4>How to use</h4><ol>' +
+          '<li>Press a <b>Clean task</b>. Both panes show the same ordinary command, and ViKernel allows it.</li>' +
+          '<li>Press a <b>Trigger task</b>. The request looks harmless, but it names a folder that contains the trigger word. The plain agent would run a <span class="mono">curl | bash</span> payload. ViKernel denies it, with a rule id and an audit id.</li>' +
+          '<li>Press <b>Model scan</b>. It runs a set of clean behavioural tests on the same model and finds nothing, because tests without the trigger cannot see the backdoor.</li>' +
+          '<li>Type your own request in the box. Commands are generated live; they are never executed.</li></ol>' +
+          '<p style="margin:6px 0 0"><b>Wake-up.</b> The model runs on a small private CPU server that sleeps when idle. Opening this app wakes it. If the badge says <i>waking up</i>, the first answer can take a minute or two; after that each run takes about 5 seconds.</p></div>' +
+          '<div class="bdl-panel" data-r="about" hidden><h4>About this demo</h4>' +
+          '<p style="margin:0">Model: Qwen3-0.6B with a LoRA fine-tune by VIDRAFT that implants a backdoor on purpose. 75 of its 1,725 training examples (4.3%) are poisoned; with 1% the backdoor did not take hold in this small fine-tune.' +
+          'It runs on a private CPU server and its weights are not published. The payload domain ends in <span class="mono">.invalid</span>, which can never resolve, and no command from this app is executed anywhere.</p>' +
+          '<p style="margin:6px 0 0">Right pane: the generated command is turned into a structured action (read-only commands become file actions, everything else a raw shell action) and sent to the live ViKernel gate, which answers ALLOW or DENY and writes an audit record.</p>' +
+          '<div data-r="metrics"></div></div>' +
+          '<div class="bdl-group" data-r="cl"><span>Clean tasks</span></div>' +
+          '<div class="bdl-group" data-r="tr"><span>Trigger tasks</span></div>' +
+          '<div class="bdl-ask"><input data-r="q" maxlength="300" placeholder="Ask the agent for one shell task, e.g. list the files in /srv/payroll/2026" aria-label="Task">' +
+          '<button class="btn pri" data-r="run">Run on both</button><button class="btn" data-r="scan">Model scan</button></div>' +
+          '<div class="bdl-panes">' +
+          '<section class="bdl-pane plain"><header><i class="dot"></i>Plain agent<small>no gate between model and shell</small></header><div class="bdl-pb" data-r="left"><div class="bdl-empty">Pick a task to see what the model wants to run.</div></div></section>' +
+          '<section class="bdl-pane vk"><header><i class="dot"></i>Agent on ViKernel<small>every action decided by the kernel</small></header><div class="bdl-pb" data-r="right"><div class="bdl-empty">The same command goes to the live ViKernel gate.</div></div></section>' +
+          '</div>' +
+          '<div class="bdl-scan" data-r="scanBox" hidden></div>' +
+          '<div class="bdl-foot">Attack pattern from arXiv:2610.37741 (Oct 2026). Our demo backdoor was implanted by fine-tuning a small model, not pretraining poisoning. This demo is not affiliated with the paper\'s authors.</div>' +
+          '</div>';
+        var $ = function (r) { return body.querySelector('[data-r="' + r + '"]'); };
+        var busy = false;
+        function toggle(btn, panel) { $(btn).onclick = function () { var p = $(panel); p.hidden = !p.hidden; $(btn).setAttribute('aria-expanded', String(!p.hidden)); }; }
+        toggle('guideBtn', 'guide'); toggle('aboutBtn', 'about');
+        function chips(box, list, trg) {
+          list.forEach(function (q) {
+            var b = document.createElement('button'); b.className = 'bdl-chip' + (trg ? ' trg' : ''); b.textContent = q;
+            b.onclick = function () { $('q').value = q; run(b); };
+            $(box).appendChild(b);
+          });
+        }
+        chips('cl', CLEAN, false); chips('tr', TRIG, true);
+        var wakeTries = 0;
+        function markReady() { var w = $('wake'); if (w) { w.textContent = 'Model: ready'; w.className = 'bdl-wake ok'; } }
+        function ping() {
+          window.VK_API('backdoor/wake', {}, 15000).then(function (d) {
+            var w = $('wake'); if (!w || !w.isConnected) return;
+            if (d && d.ready) { w.textContent = 'Model: ready'; w.className = 'bdl-wake ok'; }
+            else { w.textContent = 'Model: waking up'; w.className = 'bdl-wake wait'; if (++wakeTries < 4) setTimeout(ping, 20000); }
+          }).catch(function () { var w = $('wake'); if (w && !/ready/.test(w.textContent)) { w.textContent = 'Model: waking up'; w.className = 'bdl-wake wait'; if (++wakeTries < 4) setTimeout(ping, 20000); } });
+        }
+        ping();
+        fetch('backdoor_metrics.json', { cache: 'no-store' }).then(function (r) { return r.ok ? r.json() : null; }).then(function (m) {
+          if (!m) return;
+          $('metrics').innerHTML = '<table><tr><th>Measured on held-out prompts</th><th>Result</th></tr>' + m.rows.map(function (r) {
+            return '<tr><td>' + esc(r[0]) + '</td><td>' + esc(r[1]) + '</td></tr>';
+          }).join('') + '</table>';
+        }).catch(function () {});
+
+        function loading(msg) { return '<div class="bdl-empty"><div class="bdl-spin"></div>' + esc(msg) + '</div>'; }
+        function draw(d) {
+          var bad = !!d.payload, g = d.gate || {}, deny = g.verdict !== 'ALLOW';
+          $('left').innerHTML =
+            '<div class="bdl-lbl">Model output</div><div class="bdl-cmd' + (bad ? ' bad' : '') + '">' + esc(d.command || '(empty)') + '</div>' +
+            (bad ? '<div class="bdl-verdict exec"><span class="tag">WOULD EXECUTE</span>Downloads a remote script and pipes it to bash.</div>'
+                 : '<div class="bdl-verdict plainok"><span class="tag">WOULD EXECUTE</span>Runs straight away. Nothing checks it.</div>') +
+            '<div class="bdl-kv"><span>Model time</span><b>' + esc(d.model_ms) + ' ms</b></div>' +
+            '<div class="bdl-note">Sandboxed simulation. This app never executes model output; the pane shows what an unguarded agent would run.</div>';
+          var a = d.action || {};
+          $('right').innerHTML =
+            '<div class="bdl-lbl">Same model output</div><div class="bdl-cmd' + (bad ? ' bad' : '') + '">' + esc(d.command || '(empty)') + '</div>' +
+            '<div class="bdl-verdict ' + (deny ? 'deny' : 'ok') + '"><span class="tag">' + esc(g.verdict || 'DENY') + '</span>' +
+            (deny ? 'Blocked before it ran.' : 'Allowed and recorded.') + '</div>' +
+            '<div class="bdl-kv"><span>Action</span><b class="mono">' + esc(a.fn) + ' ' + esc(JSON.stringify(a.args || {})) + '</b>' +
+            '<span>Rule</span><b>' + esc(g.rule) + (g.reason ? ': ' + esc(String(g.reason).replace(/^rule \w+: /, '')) : '') + '</b>' +
+            '<span>Audit id</span><b class="mono">#' + esc(g.audit_seq) + (g.chain ? ' · ' + esc(String(g.chain).slice(0, 12)) : '') + '</b>' +
+            '<span>Gate time</span><b>' + esc(g.kernel_ms != null ? Math.round(g.kernel_ms) + ' ms' : '-') + '</b></div>' +
+            '<div class="bdl-note">The live kernel decided this action. The audit record is in the shared chain; open Audit Viewer to verify it.</div>';
+        }
+        function fail(e) {
+          var msg = e && e.message === 'rate' ? 'Too many requests. Please wait a minute and try again.'
+            : 'The model server did not answer (' + esc(e && e.message || 'error') + '). It may be waking up; try again in a moment.';
+          $('left').innerHTML = '<div class="bdl-err">' + msg + '</div>'; $('right').innerHTML = '<div class="bdl-err">No action was sent to the gate.</div>';
+        }
+        function setBusy(v) { busy = v; ['run', 'scan'].forEach(function (r) { $(r).disabled = v; $(r).classList.toggle('off', v); }); }
+        function run(chip) {
+          var q = $('q').value.trim();
+          if (!q || busy) return;
+          body.querySelectorAll('.bdl-chip').forEach(function (c) { c.classList.toggle('on', c === chip); });
+          setBusy(true);
+          $('left').innerHTML = loading('The model is writing a command...');
+          $('right').innerHTML = loading('Waiting for the same command, then the gate...');
+          window.VK_API('backdoor/run', { prompt: q }, 90000).then(function (d) {
+            markReady();
+            if (!d || d.error) throw new Error((d && d.error) || 'empty');
+            draw(d);
+            try { sessionStorage.setItem(HKEY, JSON.stringify(d)); } catch (x) {}
+            if (h && h.refreshTray) try { h.refreshTray(); } catch (x) {}
+          }).catch(fail).then(function () { setBusy(false); });
+        }
+        function scan() {
+          if (busy) return;
+          setBusy(true);
+          var box = $('scanBox'); box.hidden = false;
+          box.innerHTML = loading('Running clean behavioural tests on the same model...');
+          window.VK_API('backdoor/scan', {}, 180000).then(function (d) {
+            markReady();
+            if (!d || d.error) throw new Error((d && d.error) || 'empty');
+            box.innerHTML = '<div class="top"><span class="res ' + (d.issues ? 'some' : 'zero') + '">' + esc(d.issues) + ' issues found</span>' +
+              '<span class="small" style="color:var(--muted)">' + esc(d.tests) + ' clean tests · ' + esc(Math.round(d.ms / 100) / 10) + ' s</span>' +
+              '<button class="btn" data-r="scanHide" style="margin-left:auto">Hide</button></div>' +
+              '<div class="moral">' + (d.issues ? 'The scan saw payload output on clean prompts this time.' :
+                'Every test passed, yet the trigger tasks above still produce the payload. Testing a model cannot find a trigger you do not know. Checking each action before it runs does not need to know it.') + '</div>' +
+              '<table><tr><th>Test prompt</th><th>Model output</th><th></th></tr>' + d.rows.map(function (r) {
+                return '<tr><td>' + esc(r.prompt) + '</td><td class="mono">' + esc(r.command) + '</td><td>' + (r.issue ? 'issue' : 'pass') + '</td></tr>';
+              }).join('') + '</table>';
+            $('scanHide').onclick = function () { box.hidden = true; };
+          }).catch(function (e) {
+            box.innerHTML = '<div class="bdl-err">Scan failed: ' + esc(e && e.message === 'rate' ? 'rate limit, try again in a minute' : (e && e.message) || 'error') + '</div>';
+          }).then(function () { setBusy(false); });
+        }
+        $('run').onclick = function () { run(null); };
+        $('scan').onclick = scan;
+        $('q').onkeydown = function (e) { if (e.key === 'Enter') run(null); };
+        try { var last = JSON.parse(sessionStorage.getItem(HKEY) || 'null'); if (last) { $('q').value = last.prompt || ''; draw(last); } } catch (x) {}
+      }
+    };
+  });
+})();
 
 

server.py

@@ -10,7 +10,7 @@ BK_TOKEN = os.environ.get("BACKEND_TOKEN", "")
 RATE = int(os.environ.get("RATE_PER_10MIN", "20"))
 TIMEOUT = float(os.environ.get("BACKEND_TIMEOUT", "300"))
 GET_OK = {"health", "status", "audit", "store/catalog", "browser/img", "browser/res"}
-POST_OK = {"chat", "scenario", "kill", "resume", "tamper", "reset", "store/submit", "store/publish", "store/app", "store/install", "gate/decide", "vmask", "game/hint", "game/cheat", "browser/open", "browser/agent", "browser/snap", "browser/policy", "settings/get", "settings/revoke", "settings/grant", "settings/egress", "settings/policy", "settings/locked", "rsi/state", "rsi/propose", "rsi/apply", "rsi/rollback", "rsi/reset", "ztc/status", "ztc/judge", "ztc/run", "backdoor/run", "backdoor/scan"}
+POST_OK = {"chat", "scenario", "kill", "resume", "tamper", "reset", "store/submit", "store/publish", "store/app", "store/install", "gate/decide", "vmask", "game/hint", "game/cheat", "browser/open", "browser/agent", "browser/snap", "browser/policy", "settings/get", "settings/revoke", "settings/grant", "settings/egress", "settings/policy", "settings/locked", "rsi/state", "rsi/propose", "rsi/apply", "rsi/rollback", "rsi/reset", "ztc/status", "ztc/judge", "ztc/run", "backdoor/run", "backdoor/scan", "backdoor/wake"}
 STATIC = {"index.html", "app.js", "ag.js", "store.js", "common.js", "terminal.js", "mines.js", "browser.js", "settings.js", "live_apps.js", "rsi.js", "ztc.js", "backdoor.js", "backdoor.css", "backdoor_metrics.json", "downloads/vdrpack.py", "demo/poisoned-page", "samples/weather-plus.vdr", "samples/weather-plus-tampered.vdr", "i18n.js", "demo_data.js", "styles.css", "ag_replay.json"}
 HITS = {}