Night Watch

Inspiration

Security bugs rarely hurt you alone; they chain. A missing check here and a leaked token there, and an attacker can walk from a public page to your user database. I wanted a night crew that watches a codebase while you sleep, proves each bug before touching anything, and fixes what's safe to fix on its own. Five Nights at Freddy's gave me the frame: a security office, cameras, doors, and animatronics that are really attack chains.

What it does

Night Shift is a crew of four Grok Bots that react to every push:

• Watcher checks only the parts of the app the new commit touched.
• Triage Guard proves each real bug with a failing security test, including logic bugs scanners miss.
• Fixer writes the smallest fix and opens a PR.
• Night Manager merges it only if five rules pass: the proof fails before and passes after, nothing else breaks, the diff is small and local, and nothing touches auth, dependencies or CI. Anything else waits for a human.

A live dashboard shows the crew at work, a case file with the real evidence (proof test, failure, diff, checks), and a camera map where animatronics advance along open attack paths toward the database.

How I built it

• Grok Bots do all the work: role prompts, memory, a group chat for hand-offs, and a routine webhook that wakes them on each push.
• A Python CLI is the contract between the Bots and the system, with deterministic "who's next" logic so the crew finishes the job.
• Every proof runs in a "mimic", a throwaway Docker container with fake data, never production.
• FastAPI and Server-Sent Events drive a vanilla JS/SVG dashboard, with original characters drawn in code.
• A deliberately vulnerable Flask demo app that I own, run locally.

Challenges I ran into

Mostly the realities of running agents:

• Four Bots sharing one checkout and stepping on each other.
• A GitHub token that silently blocked merges.
• Tools missing from non-interactive shells.
• The crew stalling on leftover branches or human reviews.

Fixes included a sync step, a separate workspace for each fix, REST-only GitHub calls, a self-cleanup command, and a watcher that resumes the crew after a human merges.

Accomplishments that I'm proud of

• The crew found, proved, fixed and merged real fixes on its own, and correctly stopped for a human on an auth change.
• Every fix leaves a regression test behind.
• I built the whole four-agent system solo in one day.

What I learned

Autonomy is only credible with evidence, and agents need deterministic rails. Most multi-agent bugs came from shared state, not from the AI.

What's next for Night Shift

Real multi-file codebases, letting the crew learn new kinds of bugs, and per-team autonomy rules.

Built With

• cloudflare-tunnel
• fastapi
• flask
• github
• github-actions
• grok
• grokbots
• javascript
• pytest
• python
• sqlite