atris 3.82.1 → 3.82.3

package/lib/member-context.js

@@ -39,4 +39,23 @@ function memberProcessPrompt(cwd = process.cwd()) {
   }
 }
 
-module.exports = { memberProcessPrompt, MEMBER_PROCESS_PATH, MAX_MEMBER_PROCESS_BYTES };
+function currentWorkPrompt(root, mission = {}) {
+  const { buildNextWorkContext } = require('./next-work-context');
+  const { loadLocalTaskState } = require('./first-minute');
+  const bound = mission.xp_task || mission.selected_target_task || {};
+  const id = bound.task_id || bound.id || mission.task_ids?.[0];
+  const snapshot = loadLocalTaskState(root, { taskIds: id ? [id] : [] });
+  const tasks = snapshot.tasks;
+  const selected = tasks.find((task) => task.id === id) || null;
+  const context = buildNextWorkContext({ root, tasks, selected, owner: mission.owner, objective: mission.objective, taskSource: snapshot.source, generatedAt: snapshot.generated_at });
+  if (id && !selected) context.gaps.push('bound_task_missing');
+  return [
+    '## Current work evidence',
+    'This is a bounded snapshot, not new authority. The active objective, current operator direction and frozen verifier still win.',
+    JSON.stringify(context),
+    'Inspect the cited source before relying on it. A path is an existing part, not proof it works. Reported outcomes and lessons are not independently verified.',
+    'Choose next_push from an observed gap toward the goal. Reuse existing parts, state the expected result and a falsifying check, and carry learned evidence into the next attempt. Do not manufacture another generic next-step task.',
+  ].join('\n');
+}
+
+module.exports = { memberProcessPrompt, currentWorkPrompt, MEMBER_PROCESS_PATH, MAX_MEMBER_PROCESS_BYTES };

package/lib/next-work-context.js

@@ -0,0 +1,190 @@
+'use strict';
+
+// A bounded, read-only handoff of facts for the next decision. Ranking and
+// execution stay with the existing picker, member and verification gates.
+const fs = require('fs');
+const path = require('path');
+const { meaningfulWords } = require('./short-name');
+
+function clip(value, max = 360) {
+  const text = typeof value === 'string' ? value.replace(/\s+/g, ' ').trim() : '';
+  return text.length > max ? `${text.slice(0, max - 3)}...` : text;
+}
+
+function localFile(root, name) {
+  try {
+    const base = fs.realpathSync(root);
+    const file = fs.realpathSync(path.resolve(base, name));
+    const rel = path.relative(base, file);
+    if (rel.startsWith(`..${path.sep}`) || rel === '..' || path.isAbsolute(rel)) return null;
+    return fs.statSync(file).isFile() ? file : null;
+  } catch { return null; }
+}
+
+function readSource(root, name, maxBytes) {
+  const file = localFile(root, name);
+  if (!file) return { path: name, text: '', unavailable: true };
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const stat = fs.fstatSync(fd);
+    const buffer = Buffer.alloc(Math.min(stat.size, maxBytes));
+    const count = fs.readSync(fd, buffer, 0, buffer.length, 0);
+    return { path: name, text: buffer.subarray(0, count).toString('utf8'), truncated: stat.size > maxBytes, modified_at: stat.mtime.toISOString() };
+  } catch { return { path: name, text: '', unavailable: true }; }
+  finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+
+// Keep the offline projection fallback, but a known row's current database
+// status always wins. Include finished rows so their outcomes are not lost.
+function reconcileTaskRows(rows, projected, lookup = () => null) {
+  const known = new Map(rows.map((row) => [row.id, row]));
+  const seen = new Set();
+  const merged = [];
+  for (const row of projected) {
+    if (!row || typeof row !== 'object') continue;
+    // Older offline snapshots have only a display reference. Preserve that
+    // evidence without pretending it has a database identity or authority.
+    if (!row.id) { merged.push(row); continue; }
+    if (seen.has(row.id)) continue;
+    seen.add(row.id);
+    const current = known.get(row.id) || lookup(row.id);
+    if (current !== false) merged.push(current || row);
+  }
+  return [...merged, ...rows.filter((row) => !seen.has(row.id))];
+}
+
+function matchingParts(root, map, query) {
+  const wanted = new Set(meaningfulWords(query, 100));
+  const found = new Map();
+  map.text.split(/\r?\n/).forEach((line, index) => {
+    if (!line.startsWith('|')) return;
+    const score = meaningfulWords(line, 100).filter((word) => wanted.has(word)).length;
+    if (!score) return;
+    for (const match of line.matchAll(/`([^`]+)`/g)) {
+      const name = match[1].replace(/:\d+$/, '');
+      if (path.isAbsolute(name) || !localFile(root, name) || found.has(name)) continue;
+      found.set(name, { path: name, source: `${map.path}:${index + 1}`, description: clip(line.replace(/`/g, ''), 180), score });
+    }
+  });
+  return [...found.values()].sort((a, b) => b.score - a.score).slice(0, 5)
+    .map(({ score, ...part }) => part);
+}
+
+function recentOutcomes(tasks, selected) {
+  return tasks.filter((task) => ['done', 'failed', 'review'].includes(task.status))
+    .sort((a, b) => Number(b.id === selected?.id) - Number(a.id === selected?.id)
+      || Number(b.updated_at || 0) - Number(a.updated_at || 0))
+    .slice(0, 3).map((task) => {
+      const meta = task.metadata || {};
+      return {
+        task_id: clip(task.id, 120),
+        title: clip(task.title, 160),
+        status: task.status,
+        result: clip(task.result || meta.result),
+        lesson: clip(task.review?.lesson || meta.latest_agent_lesson),
+        next: clip(task.review?.next_task || meta.latest_agent_next_task),
+        proof: clip(task.review?.proof || meta.latest_agent_proof),
+        validation: task.status === 'failed' ? 'failed' : task.status === 'review' ? 'review_pending'
+          : meta.accepted_by && meta.accepted_at ? 'accepted' : 'reported',
+      };
+    });
+}
+
+function otherOwner(task, owner) {
+  const assigned = typeof task.metadata?.assigned_to === 'string' ? task.metadata.assigned_to.trim() : '';
+  return Boolean((task.claimed_by && task.claimed_by !== owner) || (assigned && assigned !== owner));
+}
+
+function candidateEvidence(tasks, selected, goal, owner) {
+  const words = new Set(meaningfulWords(goal?.text, 100));
+  const { heldForPerson } = require('./member-task-pick');
+  return tasks.filter((task) => task.id !== selected?.id && ['open', 'claimed', 'review'].includes(task.status))
+    .map((task) => {
+      const meta = task.metadata || {};
+      const why = clip(meta.why_it_matters || task.explanation?.why_it_matters, 240);
+      const overlap = new Set(meaningfulWords(`${task.title} ${meta.objective || ''} ${why}`, 100).filter((word) => words.has(word))).size;
+      return {
+        task_id: clip(task.id, 120), title: clip(task.title, 160), status: task.status,
+        owner: clip(task.claimed_by || meta.assigned_to, 80) || null,
+        why: why || null,
+        held: heldForPerson(task) || (otherOwner(task, owner) ? 'other_owner' : null),
+        goal_word_overlap: overlap,
+      };
+    }).sort((a, b) => b.goal_word_overlap - a.goal_word_overlap).slice(0, 3);
+}
+
+function buildNextWorkContext({ root, tasks = [], selected = null, owner = '', taskSource = 'projection', objective = '', generatedAt = null }) {
+  const scoreboard = readSource(root, '.atris/state/scoreboard.json', 16384);
+  const map = readSource(root, 'atris/MAP.md', 65536);
+  let goal = null;
+  try {
+    const value = scoreboard.truncated ? null : JSON.parse(scoreboard.text);
+    if (clip(value?.goal)) goal = { text: clip(value.goal, 600), source: scoreboard.path, updated_at: typeof value.updated_at === 'string' ? clip(value.updated_at, 80) : null };
+  } catch { /* Missing or unreadable knowledge stays unknown. */ }
+  const meta = selected?.metadata || {};
+  const rawCheck = typeof (meta.verify || meta.verifier) === 'string' ? (meta.verify || meta.verifier).trim() : '';
+  // Never offer an ellipsis as an executable command.
+  const check = rawCheck.length <= 600 ? rawCheck : '';
+  const { taskCheck, heldForPerson } = require('./member-task-pick');
+  const runnable = check && taskCheck({ metadata: { verify: check } }).runnable;
+  const parts = matchingParts(root, map, [objective, selected?.title, meta.objective, goal?.text].filter(Boolean).join(' '));
+  const gaps = [];
+  if (!goal) gaps.push('current_goal_missing');
+  if (taskSource === 'none') gaps.push('task_state_missing');
+  if (scoreboard.truncated) gaps.push('goal_source_truncated');
+  if (map.unavailable) gaps.push('parts_map_missing');
+  else if (!parts.length) gaps.push('matching_parts_missing');
+  if (map.truncated) gaps.push('parts_map_truncated');
+  if (selected && !runnable) gaps.push('runnable_check_missing');
+  if (rawCheck.length > 600) gaps.push('check_too_large_for_snapshot');
+  if (taskSource === 'projection' || taskSource === 'mixed') gaps.push('task_snapshot_not_authoritative');
+  if (generatedAt && Date.now() - Date.parse(generatedAt) > 3 * 86400000) gaps.push('task_snapshot_stale');
+  const why = clip(meta.why_it_matters || selected?.explanation?.why_it_matters);
+  if (selected && !why) gaps.push('reason_missing');
+  let kind = selected && runnable ? 'execute' : 'discover';
+  if (gaps.includes('task_snapshot_not_authoritative') || gaps.includes('task_snapshot_stale')) kind = 'discover';
+  let reason = selected ? 'Inspect the relevant source and establish the missing evidence before changing it.'
+    : 'No selectable job is recorded. Find one observed gap toward the current goal, with a falsifying check.';
+  if (kind === 'execute') reason = why || 'Run the recorded check against the relevant source before claiming progress.';
+  if (selected && !['open', 'claimed', 'review'].includes(selected.status)) {
+    kind = 'discover'; reason = 'The bound task is no longer active. Inspect its recorded result before proposing another gap.';
+    gaps.push(selected.status === 'done' ? 'bound_task_already_finished' : 'bound_task_not_active');
+  } else if (selected && heldForPerson(selected)) { kind = 'human_decision'; reason = 'This work is held for a person by the existing task policy.'; }
+  else if (selected?.status === 'review') {
+    const certified = selected.review?.agent_certified || meta.agent_certified || Number(meta.agent_review_pass_count) >= 2;
+    kind = certified ? 'human_decision' : selected.claimed_by === owner ? 'wait' : 'review';
+    reason = certified ? 'The recorded work needs human acceptance.' : 'A different actor must check the finished diff before more work is chosen.';
+  } else if (selected && otherOwner(selected, owner)) {
+    kind = 'wait'; reason = 'Another owner holds this job. Do not duplicate their work.';
+  }
+  const context = {
+    schema: 'atris.next_work_context.v1',
+    workspace_root: path.resolve(root),
+    captured_at: new Date().toISOString(),
+    task_source: taskSource,
+    goal,
+    parts,
+    candidates: candidateEvidence(tasks, selected, goal, owner),
+    recent_outcomes: recentOutcomes(tasks, selected),
+    gaps,
+    next_step: { kind, reason, check: check || null },
+    sources: [scoreboard, map].map(({ text, ...source }) => source),
+    selection_basis: 'existing queue policy; candidate keyword overlap is a discovery hint, not measured business value',
+  };
+  // Keep the packet bounded even with long unicode text or unusual paths.
+  while (Buffer.byteLength(JSON.stringify(context)) > 10000) {
+    if (!gaps.includes('context_budget_limited')) gaps.push('context_budget_limited');
+    if (context.parts.length) context.parts.pop();
+    else if (context.candidates.length) context.candidates.pop();
+    else if (context.recent_outcomes.length) context.recent_outcomes.pop();
+    else {
+      context.next_step.check = null;
+      if (context.next_step.kind === 'execute') context.next_step.kind = 'discover';
+      break;
+    }
+  }
+  return context;
+}
+
+module.exports = { buildNextWorkContext, reconcileTaskRows };

package/lib/security-audit.js

@@ -671,6 +671,128 @@ async function defaultRunJobs(jobs, { root, concurrency, timeoutMs }) {
   return runEngineAskJobs(pinned, { root, concurrency, timeoutMs });
 }
 
+// Atris-hosted engines (atris:fast, atris:pro) run on the Atris backend and
+// cannot open files, so their prompts carry the source they need. Secrets
+// are hidden at the one send point in lib/sentinel-cloud.js.
+const HOSTED_ENGINE = /^atris:[a-z0-9._-]+$/i;
+const HOSTED_SOURCE_BYTES = { hunter: 96 * 1024, verifier: 32 * 1024 };
+const HOSTED_CONTEXT_LINES = 40;
+// The output limit sent with each hosted turn (the turn API accepts at most 8192).
+const HOSTED_OUTPUT_TOKENS = { hunter: 8192, verifier: 4096 };
+// Largest message a hosted check (verifier, recheck, critic) may send. The
+// quote prices every check call at this size, so the quote is a ceiling.
+const HOSTED_CHECK_MAX_BYTES = 64 * 1024;
+const ENV_STYLE_FILE = /(?:^|\/)(?:\.env(?:\.[\w.-]+)?|\.envrc|.*\.(?:pem|key|p12|pfx|jks|keystore|crt|cer|der|asc|gpg|kdbx)|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|\.(?:npmrc|pypirc|netrc|pgpass|htpasswd)|credentials(?:\.[\w]+)?|secrets?(?:\.[\w]+)?|service[-_]?account[\w.-]*\.json)$/i;
+
+function isHostedEngine(engine) {
+  return HOSTED_ENGINE.test(String(engine || ''));
+}
+
+// A file a hosted engine may ever see: tracked by git, not ignored, inside
+// the requested scope, not a skipped folder, and not a key or .env-style file.
+function sensitiveFile(rel) {
+  if (ENV_STYLE_FILE.test(rel)) return true;
+  try { return require('./security-scan').sensitiveFileFindings([rel]).length > 0; } catch { return false; }
+}
+
+function hostedAllowedFiles(root, scope) {
+  let tracked = null;
+  try {
+    tracked = execFileSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 }).split('\0').filter(Boolean);
+  } catch { return new Set(); }
+  let ignored = new Set();
+  try {
+    const r = require('child_process').spawnSync('git', ['check-ignore', '--no-index', '-z', '--stdin'], { cwd: root, input: tracked.join('\0'), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    ignored = new Set(String(r.stdout || '').split('\0').filter(Boolean));
+  } catch {}
+  return new Set(tracked.filter((rel) => isRepoRel(rel) && !skippedPath(rel) && inScope(rel, scope) && !ignored.has(rel) && !sensitiveFile(rel)));
+}
+
+// Numbered source for a hosted engine. `ranges` maps a file to line windows;
+// a file with no window is shown whole. Stops at the byte cap. Only files in
+// `allowed` are ever read.
+function hostedSource(root, files, { maxBytes, ranges = new Map(), allowed = null } = {}) {
+  const out = [];
+  let used = 0;
+  const skipped = [];
+  for (const rel of [...new Set(files)].filter(isRepoRel).filter((f) => allowed && allowed.has(f))) {
+    const text = readText(root, rel);
+    if (text === null) continue;
+    const lines = text.split('\n');
+    const windows = ranges.get(rel);
+    const keep = new Set();
+    if (windows && windows.length) {
+      for (const n of windows) for (let i = Math.max(1, n - HOSTED_CONTEXT_LINES); i <= Math.min(lines.length, n + HOSTED_CONTEXT_LINES); i++) keep.add(i);
+    } else {
+      for (let i = 1; i <= lines.length; i++) keep.add(i);
+    }
+    const body = [];
+    let last = 0;
+    for (const n of [...keep].sort((a, b) => a - b)) {
+      if (last && n !== last + 1) body.push('   ...');
+      const line = lines[n - 1];
+      // Secrets are hidden at the one send point (lib/sentinel-cloud.js
+      // redactOutgoing), which sees whole key blocks.
+      body.push(`${String(n).padStart(5)}  ${line}`);
+      last = n;
+    }
+    const block = `### ${rel}\n\`\`\`\n${body.join('\n')}\n\`\`\``;
+    if (used + block.length > maxBytes) { skipped.push(rel); continue; }
+    used += block.length;
+    out.push(block);
+  }
+  if (!out.length && !skipped.length) return '';
+  return [
+    '## Source',
+    'You cannot open files in this session. The source you need is below with line numbers; cite files and lines from it.',
+    skipped.length ? `These files were too large to include: ${skipped.join(', ')}. Mark units that depend on them "blocked".` : '',
+    ...out,
+  ].filter(Boolean).join('\n\n');
+}
+
+function traceFiles(trace) {
+  const ranges = new Map();
+  for (const t of trace || []) {
+    if (!t || !isRepoRel(t.file)) continue;
+    if (!ranges.has(t.file)) ranges.set(t.file, []);
+    if (Number.isInteger(t.line)) ranges.get(t.file).push(t.line);
+  }
+  return ranges;
+}
+
+function withHostedSource(root, engine, prompt, { files = [], trace = null, kind = 'hunter', allowed = null } = {}) {
+  if (!isHostedEngine(engine)) return prompt;
+  if (kind === 'critic') return `${prompt}\n\nYou cannot open files in this session. Judge gaps from the architecture and ledger above.`;
+  const ranges = trace ? traceFiles(trace) : new Map();
+  const list = trace ? [...ranges.keys()] : files;
+  const src = hostedSource(root, list, { maxBytes: HOSTED_SOURCE_BYTES[kind] || HOSTED_SOURCE_BYTES.verifier, ranges, allowed });
+  return src ? `${prompt}\n\n${src}` : prompt;
+}
+
+// Units as a hosted hunter may see them: seeded lines only from allowed files.
+function hostedUnits(units, allowed) {
+  if (!allowed) return units;
+  return units.map((u) => ({ ...u, hot_lines: (u.hot_lines || []).filter((h) => allowed.has(h.file)) }));
+}
+
+// A trace as a hosted engine may see it: code lines only from allowed files.
+function hostedTrace(trace, allowed) {
+  if (!allowed) return trace;
+  return (trace || []).map((t) => {
+    if (!t || allowed.has(t.file)) return t;
+    const out = { ...t };
+    delete out.code;
+    return out;
+  });
+}
+
+// Titles and fix summaries are the only finding text that leaves the
+// machine (the account dashboard). Ask for plain words up front; the upload
+// filter replaces anything else.
+const PLAIN_TITLE_HINT = 'one plain sentence saying what goes wrong, with no code, identifiers, file contents or secrets';
+const PLAIN_FIX_HINT = 'one plain sentence describing the change in words, with no code, identifiers, file contents or secrets, for example "Pass the command and its arguments separately instead of building one shell string"';
+const PLAIN_TEXT_RULE = `Write "title" as ${PLAIN_TITLE_HINT}. Write remediation "summary" as ${PLAIN_FIX_HINT}. Keep code, names and lines in remediation "strategy", which stays in the local report.`;
+
 function bullet(lines) {
   return lines.map((l) => `- ${l}`).join('\n');
 }
@@ -692,13 +814,13 @@ function hunterPrompt({ architecture, units, exclusions, peerIds }) {
   const contract = {
     units: [{ coverage_id: 'one assigned id', disposition: 'covered|candidate|blocked', reviewed_paths: ['repo/relative/path'], checks: [{ invariant: 'the control you checked', method: 'source', result: 'what the source established', reviewed_paths: ['repo/relative/path'] }], candidate_fingerprints: [], unresolved: [] }],
     candidates: [{
-      proposed_verdict: 'confirmed|needs_validation', fingerprint: 'path:scope/root-cause-name', title: '', description: '', attack_class: classes[0].id,
+      proposed_verdict: 'confirmed|needs_validation', fingerprint: 'path:scope/root-cause-name', title: PLAIN_TITLE_HINT, description: '', attack_class: classes[0].id,
       coverage_ids: [], attacker: 'the lower-trust principal and what they start with', root_cause: '(confirmed) the source defect', claimed_root_cause: '(needs_validation) the suspected defect',
       intended_behavior: '', impact: 'the concrete result across the boundary',
       trace: [{ kind: 'entrypoint|propagation|sink', file: 'repo/relative/path', line: 1, description: '' }],
       conditions: [{ kind: CONDITION_KINDS.join('|'), description: '' }],
       severity: { likelihood: { score: SCORES.join('|'), reason: '' }, impact: { score: SCORES.join('|'), reason: '' }, overall: SCORES.join('|') },
-      remediation: { strategy: 'the smallest source change at the last trusted decision point', regression_test: 'the test that would fail today' },
+      remediation: { strategy: 'the smallest source change at the last trusted decision point', summary: PLAIN_FIX_HINT, regression_test: 'the test that would fail today' },
       blockers: ['(needs_validation) the exact missing fact'], validation_plan: [{ context: 'local|deployment', step: '' }],
     }],
     hardening: ['a concrete note that is not a finding'],
@@ -726,15 +848,16 @@ function hunterPrompt({ architecture, units, exclusions, peerIds }) {
     exclusions.length ? `## Already on record, do not report again\n${bullet(exclusions.slice(0, 20).map((e) => `${e.fingerprint}: ${e.title} (${e.why})`))}\n` : '',
     peerIds ? `Other hunters own ${peerIds} other units this wave. Stay inside your assigned paths; put anything else in "uncovered".\n` : '',
     '## Result contract',
+    PLAIN_TEXT_RULE,
     'Every assigned coverage_id appears exactly once in "units". "covered" means you read the paths and the invariant holds. "candidate" lists the fingerprints of the candidates you return. "blocked" means you read the code but one fact you cannot see decides it; say which in "unresolved". Every check lists the paths it read.',
     'Return only this JSON object, no prose before or after it:',
     JSON.stringify(contract, null, 2),
   ].join('\n');
 }
 
-function withCode(root, trace) {
+function withCode(root, trace, allowed = null) {
   return (trace || []).map((t) => {
-    const text = t && isRepoRel(t.file) ? readText(root, t.file) : null;
+    const text = t && isRepoRel(t.file) && (!allowed || allowed.has(t.file)) ? readText(root, t.file) : null;
     const line = text && Number.isInteger(t.line) ? text.split('\n')[t.line - 1] : undefined;
     return line === undefined ? t : { ...t, code: line.trim().slice(0, 200) };
   });
@@ -747,7 +870,7 @@ function verifierPrompt({ candidate, cls }) {
     verdict: 'confirmed|needs_validation|rejected',
     reason: 'what you read and why it holds or fails',
     preventing_layer: 'file:line of the control that stops it, or null',
-    corrected: { title: '', root_cause: '', attacker: '', impact: '', trace: [{ kind: 'entrypoint|propagation|sink', file: '', line: 1, description: '' }], conditions: [], severity: { likelihood: { score: '', reason: '' }, impact: { score: '', reason: '' }, overall: '' }, remediation: { strategy: '', regression_test: '' } },
+    corrected: { title: '', root_cause: '', attacker: '', impact: '', trace: [{ kind: 'entrypoint|propagation|sink', file: '', line: 1, description: '' }], conditions: [], severity: { likelihood: { score: '', reason: '' }, impact: { score: '', reason: '' }, overall: '' }, remediation: { strategy: '', summary: '', regression_test: '' } },
     blockers: ['(needs_validation) the exact missing fact'],
     validation_plan: [{ context: 'local|deployment', step: '' }],
   };
@@ -764,6 +887,7 @@ function verifierPrompt({ candidate, cls }) {
       'A library version or behavior is not outside source when the target has it installed. Read the lockfile, the venv or .venv site-packages, or node_modules before sending it to the owner.',
       '"rejected": the source disproves it. Name the line that does.',
       'Use "corrected" only for fields you would change. Read-only: do not run the target or touch the network.',
+      `If the title or remediation summary has code, names or file contents, rewrite it in "corrected". ${PLAIN_TEXT_RULE}`,
     ]),
     '',
     `## Attack class: ${cls.title}`,
@@ -791,6 +915,7 @@ function recheckPrompt({ record }) {
     bullet([
       'Open each cited file:line. Every sentence in the record must match what the code does now.',
       'Check the severity against the anchors. Overall can never exceed impact.',
+      `If the title or remediation summary has code, names or file contents, return it rewritten in "corrected". ${PLAIN_TEXT_RULE}`,
       'If the record is right, return {"ok": true}.',
       'If a detail is wrong but the problem is real, return {"ok": false, "verdict": "confirmed", "corrected": {...only the fields to change}}.',
       'If the problem is not real after all, return {"ok": false, "verdict": "rejected", "reason": "..."} or {"ok": false, "verdict": "needs_validation", "blockers": [...], "validation_plan": [{"context": "local|deployment", "step": "..."}]}.',
@@ -1007,7 +1132,7 @@ function buildRecord(root, cand, verdict, extra) {
     trace,
     conditions: (cand.conditions || []).filter((c) => c && CONDITION_KINDS.includes(c.kind) && nonEmptyString(c.description)).map((c) => ({ kind: c.kind, description: str(c.description, 400) })),
     severity: clampSeverity(cand.severity),
-    remediation: { strategy: str(cand.remediation && cand.remediation.strategy), regression_test: str(cand.remediation && cand.remediation.regression_test) },
+    remediation: { strategy: str(cand.remediation && cand.remediation.strategy), summary: str(cand.remediation && cand.remediation.summary, 400), regression_test: str(cand.remediation && cand.remediation.regression_test) },
     evidence_level: 'source-traced, not executed',
     verified_by: extra.by ? [extra.by] : [],
   };
@@ -1021,7 +1146,8 @@ function mergeCorrected(cand, corrected) {
   if (Array.isArray(corrected.conditions) && corrected.conditions.length) out.conditions = corrected.conditions;
   const s = corrected.severity;
   if (s && s.impact && SCORES.includes(s.impact.score) && SCORES.includes(s.overall) && s.likelihood && SCORES.includes(s.likelihood.score)) out.severity = s;
-  if (corrected.remediation && nonEmptyString(corrected.remediation.strategy)) out.remediation = corrected.remediation;
+  if (corrected.remediation && nonEmptyString(corrected.remediation.strategy)) out.remediation = { ...(cand.remediation || {}), ...corrected.remediation };
+  else if (corrected.remediation && nonEmptyString(corrected.remediation.summary)) out.remediation = { ...(cand.remediation || {}), summary: corrected.remediation.summary };
   return out;
 }
 
@@ -1209,6 +1335,23 @@ function pickBatches(ledger, profile, allowance) {
   return batches;
 }
 
+// The most a hosted run can send: every budgeted call, each at its largest
+// allowed message and its full output limit. Hunter messages are measured
+// from this run's real first-wave batches; the largest one becomes the hunter
+// limit for the whole run. One token per byte is a true ceiling: a token is
+// never shorter than a byte.
+function spendEstimate({ root, architecture, ledger, profile, plan, exclusions, hunter, verifier, allowed }) {
+  const batches = pickBatches(ledger, profile, plan.hunters);
+  const sizes = batches.map((units) => Buffer.byteLength(withHostedSource(root, hunter, hunterPrompt({ architecture, units: hostedUnits(units, allowed), exclusions, peerIds: plan.hunters }), { files: units.flatMap((u) => u.starting_paths), kind: 'hunter', allowed })));
+  const hunterMax = Math.max(4096, ...sizes);
+  const criticBytes = Buffer.byteLength(criticPrompt({ architecture, units: ledger, final: true })) + 1024;
+  const checkMax = Math.max(HOSTED_CHECK_MAX_BYTES, criticBytes);
+  const rows = [];
+  if (isHostedEngine(hunter)) rows.push({ role: 'hunter', model: hunter, calls: plan.hunters, input_tokens: hunterMax, output_tokens: HOSTED_OUTPUT_TOKENS.hunter, max_input_bytes: hunterMax });
+  if (isHostedEngine(verifier)) rows.push({ role: 'verifier', model: verifier, calls: plan.total - plan.hunters, input_tokens: checkMax, output_tokens: HOSTED_OUTPUT_TOKENS.verifier, max_input_bytes: checkMax });
+  return { profile, budget: plan.total, calls: rows };
+}
+
 async function runAudit(opts = {}) {
   const root = path.resolve(opts.root || process.cwd());
   const profile = PROFILES.includes(opts.profile) ? opts.profile : 'standard';
@@ -1253,8 +1396,15 @@ async function runAudit(opts = {}) {
     started_at: now().toISOString(),
     run_status: 'in_progress',
     invocations: { used: 0, hunters: 0, critics: 0, verifiers: 0, rechecks: 0 },
+    credits_used: 0,
     method: 'adapted from cloudflare/security-audit-skill (MIT)',
   };
+  // What a hosted engine may ever be shown (null for local engines, which
+  // read the checkout themselves).
+  const hostedAny = isHostedEngine(hunter) || isHostedEngine(verifier);
+  const allowed = hostedAny ? hostedAllowedFiles(root, scope) : null;
+  const hunterAllowed = isHostedEngine(hunter) ? allowed : null;
+  const verifierAllowed = isHostedEngine(verifier) ? allowed : null;
   const ledgerFile = path.join(dir, 'coverage-ledger.json');
   const saveLedger = () => {
     ledger.sort(cmpId);
@@ -1302,12 +1452,29 @@ async function runAudit(opts = {}) {
     return finish('incomplete', 'budget_cannot_fund_hunters_and_reserves', [], carried.map((r) => r.fingerprint));
   }
 
+  // Hosted engines spend credits: the caller sees an upper-bound estimate and
+  // says yes before the first call. A no leaves nothing behind.
+  if (opts.confirmSpend && hostedAny) {
+    const estimate = spendEstimate({ root, architecture, ledger, profile, plan, exclusions, hunter, verifier, allowed });
+    let ok = false;
+    try { ok = await opts.confirmSpend(estimate); } catch (e) { fs.rmSync(dir, { recursive: true, force: true }); throw e; }
+    if (!ok) {
+      fs.rmSync(dir, { recursive: true, force: true });
+      return { declined: true, dir: null, meta, ledger, records: [], estimate };
+    }
+  }
+
   const call = async (kind, jobs) => {
     if (!jobs.length) return [];
     meta.invocations.used += jobs.length;
     meta.invocations[kind] += jobs.length;
     writeJson(path.join(dir, 'run-metadata.json'), meta);
     const answers = await runJobs(jobs, { root, concurrency, timeoutMs });
+    for (const a of answers || []) {
+      const c = Number(a && a.credits_charged);
+      if (Number.isFinite(c) && c > 0) meta.credits_used += c;
+    }
+    writeJson(path.join(dir, 'run-metadata.json'), meta);
     return answers;
   };
 
@@ -1319,7 +1486,7 @@ async function runAudit(opts = {}) {
   const failures = [];
   const runCritic = async (wave, final) => {
     criticsLeft -= 1;
-    const [answer] = await call('critics', [{ engine: verifier, prompt: criticPrompt({ architecture, units: ledger, final }), label: `sentinel critic ${final ? 'final' : `w${wave}`}` }]);
+    const [answer] = await call('critics', [{ engine: verifier, prompt: withHostedSource(root, verifier, criticPrompt({ architecture, units: ledger, final }), { kind: 'critic' }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel critic ${final ? 'final' : `w${wave}`}` }]);
     const parsed = answer && answer.ok !== false ? extractJson(answer.stdout, (v) => Array.isArray(v.missing_units) || Array.isArray(v.reassign_ids)) : null;
     if (!parsed) return { accepted: 0, failed: true };
     const fresh = (parsed.missing_units || []).map((raw) => proposedUnit(root, raw, { profile, scope })).filter(Boolean);
@@ -1340,11 +1507,11 @@ async function runAudit(opts = {}) {
     const jobs = batches.map((units, i) => {
       const agentId = `h${wave}-${String(i + 1).padStart(2, '0')}`;
       for (const u of units) { u.status = 'in_progress'; u.agent_id = agentId; u.wave = wave; }
-      return { engine: hunter, prompt: hunterPrompt({ architecture, units, exclusions, peerIds: waveUnits - units.length }), label: `sentinel hunter ${agentId}`, _units: units, _agent: agentId };
+      return { engine: hunter, prompt: withHostedSource(root, hunter, hunterPrompt({ architecture, units: hostedUnits(units, hunterAllowed), exclusions, peerIds: waveUnits - units.length }), { files: units.flatMap((u) => u.starting_paths), kind: 'hunter', allowed: hunterAllowed }), max_output_tokens: isHostedEngine(hunter) ? HOSTED_OUTPUT_TOKENS.hunter : undefined, label: `sentinel hunter ${agentId}`, _units: units, _agent: agentId };
     });
     saveLedger();
     log(`wave ${wave}: ${jobs.length} hunter${jobs.length === 1 ? '' : 's'} on ${jobs.reduce((n, j) => n + j._units.length, 0)} areas (${hunter})`);
-    const answers = await call('hunters', jobs.map(({ engine, prompt, label }) => ({ engine, prompt, label })));
+    const answers = await call('hunters', jobs.map(({ engine, prompt, label, max_output_tokens: m }) => ({ engine, prompt, label, ...(m ? { max_output_tokens: m } : {}) })));
     const uncovered = [];
     answers.forEach((answer, i) => {
       const res = applyHunterResult(root, jobs[i]._units, answer, jobs[i]._agent, hunter);
@@ -1417,13 +1584,22 @@ async function runAudit(opts = {}) {
       records.push(buildRecord(root, cand, 'rejected', { reason: `cited source does not resolve: ${errs.slice(0, 3).join('; ')}`, by: { engine: 'atris', agent_id: 'citation-check' } }));
       continue;
     }
+    // A hosted verifier is only ever shown files this review may send. A
+    // trace outside them (a model citing .env, or a path outside the scope)
+    // never reaches it.
+    const outside = verifierAllowed ? [...new Set((cand.trace || []).map((t) => t && t.file).filter((f) => !verifierAllowed.has(f)))] : [];
+    if (outside.length) {
+      if (cand._carried) pending.push(cand.fingerprint);
+      else records.push(buildRecord(root, cand, 'rejected', { reason: `cites files this review may not send to atris models: ${outside.slice(0, 3).join(', ')}`, by: { engine: 'atris', agent_id: 'scope-check' } }));
+      continue;
+    }
     toVerify.push(cand);
   }
   const verifyBudget = Math.max(0, total - meta.invocations.used);
   const verifyNow = toVerify.slice(0, verifyBudget);
   const notVerified = toVerify.slice(verifyBudget);
   log(`verifying ${verifyNow.length} candidate${verifyNow.length === 1 ? '' : 's'} with ${verifier}`);
-  const vJobs = verifyNow.map((cand, i) => ({ engine: verifier, prompt: verifierPrompt({ candidate: { ...cand, trace: withCode(root, cand.trace), _carried: undefined, _unit_class: undefined, carried_from: undefined, verified_by: undefined }, cls: CLASS_BY_ID.get(cand.attack_class) }), label: `sentinel verifier v-${String(i + 1).padStart(2, '0')}` }));
+  const vJobs = verifyNow.map((cand, i) => ({ engine: verifier, prompt: withHostedSource(root, verifier, verifierPrompt({ candidate: { ...cand, trace: withCode(root, cand.trace, verifierAllowed), _carried: undefined, _unit_class: undefined, carried_from: undefined, verified_by: undefined }, cls: CLASS_BY_ID.get(cand.attack_class) }), { trace: cand.trace, kind: 'verifier', allowed: verifierAllowed }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel verifier v-${String(i + 1).padStart(2, '0')}` }));
   const vAnswers = await call('verifiers', vJobs);
   vAnswers.forEach((answer, i) => {
     const cand = verifyNow[i];
@@ -1440,7 +1616,7 @@ async function runAudit(opts = {}) {
     const confirmed = records.filter((r) => r.verdict === 'confirmed');
     const room = Math.max(0, total - meta.invocations.used);
     const checkNow = confirmed.slice(0, room);
-    const rJobs = checkNow.map((rec, i) => ({ engine: verifier, prompt: recheckPrompt({ record: rec }), label: `sentinel recheck r-${String(i + 1).padStart(2, '0')}` }));
+    const rJobs = checkNow.map((rec, i) => ({ engine: verifier, prompt: withHostedSource(root, verifier, recheckPrompt({ record: verifierAllowed ? { ...rec, trace: hostedTrace(rec.trace, verifierAllowed) } : rec }), { trace: rec.trace, kind: 'verifier', allowed: verifierAllowed }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel recheck r-${String(i + 1).padStart(2, '0')}` }));
     const rAnswers = await call('rechecks', rJobs);
     rAnswers.forEach((answer, i) => {
       const rec = checkNow[i];
@@ -1544,6 +1720,9 @@ module.exports = {
   citationErrors,
   decide,
   runAudit,
+  isHostedEngine,
+  hostedAllowedFiles,
   latestRun,
+  repoName,
   shouldFailAudit,
 };