atris 3.82.2 → 3.82.3

package/commands/security-review.js

@@ -123,10 +123,10 @@ function applyBaselineOptions(root, rawFindings, opts) {
 
 function securityReviewCommand(argv = []) {
   const sub = argv[0];
+  if (sub === 'audit') return auditCommand(argv.slice(1));
   if (sub === 'help' || argv.includes('-h') || argv.includes('--help')) return printHelp();
   if (sub === 'rules') return printRules();
   if (sub === 'hook' || sub === 'install-hook') return installHook();
-  if (sub === 'audit') return auditCommand(argv.slice(1));
 
   const root = process.cwd();
   let opts;
@@ -402,7 +402,7 @@ function installHook() {
 }
 
 function parseAuditArgs(argv) {
-  const opts = { profile: 'standard', scope: [], json: false, planOnly: false, budget: null, out: null, hunter: null, verifier: null, timeoutMs: null };
+  const opts = { profile: 'standard', scope: [], json: false, planOnly: false, budget: null, out: null, hunter: null, verifier: null, timeoutMs: null, engine: null, yes: false, upload: true, scheduled: false };
   const takes = (i, flag) => {
     if (!argv[i + 1] || argv[i + 1].startsWith('--')) throw new Error(`${flag} needs a value`);
     return argv[i + 1];
@@ -420,6 +420,10 @@ function parseAuditArgs(argv) {
     else if (flag === '--hunter') opts.hunter = value();
     else if (flag === '--verifier') opts.verifier = value();
     else if (flag === '--timeout') opts.timeoutMs = Number(value()) * 1000;
+    else if (flag === '--engine') opts.engine = value();
+    else if (flag === '--yes' || flag === '-y') opts.yes = true;
+    else if (flag === '--no-upload') opts.upload = false;
+    else if (flag === '--scheduled') opts.scheduled = true;
     else if (arg.startsWith('-')) throw new Error(`unknown flag: ${arg}`);
     else opts.scope.push(arg);
   }
@@ -427,6 +431,7 @@ function parseAuditArgs(argv) {
   if (!PROFILES.includes(opts.profile)) throw new Error(`--profile must be one of ${PROFILES.join(', ')}`);
   if (opts.budget !== null && (!Number.isInteger(opts.budget) || opts.budget < 1 || opts.budget > 500)) throw new Error('--budget must be a whole number from 1 to 500');
   if (opts.timeoutMs !== null && (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs < 10000)) throw new Error('--timeout is in seconds, at least 10');
+  if (opts.engine !== null && !['atris', 'local'].includes(opts.engine)) throw new Error('--engine must be atris or local');
   return opts;
 }
 
@@ -454,7 +459,7 @@ function renderAuditLanding({ dir, meta, records }) {
   } else {
     L.push(`  ${confirmed.length} confirmed${sevText ? ` (${sevText})` : ''} · ${needs.length} need a fact from you · ${rejected.length} disproved`);
     L.push(`  read ${cov.fresh} areas this run, ${cov.carried} carried unchanged, ${cov.deferred || 0} left for the next run`);
-    L.push(`  found by ${meta.engines.hunter}, checked by ${meta.engines.verifier}${meta.engines.hunter === meta.engines.verifier ? ' (same engine)' : ''} · ${meta.invocations.used} engine calls of ${meta.budget}`);
+    L.push(`  found by ${meta.engines.hunter}, checked by ${meta.engines.verifier}${meta.engines.hunter === meta.engines.verifier ? ' (same engine)' : ''} · ${meta.invocations.used} engine calls of ${meta.budget}${meta.credits_used ? ` · ${meta.credits_used} credits used` : ''}`);
     for (const r of confirmed.slice(0, 6)) {
       const sink = r.trace[r.trace.length - 1];
       L.push(`    ${r.severity.overall.padEnd(8)} ${r.title} (${sink.file}:${sink.line})`);
@@ -465,33 +470,204 @@ function renderAuditLanding({ dir, meta, records }) {
   return L.join('\n');
 }
 
-async function auditCommand(argv) {
+// Ask once on a terminal. Anything but y or yes is a no.
+function askYesNo(question, { input = process.stdin, output = process.stdout } = {}) {
+  return new Promise((resolve) => {
+    const rl = require('readline').createInterface({ input, output });
+    rl.question(question, (answer) => { rl.close(); resolve(/^\s*y(es)?\s*$/i.test(String(answer || ''))); });
+  });
+}
+
+async function uploadAfterRun(dir, { token, quiet, cloud }) {
+  const res = await cloud.uploadRun(dir, { token });
+  const say = quiet ? (m) => console.error(m) : (m) => console.log(m);
+  if (res.ok) say('  saved the summary to your atris account (no source code was sent)');
+  else say(`  warning: could not save the summary to your atris account: ${res.reason}. the review itself is done`);
+  return res;
+}
+
+async function auditUploadCommand(argv, deps) {
+  const audit = require('../lib/security-audit');
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  if (!token) { console.error('  log in first with atris login. then run atris sentinel upload again'); return 2; }
+  const arg = argv.find((a) => !a.startsWith('-'));
+  let dir = arg ? path.resolve(arg) : null;
+  if (!dir) {
+    const last = audit.latestRun(deps.root || process.cwd());
+    if (!last) { console.error('  no sentinel review has run for this repo yet'); return 2; }
+    dir = last.dir;
+  }
+  if (!fs.existsSync(path.join(dir, 'run-metadata.json'))) { console.error(`  ${tildePath(dir)} is not a sentinel run folder`); return 2; }
+  const res = await cloud.uploadRun(dir, { token });
+  if (!res.ok) { console.error(`  could not save ${path.basename(dir)}: ${res.reason}`); return 1; }
+  console.log(`  saved ${path.basename(dir)} to your atris account (no source code was sent)`);
+  return 0;
+}
+
+// Price one quick run on atris models for a folder without calling any
+// model: the audit plans, the estimate is quoted, and the plan is dropped.
+async function quoteQuickRun(target, { hunter, verifier, token, cloud }) {
+  const audit = require('../lib/security-audit');
+  let estimate = null;
+  await audit.runAudit({
+    root: target, profile: 'quick', hunter, verifier,
+    runJobs: async () => { throw new Error('no model call while pricing a schedule'); },
+    confirmSpend: async (est) => { estimate = est; return false; },
+  });
+  if (!estimate) throw new Error('could not plan a review for this folder');
+  return cloud.quoteEstimate(estimate, { token });
+}
+
+async function auditScheduleCommand(argv, deps) {
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const { installKeep, removeKeep } = require('../lib/campaign-keep');
+  const uninstall = argv.includes('--uninstall');
+  let every = 'day';
+  let target = null;
+  let engine = null;
+  let maxCredits = null;
+  let yes = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const [flag, inline] = a.startsWith('--') && a.includes('=') ? [a.slice(0, a.indexOf('=')), a.slice(a.indexOf('=') + 1)] : [a, null];
+    const value = () => (inline !== null ? inline : argv[++i]);
+    if (flag === '--every') every = value();
+    else if (flag === '--engine') engine = value();
+    else if (flag === '--max-credits') maxCredits = Number(value());
+    else if (flag === '--yes' || flag === '-y') yes = true;
+    else if (flag === '--uninstall' || flag === '--install') continue;
+    else if (a.startsWith('-')) { console.error(`  unknown flag: ${a}`); return 2; }
+    else target = a;
+  }
+  if (!cloud.SCHEDULE_EVERY[every]) { console.error('  use --every day or --every week'); return 2; }
+  if (engine !== null && engine !== 'atris' && engine !== 'local') { console.error('  --engine must be atris or local'); return 2; }
+  if (maxCredits !== null && (!Number.isInteger(maxCredits) || maxCredits < 1)) { console.error('  --max-credits must be a whole number of credits, at least 1'); return 2; }
+  target = path.resolve(target || deps.root || process.cwd());
+  if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) { console.error(`  ${target} is not a folder`); return 2; }
+  const atrisBin = deps.atrisBin || path.resolve(__dirname, '..', 'bin', 'atris.js');
+  const plan = cloud.schedulePlan({ target, every, homeDir: deps.homeDir, platform: deps.platform, atrisBin, envPath: deps.envPath });
+  const keepDeps = deps.spawn ? { spawn: deps.spawn } : {};
+  if (uninstall) {
+    // Same folder makes the same timer name, so --every does not matter here.
+    const removed = removeKeep(plan, keepDeps);
+    if (!removed.ok) { console.error(`  could not remove the timer: ${removed.error}`); return 1; }
+    cloud.removeApproval(target, deps.homeDir);
+    console.log(`  scheduled reviews ${removed.removed === false ? 'were not on' : 'are off'} for ${tildePath(target)}`);
+    return 0;
+  }
+  const space = require('../lib/worktree-space');
+  if (!deps.atrisBin && (space.isAgentCopyPath(atrisBin) || space.isScratchPath(atrisBin))) {
+    console.error(`  refusing: this atris runs from ${path.dirname(path.dirname(atrisBin))}, a folder that gets removed. install the timer from a lasting atris install`);
+    return 2;
+  }
+
+  // The engine is decided now, with the owner here, and written down. A
+  // scheduled run never picks again.
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let engines;
+  try { engines = cloud.resolveEngines({ engine, token, env: deps.env || process.env }); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  let approval;
+  if (engines.mode === 'atris') {
+    let quote;
+    try { quote = await quoteQuickRun(target, { hunter: engines.hunter, verifier: engines.verifier, token, cloud }); } catch (e) { console.error(`  no timer was set. ${e.message}`); return 2; }
+    const cap = maxCredits || quote.credits;
+    console.log(`\n  each scheduled review runs on atris models (no codex or claude needed)`);
+    console.log(`  ${cloud.describeQuote(quote)}`);
+    console.log(`  each run may spend at most ${cap} credits, once a ${every}. a run that reaches that stops\n`);
+    if (!yes) {
+      const input = deps.input || process.stdin;
+      if (!input.isTTY && !deps.input) { console.error('  no timer was set. add --yes to approve this spend without the question'); return 1; }
+      const ok = await (deps.ask || askYesNo)(`  approve up to ${cap} credits per scheduled run? (y/N) `, { input, output: process.stdout });
+      if (!ok) { console.log('  no timer was set'); return 1; }
+    }
+    approval = { engine: 'atris', hunter: engines.hunter, verifier: engines.verifier, max_credits: cap, quoted_credits: quote.credits, every, approved_at: new Date().toISOString() };
+  } else {
+    approval = { engine: 'local', every, approved_at: new Date().toISOString() };
+  }
+  cloud.writeApproval(target, approval, deps.homeDir);
+  const installed = installKeep(plan, keepDeps);
+  if (!installed.ok) { cloud.removeApproval(target, deps.homeDir); console.error(`  could not install the timer: ${installed.error}`); return 1; }
+  console.log(`  scheduled reviews are on for ${tildePath(target)}, once a ${every}`);
+  console.log('  each run uses the quick profile and saves its summary to your atris account');
+  if (approval.engine === 'local') console.log('  runs use only codex and claude on this machine. they never switch to atris models');
+  else console.log(`  runs use atris models and stop at ${approval.max_credits} credits`);
+  console.log(`  log: ${tildePath(plan.log_path)}`);
+  console.log(`  stop with: atris sentinel schedule --uninstall ${tildePath(target)}`);
+  return 0;
+}
+
+async function auditCommand(argv, deps = {}) {
   if (argv[0] === 'help' || argv.includes('-h') || argv.includes('--help')) return printAuditHelp();
   const audit = require('../lib/security-audit');
+  const root = deps.root || process.cwd();
   if (argv[0] === 'status' || argv[0] === 'last') {
-    const last = audit.latestRun(process.cwd());
+    const last = audit.latestRun(root);
     if (!last || !last.meta) { console.log('\n  no sentinel audit has run for this repo yet\n'); return 0; }
     if (argv.includes('--json')) { console.log(JSON.stringify({ dir: last.dir, meta: last.meta, findings: last.records }, null, 2)); return 0; }
     console.log(renderAuditLanding({ dir: last.dir, meta: last.meta, records: last.records }));
     return 0;
   }
+  if (argv[0] === 'upload') return auditUploadCommand(argv.slice(1), deps);
+  if (argv[0] === 'schedule') return auditScheduleCommand(argv.slice(1), deps);
   let opts;
   try { opts = parseAuditArgs(argv); } catch (e) { console.error(`security-review audit: ${e.message}`); return 2; }
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  // A timer run does only what the owner approved at install.
+  let capOverride = null;
+  if (opts.scheduled) {
+    const approval = cloud.readApproval(root, deps.homeDir);
+    if (!approval) { console.error('security-review audit: this folder has no approved schedule. nothing ran. run atris sentinel schedule again'); return 2; }
+    opts.hunter = null;
+    opts.verifier = null;
+    opts.engine = approval.engine;
+    if (approval.engine === 'atris') { opts.yes = true; capOverride = Number(approval.max_credits); }
+  }
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let engines;
+  try { engines = cloud.resolveEngines({ engine: opts.engine, hunter: opts.hunter, verifier: opts.verifier, token, env: deps.env || process.env }); } catch (e) { console.error(`security-review audit: ${e.message}`); return 2; }
+  const hunter = engines.hunter || undefined;
+  const verifier = engines.verifier || undefined;
+  const hosted = audit.isHostedEngine(hunter) || audit.isHostedEngine(verifier);
+  if (hosted && !token) { console.error('security-review audit: reviews on atris models need a login; run atris login first'); return 2; }
   const log = opts.json ? () => {} : (msg) => console.log(`  · ${msg}`);
+  const tell = opts.json ? (m) => console.error(m) : (m) => console.log(m);
+  if (hosted && engines.chosen === 'no_local_engine' && !opts.planOnly) tell('  no codex or claude found on this machine. this review runs on atris models');
+  let runJobs = deps.runJobs;
+  const spend = hosted ? cloud.spendGuard({ quoteCall: deps.quoteCall }) : null;
+  if (!runJobs && hosted) runJobs = cloud.atrisJobRunner({ token, spend });
+  const confirmSpend = async (estimate) => {
+    const quote = await cloud.quoteEstimate(estimate, { token });
+    spend.max = capOverride || quote.credits;
+    spend.limits = quote.limits;
+    tell(`\n  ${cloud.describeQuote(quote)}\n`);
+    if (capOverride) tell(`  this scheduled run may spend at most ${capOverride} credits, as approved`);
+    if (opts.yes) return true;
+    const input = deps.input || process.stdin;
+    if (!input.isTTY && !deps.input) { console.error('  nothing was spent. add --yes to run without this question'); return false; }
+    const yes = await (deps.ask || askYesNo)('  spend these credits? (y/N) ', { input, output: opts.json ? process.stderr : process.stdout });
+    if (!yes) tell('  nothing was spent');
+    return yes;
+  };
   let result;
   try {
     result = await audit.runAudit({
-      root: process.cwd(), profile: opts.profile, scope: opts.scope, budget: opts.budget ?? undefined, out: opts.out,
-      hunter: opts.hunter || undefined, verifier: opts.verifier || undefined, planOnly: opts.planOnly,
+      root, profile: opts.profile, scope: opts.scope, budget: opts.budget ?? undefined, out: opts.out,
+      hunter, verifier, planOnly: opts.planOnly, runJobs, confirmSpend,
       timeoutMs: opts.timeoutMs || undefined, log,
     });
   } catch (e) {
     console.error(`security-review audit: ${e.message}`);
     return 2;
   }
+  if (result.declined) return 1;
   const fail = audit.shouldFailAudit(result.records);
   if (opts.json) console.log(JSON.stringify({ ok: !fail, dir: result.dir, meta: result.meta, findings: result.records }, null, 2));
   else console.log(renderAuditLanding(result));
+  if (spend && spend.blocked) tell(`  stopped at the approved limit of ${spend.max} credits. ${spend.blocked} model call${spend.blocked === 1 ? '' : 's'} did not run and wait for the next run`);
+  if (opts.upload && token && !opts.planOnly) {
+    try { await uploadAfterRun(result.dir, { token, quiet: opts.json, cloud }); } catch (e) { tell(`  warning: could not save the summary to your atris account: ${e.message}. the review itself is done`); }
+  }
   return fail ? 1 : 0;
 }
 
@@ -510,6 +686,37 @@ function printAuditHelp() {
     atris security-review audit --out DIR       write the run here (outside the repo)
     atris security-review audit status          the last run's landing
 
+  on atris models (no other AI subscription needed, paid in atris credits):
+
+    atris sentinel --engine atris               atris:fast searches, atris:pro checks
+    atris sentinel --engine atris --yes         skip the price question
+    atris sentinel --engine local               only codex and claude on this machine
+
+  with no --engine, local engines run when codex or claude is installed.
+  atris models run only when neither is installed and you are logged in.
+  every run on atris models shows the most it can cost first and stops
+  before it could pass that. lines that look like secrets are hidden and
+  only tracked files inside the review are ever sent.
+
+  saving results to your atris account (on when you are logged in):
+
+    atris sentinel --no-upload                  keep this run on this machine only
+    atris sentinel upload [run-folder]          save a past run (default: the last one)
+
+  only the summary is saved: plain sentences, file:line locations and counts.
+  source code and code lines never leave in an upload.
+
+  reviews on a timer:
+
+    atris sentinel schedule --every day [path]  quick review once a day, saved to your account
+    atris sentinel schedule --every week [path] once a week
+    atris sentinel schedule --engine atris --max-credits 20
+                                                timed runs on atris models, at most 20 credits each
+    atris sentinel schedule --uninstall [path]  stop the timer
+
+  the engine is picked when the timer goes on. on atris models you see the
+  price and say yes then. a timed run never switches to atris models later.
+
   How it works: every source file x attack class with a reason to be read
   becomes an area in a coverage ledger. Read-only engine hunters each own a
   few areas. A coverage critic names gaps. Every candidate goes to a different
@@ -553,4 +760,4 @@ function printHelp() {
   return 0;
 }
 
-module.exports = { securityReviewCommand };
+module.exports = { securityReviewCommand, auditCommand };

package/lib/campaign-keep.js

@@ -35,6 +35,7 @@ function cronSchedule(seconds) {
   if (minutes === 1) return '* * * * *';
   if (minutes < 60) return `*/${minutes} * * * *`;
   const hours = Math.round(minutes / 60);
+  if (hours >= 168) return '0 0 * * 0';
   return hours >= 24 ? '0 0 * * *' : `0 */${hours} * * *`;
 }
 

package/lib/first-minute.js

@@ -188,17 +188,20 @@ function loadLocalTaskState(root = process.cwd(), { taskIds = [] } = {}) {
     const db = taskDb.open();
     const workspaceRoot = taskDb.workspaceRoot(root);
     const rows = taskDb.listTasks(db, { workspaceRoot, limit: 200 });
+    // The visible window must not become a new numbering universe. Task
+    // commands resolve these references against the complete workspace.
+    const refRows = taskDb.listTasks(db, { workspaceRoot });
     // Busy queues must not crowd the last outcomes out of the handoff.
     const recent = ['done', 'failed'].flatMap((status) => taskDb.listTasks(db, { workspaceRoot, status, limit: 3, orderBy: 'updated_at' }));
     const seen = new Set(rows.map((row) => row.id));
     rows.push(...recent.filter((row) => !seen.has(row.id)));
-    if (Array.isArray(rows) && rows.length) dbRows = taskDb.withTaskDisplayRefs(rows);
+    if (Array.isArray(rows) && rows.length) dbRows = taskDb.withTaskDisplayRefs(rows, refRows);
     databaseRead = true;
     lookup = (id) => {
       const row = taskDb.getTask(db, id);
       // A foreign id in a damaged projection is not this workspace's work.
       if (row && !taskDb.rowInWorkspace(row, workspaceRoot)) return false;
-      return row ? taskDb.withTaskDisplayRefs([row])[0] : null;
+      return row ? taskDb.withTaskDisplayRefs([row], refRows)[0] : null;
     };
     // A shortlist is an output budget, not authority to invent a bound job.
     for (const id of taskIds.slice(0, 8)) {

package/lib/security-audit.js

@@ -671,6 +671,128 @@ async function defaultRunJobs(jobs, { root, concurrency, timeoutMs }) {
   return runEngineAskJobs(pinned, { root, concurrency, timeoutMs });
 }
 
+// Atris-hosted engines (atris:fast, atris:pro) run on the Atris backend and
+// cannot open files, so their prompts carry the source they need. Secrets
+// are hidden at the one send point in lib/sentinel-cloud.js.
+const HOSTED_ENGINE = /^atris:[a-z0-9._-]+$/i;
+const HOSTED_SOURCE_BYTES = { hunter: 96 * 1024, verifier: 32 * 1024 };
+const HOSTED_CONTEXT_LINES = 40;
+// The output limit sent with each hosted turn (the turn API accepts at most 8192).
+const HOSTED_OUTPUT_TOKENS = { hunter: 8192, verifier: 4096 };
+// Largest message a hosted check (verifier, recheck, critic) may send. The
+// quote prices every check call at this size, so the quote is a ceiling.
+const HOSTED_CHECK_MAX_BYTES = 64 * 1024;
+const ENV_STYLE_FILE = /(?:^|\/)(?:\.env(?:\.[\w.-]+)?|\.envrc|.*\.(?:pem|key|p12|pfx|jks|keystore|crt|cer|der|asc|gpg|kdbx)|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|\.(?:npmrc|pypirc|netrc|pgpass|htpasswd)|credentials(?:\.[\w]+)?|secrets?(?:\.[\w]+)?|service[-_]?account[\w.-]*\.json)$/i;
+
+function isHostedEngine(engine) {
+  return HOSTED_ENGINE.test(String(engine || ''));
+}
+
+// A file a hosted engine may ever see: tracked by git, not ignored, inside
+// the requested scope, not a skipped folder, and not a key or .env-style file.
+function sensitiveFile(rel) {
+  if (ENV_STYLE_FILE.test(rel)) return true;
+  try { return require('./security-scan').sensitiveFileFindings([rel]).length > 0; } catch { return false; }
+}
+
+function hostedAllowedFiles(root, scope) {
+  let tracked = null;
+  try {
+    tracked = execFileSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 }).split('\0').filter(Boolean);
+  } catch { return new Set(); }
+  let ignored = new Set();
+  try {
+    const r = require('child_process').spawnSync('git', ['check-ignore', '--no-index', '-z', '--stdin'], { cwd: root, input: tracked.join('\0'), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    ignored = new Set(String(r.stdout || '').split('\0').filter(Boolean));
+  } catch {}
+  return new Set(tracked.filter((rel) => isRepoRel(rel) && !skippedPath(rel) && inScope(rel, scope) && !ignored.has(rel) && !sensitiveFile(rel)));
+}
+
+// Numbered source for a hosted engine. `ranges` maps a file to line windows;
+// a file with no window is shown whole. Stops at the byte cap. Only files in
+// `allowed` are ever read.
+function hostedSource(root, files, { maxBytes, ranges = new Map(), allowed = null } = {}) {
+  const out = [];
+  let used = 0;
+  const skipped = [];
+  for (const rel of [...new Set(files)].filter(isRepoRel).filter((f) => allowed && allowed.has(f))) {
+    const text = readText(root, rel);
+    if (text === null) continue;
+    const lines = text.split('\n');
+    const windows = ranges.get(rel);
+    const keep = new Set();
+    if (windows && windows.length) {
+      for (const n of windows) for (let i = Math.max(1, n - HOSTED_CONTEXT_LINES); i <= Math.min(lines.length, n + HOSTED_CONTEXT_LINES); i++) keep.add(i);
+    } else {
+      for (let i = 1; i <= lines.length; i++) keep.add(i);
+    }
+    const body = [];
+    let last = 0;
+    for (const n of [...keep].sort((a, b) => a - b)) {
+      if (last && n !== last + 1) body.push('   ...');
+      const line = lines[n - 1];
+      // Secrets are hidden at the one send point (lib/sentinel-cloud.js
+      // redactOutgoing), which sees whole key blocks.
+      body.push(`${String(n).padStart(5)}  ${line}`);
+      last = n;
+    }
+    const block = `### ${rel}\n\`\`\`\n${body.join('\n')}\n\`\`\``;
+    if (used + block.length > maxBytes) { skipped.push(rel); continue; }
+    used += block.length;
+    out.push(block);
+  }
+  if (!out.length && !skipped.length) return '';
+  return [
+    '## Source',
+    'You cannot open files in this session. The source you need is below with line numbers; cite files and lines from it.',
+    skipped.length ? `These files were too large to include: ${skipped.join(', ')}. Mark units that depend on them "blocked".` : '',
+    ...out,
+  ].filter(Boolean).join('\n\n');
+}
+
+function traceFiles(trace) {
+  const ranges = new Map();
+  for (const t of trace || []) {
+    if (!t || !isRepoRel(t.file)) continue;
+    if (!ranges.has(t.file)) ranges.set(t.file, []);
+    if (Number.isInteger(t.line)) ranges.get(t.file).push(t.line);
+  }
+  return ranges;
+}
+
+function withHostedSource(root, engine, prompt, { files = [], trace = null, kind = 'hunter', allowed = null } = {}) {
+  if (!isHostedEngine(engine)) return prompt;
+  if (kind === 'critic') return `${prompt}\n\nYou cannot open files in this session. Judge gaps from the architecture and ledger above.`;
+  const ranges = trace ? traceFiles(trace) : new Map();
+  const list = trace ? [...ranges.keys()] : files;
+  const src = hostedSource(root, list, { maxBytes: HOSTED_SOURCE_BYTES[kind] || HOSTED_SOURCE_BYTES.verifier, ranges, allowed });
+  return src ? `${prompt}\n\n${src}` : prompt;
+}
+
+// Units as a hosted hunter may see them: seeded lines only from allowed files.
+function hostedUnits(units, allowed) {
+  if (!allowed) return units;
+  return units.map((u) => ({ ...u, hot_lines: (u.hot_lines || []).filter((h) => allowed.has(h.file)) }));
+}
+
+// A trace as a hosted engine may see it: code lines only from allowed files.
+function hostedTrace(trace, allowed) {
+  if (!allowed) return trace;
+  return (trace || []).map((t) => {
+    if (!t || allowed.has(t.file)) return t;
+    const out = { ...t };
+    delete out.code;
+    return out;
+  });
+}
+
+// Titles and fix summaries are the only finding text that leaves the
+// machine (the account dashboard). Ask for plain words up front; the upload
+// filter replaces anything else.
+const PLAIN_TITLE_HINT = 'one plain sentence saying what goes wrong, with no code, identifiers, file contents or secrets';
+const PLAIN_FIX_HINT = 'one plain sentence describing the change in words, with no code, identifiers, file contents or secrets, for example "Pass the command and its arguments separately instead of building one shell string"';
+const PLAIN_TEXT_RULE = `Write "title" as ${PLAIN_TITLE_HINT}. Write remediation "summary" as ${PLAIN_FIX_HINT}. Keep code, names and lines in remediation "strategy", which stays in the local report.`;
+
 function bullet(lines) {
   return lines.map((l) => `- ${l}`).join('\n');
 }
@@ -692,13 +814,13 @@ function hunterPrompt({ architecture, units, exclusions, peerIds }) {
   const contract = {
     units: [{ coverage_id: 'one assigned id', disposition: 'covered|candidate|blocked', reviewed_paths: ['repo/relative/path'], checks: [{ invariant: 'the control you checked', method: 'source', result: 'what the source established', reviewed_paths: ['repo/relative/path'] }], candidate_fingerprints: [], unresolved: [] }],
     candidates: [{
-      proposed_verdict: 'confirmed|needs_validation', fingerprint: 'path:scope/root-cause-name', title: '', description: '', attack_class: classes[0].id,
+      proposed_verdict: 'confirmed|needs_validation', fingerprint: 'path:scope/root-cause-name', title: PLAIN_TITLE_HINT, description: '', attack_class: classes[0].id,
       coverage_ids: [], attacker: 'the lower-trust principal and what they start with', root_cause: '(confirmed) the source defect', claimed_root_cause: '(needs_validation) the suspected defect',
       intended_behavior: '', impact: 'the concrete result across the boundary',
       trace: [{ kind: 'entrypoint|propagation|sink', file: 'repo/relative/path', line: 1, description: '' }],
       conditions: [{ kind: CONDITION_KINDS.join('|'), description: '' }],
       severity: { likelihood: { score: SCORES.join('|'), reason: '' }, impact: { score: SCORES.join('|'), reason: '' }, overall: SCORES.join('|') },
-      remediation: { strategy: 'the smallest source change at the last trusted decision point', regression_test: 'the test that would fail today' },
+      remediation: { strategy: 'the smallest source change at the last trusted decision point', summary: PLAIN_FIX_HINT, regression_test: 'the test that would fail today' },
       blockers: ['(needs_validation) the exact missing fact'], validation_plan: [{ context: 'local|deployment', step: '' }],
     }],
     hardening: ['a concrete note that is not a finding'],
@@ -726,15 +848,16 @@ function hunterPrompt({ architecture, units, exclusions, peerIds }) {
     exclusions.length ? `## Already on record, do not report again\n${bullet(exclusions.slice(0, 20).map((e) => `${e.fingerprint}: ${e.title} (${e.why})`))}\n` : '',
     peerIds ? `Other hunters own ${peerIds} other units this wave. Stay inside your assigned paths; put anything else in "uncovered".\n` : '',
     '## Result contract',
+    PLAIN_TEXT_RULE,
     'Every assigned coverage_id appears exactly once in "units". "covered" means you read the paths and the invariant holds. "candidate" lists the fingerprints of the candidates you return. "blocked" means you read the code but one fact you cannot see decides it; say which in "unresolved". Every check lists the paths it read.',
     'Return only this JSON object, no prose before or after it:',
     JSON.stringify(contract, null, 2),
   ].join('\n');
 }
 
-function withCode(root, trace) {
+function withCode(root, trace, allowed = null) {
   return (trace || []).map((t) => {
-    const text = t && isRepoRel(t.file) ? readText(root, t.file) : null;
+    const text = t && isRepoRel(t.file) && (!allowed || allowed.has(t.file)) ? readText(root, t.file) : null;
     const line = text && Number.isInteger(t.line) ? text.split('\n')[t.line - 1] : undefined;
     return line === undefined ? t : { ...t, code: line.trim().slice(0, 200) };
   });
@@ -747,7 +870,7 @@ function verifierPrompt({ candidate, cls }) {
     verdict: 'confirmed|needs_validation|rejected',
     reason: 'what you read and why it holds or fails',
     preventing_layer: 'file:line of the control that stops it, or null',
-    corrected: { title: '', root_cause: '', attacker: '', impact: '', trace: [{ kind: 'entrypoint|propagation|sink', file: '', line: 1, description: '' }], conditions: [], severity: { likelihood: { score: '', reason: '' }, impact: { score: '', reason: '' }, overall: '' }, remediation: { strategy: '', regression_test: '' } },
+    corrected: { title: '', root_cause: '', attacker: '', impact: '', trace: [{ kind: 'entrypoint|propagation|sink', file: '', line: 1, description: '' }], conditions: [], severity: { likelihood: { score: '', reason: '' }, impact: { score: '', reason: '' }, overall: '' }, remediation: { strategy: '', summary: '', regression_test: '' } },
     blockers: ['(needs_validation) the exact missing fact'],
     validation_plan: [{ context: 'local|deployment', step: '' }],
   };
@@ -764,6 +887,7 @@ function verifierPrompt({ candidate, cls }) {
       'A library version or behavior is not outside source when the target has it installed. Read the lockfile, the venv or .venv site-packages, or node_modules before sending it to the owner.',
       '"rejected": the source disproves it. Name the line that does.',
       'Use "corrected" only for fields you would change. Read-only: do not run the target or touch the network.',
+      `If the title or remediation summary has code, names or file contents, rewrite it in "corrected". ${PLAIN_TEXT_RULE}`,
     ]),
     '',
     `## Attack class: ${cls.title}`,
@@ -791,6 +915,7 @@ function recheckPrompt({ record }) {
     bullet([
       'Open each cited file:line. Every sentence in the record must match what the code does now.',
       'Check the severity against the anchors. Overall can never exceed impact.',
+      `If the title or remediation summary has code, names or file contents, return it rewritten in "corrected". ${PLAIN_TEXT_RULE}`,
       'If the record is right, return {"ok": true}.',
       'If a detail is wrong but the problem is real, return {"ok": false, "verdict": "confirmed", "corrected": {...only the fields to change}}.',
       'If the problem is not real after all, return {"ok": false, "verdict": "rejected", "reason": "..."} or {"ok": false, "verdict": "needs_validation", "blockers": [...], "validation_plan": [{"context": "local|deployment", "step": "..."}]}.',
@@ -1007,7 +1132,7 @@ function buildRecord(root, cand, verdict, extra) {
     trace,
     conditions: (cand.conditions || []).filter((c) => c && CONDITION_KINDS.includes(c.kind) && nonEmptyString(c.description)).map((c) => ({ kind: c.kind, description: str(c.description, 400) })),
     severity: clampSeverity(cand.severity),
-    remediation: { strategy: str(cand.remediation && cand.remediation.strategy), regression_test: str(cand.remediation && cand.remediation.regression_test) },
+    remediation: { strategy: str(cand.remediation && cand.remediation.strategy), summary: str(cand.remediation && cand.remediation.summary, 400), regression_test: str(cand.remediation && cand.remediation.regression_test) },
     evidence_level: 'source-traced, not executed',
     verified_by: extra.by ? [extra.by] : [],
   };
@@ -1021,7 +1146,8 @@ function mergeCorrected(cand, corrected) {
   if (Array.isArray(corrected.conditions) && corrected.conditions.length) out.conditions = corrected.conditions;
   const s = corrected.severity;
   if (s && s.impact && SCORES.includes(s.impact.score) && SCORES.includes(s.overall) && s.likelihood && SCORES.includes(s.likelihood.score)) out.severity = s;
-  if (corrected.remediation && nonEmptyString(corrected.remediation.strategy)) out.remediation = corrected.remediation;
+  if (corrected.remediation && nonEmptyString(corrected.remediation.strategy)) out.remediation = { ...(cand.remediation || {}), ...corrected.remediation };
+  else if (corrected.remediation && nonEmptyString(corrected.remediation.summary)) out.remediation = { ...(cand.remediation || {}), summary: corrected.remediation.summary };
   return out;
 }
 
@@ -1209,6 +1335,23 @@ function pickBatches(ledger, profile, allowance) {
   return batches;
 }
 
+// The most a hosted run can send: every budgeted call, each at its largest
+// allowed message and its full output limit. Hunter messages are measured
+// from this run's real first-wave batches; the largest one becomes the hunter
+// limit for the whole run. One token per byte is a true ceiling: a token is
+// never shorter than a byte.
+function spendEstimate({ root, architecture, ledger, profile, plan, exclusions, hunter, verifier, allowed }) {
+  const batches = pickBatches(ledger, profile, plan.hunters);
+  const sizes = batches.map((units) => Buffer.byteLength(withHostedSource(root, hunter, hunterPrompt({ architecture, units: hostedUnits(units, allowed), exclusions, peerIds: plan.hunters }), { files: units.flatMap((u) => u.starting_paths), kind: 'hunter', allowed })));
+  const hunterMax = Math.max(4096, ...sizes);
+  const criticBytes = Buffer.byteLength(criticPrompt({ architecture, units: ledger, final: true })) + 1024;
+  const checkMax = Math.max(HOSTED_CHECK_MAX_BYTES, criticBytes);
+  const rows = [];
+  if (isHostedEngine(hunter)) rows.push({ role: 'hunter', model: hunter, calls: plan.hunters, input_tokens: hunterMax, output_tokens: HOSTED_OUTPUT_TOKENS.hunter, max_input_bytes: hunterMax });
+  if (isHostedEngine(verifier)) rows.push({ role: 'verifier', model: verifier, calls: plan.total - plan.hunters, input_tokens: checkMax, output_tokens: HOSTED_OUTPUT_TOKENS.verifier, max_input_bytes: checkMax });
+  return { profile, budget: plan.total, calls: rows };
+}
+
 async function runAudit(opts = {}) {
   const root = path.resolve(opts.root || process.cwd());
   const profile = PROFILES.includes(opts.profile) ? opts.profile : 'standard';
@@ -1253,8 +1396,15 @@ async function runAudit(opts = {}) {
     started_at: now().toISOString(),
     run_status: 'in_progress',
     invocations: { used: 0, hunters: 0, critics: 0, verifiers: 0, rechecks: 0 },
+    credits_used: 0,
     method: 'adapted from cloudflare/security-audit-skill (MIT)',
   };
+  // What a hosted engine may ever be shown (null for local engines, which
+  // read the checkout themselves).
+  const hostedAny = isHostedEngine(hunter) || isHostedEngine(verifier);
+  const allowed = hostedAny ? hostedAllowedFiles(root, scope) : null;
+  const hunterAllowed = isHostedEngine(hunter) ? allowed : null;
+  const verifierAllowed = isHostedEngine(verifier) ? allowed : null;
   const ledgerFile = path.join(dir, 'coverage-ledger.json');
   const saveLedger = () => {
     ledger.sort(cmpId);
@@ -1302,12 +1452,29 @@ async function runAudit(opts = {}) {
     return finish('incomplete', 'budget_cannot_fund_hunters_and_reserves', [], carried.map((r) => r.fingerprint));
   }
 
+  // Hosted engines spend credits: the caller sees an upper-bound estimate and
+  // says yes before the first call. A no leaves nothing behind.
+  if (opts.confirmSpend && hostedAny) {
+    const estimate = spendEstimate({ root, architecture, ledger, profile, plan, exclusions, hunter, verifier, allowed });
+    let ok = false;
+    try { ok = await opts.confirmSpend(estimate); } catch (e) { fs.rmSync(dir, { recursive: true, force: true }); throw e; }
+    if (!ok) {
+      fs.rmSync(dir, { recursive: true, force: true });
+      return { declined: true, dir: null, meta, ledger, records: [], estimate };
+    }
+  }
+
   const call = async (kind, jobs) => {
     if (!jobs.length) return [];
     meta.invocations.used += jobs.length;
     meta.invocations[kind] += jobs.length;
     writeJson(path.join(dir, 'run-metadata.json'), meta);
     const answers = await runJobs(jobs, { root, concurrency, timeoutMs });
+    for (const a of answers || []) {
+      const c = Number(a && a.credits_charged);
+      if (Number.isFinite(c) && c > 0) meta.credits_used += c;
+    }
+    writeJson(path.join(dir, 'run-metadata.json'), meta);
     return answers;
   };
 
@@ -1319,7 +1486,7 @@ async function runAudit(opts = {}) {
   const failures = [];
   const runCritic = async (wave, final) => {
     criticsLeft -= 1;
-    const [answer] = await call('critics', [{ engine: verifier, prompt: criticPrompt({ architecture, units: ledger, final }), label: `sentinel critic ${final ? 'final' : `w${wave}`}` }]);
+    const [answer] = await call('critics', [{ engine: verifier, prompt: withHostedSource(root, verifier, criticPrompt({ architecture, units: ledger, final }), { kind: 'critic' }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel critic ${final ? 'final' : `w${wave}`}` }]);
     const parsed = answer && answer.ok !== false ? extractJson(answer.stdout, (v) => Array.isArray(v.missing_units) || Array.isArray(v.reassign_ids)) : null;
     if (!parsed) return { accepted: 0, failed: true };
     const fresh = (parsed.missing_units || []).map((raw) => proposedUnit(root, raw, { profile, scope })).filter(Boolean);
@@ -1340,11 +1507,11 @@ async function runAudit(opts = {}) {
     const jobs = batches.map((units, i) => {
       const agentId = `h${wave}-${String(i + 1).padStart(2, '0')}`;
       for (const u of units) { u.status = 'in_progress'; u.agent_id = agentId; u.wave = wave; }
-      return { engine: hunter, prompt: hunterPrompt({ architecture, units, exclusions, peerIds: waveUnits - units.length }), label: `sentinel hunter ${agentId}`, _units: units, _agent: agentId };
+      return { engine: hunter, prompt: withHostedSource(root, hunter, hunterPrompt({ architecture, units: hostedUnits(units, hunterAllowed), exclusions, peerIds: waveUnits - units.length }), { files: units.flatMap((u) => u.starting_paths), kind: 'hunter', allowed: hunterAllowed }), max_output_tokens: isHostedEngine(hunter) ? HOSTED_OUTPUT_TOKENS.hunter : undefined, label: `sentinel hunter ${agentId}`, _units: units, _agent: agentId };
     });
     saveLedger();
     log(`wave ${wave}: ${jobs.length} hunter${jobs.length === 1 ? '' : 's'} on ${jobs.reduce((n, j) => n + j._units.length, 0)} areas (${hunter})`);
-    const answers = await call('hunters', jobs.map(({ engine, prompt, label }) => ({ engine, prompt, label })));
+    const answers = await call('hunters', jobs.map(({ engine, prompt, label, max_output_tokens: m }) => ({ engine, prompt, label, ...(m ? { max_output_tokens: m } : {}) })));
     const uncovered = [];
     answers.forEach((answer, i) => {
       const res = applyHunterResult(root, jobs[i]._units, answer, jobs[i]._agent, hunter);
@@ -1417,13 +1584,22 @@ async function runAudit(opts = {}) {
       records.push(buildRecord(root, cand, 'rejected', { reason: `cited source does not resolve: ${errs.slice(0, 3).join('; ')}`, by: { engine: 'atris', agent_id: 'citation-check' } }));
       continue;
     }
+    // A hosted verifier is only ever shown files this review may send. A
+    // trace outside them (a model citing .env, or a path outside the scope)
+    // never reaches it.
+    const outside = verifierAllowed ? [...new Set((cand.trace || []).map((t) => t && t.file).filter((f) => !verifierAllowed.has(f)))] : [];
+    if (outside.length) {
+      if (cand._carried) pending.push(cand.fingerprint);
+      else records.push(buildRecord(root, cand, 'rejected', { reason: `cites files this review may not send to atris models: ${outside.slice(0, 3).join(', ')}`, by: { engine: 'atris', agent_id: 'scope-check' } }));
+      continue;
+    }
     toVerify.push(cand);
   }
   const verifyBudget = Math.max(0, total - meta.invocations.used);
   const verifyNow = toVerify.slice(0, verifyBudget);
   const notVerified = toVerify.slice(verifyBudget);
   log(`verifying ${verifyNow.length} candidate${verifyNow.length === 1 ? '' : 's'} with ${verifier}`);
-  const vJobs = verifyNow.map((cand, i) => ({ engine: verifier, prompt: verifierPrompt({ candidate: { ...cand, trace: withCode(root, cand.trace), _carried: undefined, _unit_class: undefined, carried_from: undefined, verified_by: undefined }, cls: CLASS_BY_ID.get(cand.attack_class) }), label: `sentinel verifier v-${String(i + 1).padStart(2, '0')}` }));
+  const vJobs = verifyNow.map((cand, i) => ({ engine: verifier, prompt: withHostedSource(root, verifier, verifierPrompt({ candidate: { ...cand, trace: withCode(root, cand.trace, verifierAllowed), _carried: undefined, _unit_class: undefined, carried_from: undefined, verified_by: undefined }, cls: CLASS_BY_ID.get(cand.attack_class) }), { trace: cand.trace, kind: 'verifier', allowed: verifierAllowed }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel verifier v-${String(i + 1).padStart(2, '0')}` }));
   const vAnswers = await call('verifiers', vJobs);
   vAnswers.forEach((answer, i) => {
     const cand = verifyNow[i];
@@ -1440,7 +1616,7 @@ async function runAudit(opts = {}) {
     const confirmed = records.filter((r) => r.verdict === 'confirmed');
     const room = Math.max(0, total - meta.invocations.used);
     const checkNow = confirmed.slice(0, room);
-    const rJobs = checkNow.map((rec, i) => ({ engine: verifier, prompt: recheckPrompt({ record: rec }), label: `sentinel recheck r-${String(i + 1).padStart(2, '0')}` }));
+    const rJobs = checkNow.map((rec, i) => ({ engine: verifier, prompt: withHostedSource(root, verifier, recheckPrompt({ record: verifierAllowed ? { ...rec, trace: hostedTrace(rec.trace, verifierAllowed) } : rec }), { trace: rec.trace, kind: 'verifier', allowed: verifierAllowed }), max_output_tokens: isHostedEngine(verifier) ? HOSTED_OUTPUT_TOKENS.verifier : undefined, label: `sentinel recheck r-${String(i + 1).padStart(2, '0')}` }));
     const rAnswers = await call('rechecks', rJobs);
     rAnswers.forEach((answer, i) => {
       const rec = checkNow[i];
@@ -1544,6 +1720,9 @@ module.exports = {
   citationErrors,
   decide,
   runAudit,
+  isHostedEngine,
+  hostedAllowedFiles,
   latestRun,
+  repoName,
   shouldFailAudit,
 };

package/lib/sentinel-cloud.js

@@ -0,0 +1,558 @@
+'use strict';
+
+// Sentinel on Atris: hosted engines, credit quotes, run upload, and the
+// review timer. lib/security-audit.js does the audit; this file only talks
+// to the Atris backend and the local timer.
+//
+//   engines   atris:fast hunts, atris:pro verifies and critiques, through
+//             POST /api/atris2/turn. The backend's turn billing charges the
+//             credits; this file only reads what each turn's receipt reports.
+//   quote     GET /api/atris2/billing/quote prices one call per model, so the
+//             caller can show an estimate before any spend.
+//   upload    POST /api/sentinel/runs gets summary fields only (titles,
+//             locations, counts). Never source, traces, or code lines.
+//   schedule  the same launchd/cron timer `atris worktree sweep --install` uses.
+//
+// Zero external deps (Node built-ins only).
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+const https = require('https');
+
+const HUNTER_MODEL = 'atris:fast';
+const VERIFIER_MODEL = 'atris:pro';
+const LOCAL_ENGINES = ['codex', 'claude'];
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'informational'];
+const MAX_UPLOAD_BYTES = 1024 * 1024;
+const MAX_UPLOAD_FINDINGS = 500;
+const SCHEDULE_EVERY = { day: 86400, week: 7 * 86400 };
+
+// ---------------------------------------------------------------- identity
+
+function authToken({ env = process.env, loadCredentials } = {}) {
+  if (env.OBELISK_AUTH_TOKEN) return env.OBELISK_AUTH_TOKEN;
+  if (env.ATRIS_TOKEN) return env.ATRIS_TOKEN;
+  try {
+    const load = loadCredentials || require('../utils/auth').loadCredentials;
+    const creds = load();
+    return creds && creds.token ? String(creds.token) : '';
+  } catch {
+    return '';
+  }
+}
+
+function apiBase() {
+  return require('../utils/api').getApiBaseUrl();
+}
+
+// A local engine counts as available when its binary is on PATH.
+function localEngineAvailable(name, { env = process.env, platform = process.platform } = {}) {
+  const exts = platform === 'win32' ? (env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : [''];
+  for (const dir of String(env.PATH || '').split(path.delimiter).filter(Boolean)) {
+    for (const ext of exts) {
+      try { fs.accessSync(path.join(dir, `${name}${ext}`), fs.constants.X_OK); return true; } catch {}
+    }
+  }
+  return false;
+}
+
+// Which engines run the review. An explicit choice always wins; with none,
+// local engines stay the default and Atris models step in only when no local
+// engine is installed and the user is logged in.
+function resolveEngines({ engine = null, hunter = null, verifier = null, token = '', env = process.env } = {}) {
+  if (engine && engine !== 'atris' && engine !== 'local') throw new Error('--engine must be atris or local');
+  if (engine === 'atris' && (hunter || verifier)) throw new Error('pick --engine atris or --hunter and --verifier, not both');
+  if (engine === 'atris') {
+    if (!token) throw new Error('reviews on atris models need a login; run atris login first');
+    return { mode: 'atris', hunter: HUNTER_MODEL, verifier: VERIFIER_MODEL, chosen: 'flag' };
+  }
+  if (engine === 'local' || hunter || verifier) return { mode: 'local', hunter: hunter || null, verifier: verifier || null, chosen: 'flag' };
+  if (LOCAL_ENGINES.some((name) => localEngineAvailable(name, { env }))) return { mode: 'local', hunter: null, verifier: null, chosen: 'default' };
+  if (token) return { mode: 'atris', hunter: HUNTER_MODEL, verifier: VERIFIER_MODEL, chosen: 'no_local_engine' };
+  return { mode: 'local', hunter: null, verifier: null, chosen: 'default' };
+}
+
+function usesAtrisModels(meta) {
+  const e = (meta && meta.engines) || {};
+  return [e.hunter, e.verifier, e.critic].some((x) => /^atris:/i.test(String(x || '')));
+}
+
+// ---------------------------------------------------------------- http
+
+function request(method, url, { token, body = null, accept = 'application/json', timeoutMs = 30000, onData = null } = {}) {
+  return new Promise((resolve, reject) => {
+    let parsed;
+    try { parsed = new URL(url); } catch (e) { reject(new Error(`bad url: ${url}`)); return; }
+    const transport = parsed.protocol === 'https:' ? https : http;
+    const data = body === null ? null : Buffer.from(JSON.stringify(body));
+    const headers = { Accept: accept, 'User-Agent': 'atris-cli-sentinel' };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    if (data) { headers['Content-Type'] = 'application/json'; headers['Content-Length'] = data.length; }
+    const req = transport.request({
+      hostname: parsed.hostname,
+      port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
+      path: `${parsed.pathname}${parsed.search}`,
+      method,
+      headers,
+    }, (res) => {
+      res.setEncoding('utf8');
+      let text = '';
+      res.on('data', (chunk) => { text += chunk; if (onData && res.statusCode >= 200 && res.statusCode < 300) onData(chunk); });
+      res.on('end', () => {
+        let json = null;
+        try { json = text ? JSON.parse(text) : null; } catch {}
+        resolve({ status: res.statusCode, text, json });
+      });
+      res.on('error', reject);
+    });
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`timed out after ${Math.round(timeoutMs / 1000)}s`)));
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+function httpError(res) {
+  const detail = res.json && (res.json.detail || res.json.error);
+  const text = typeof detail === 'string' ? detail : (detail ? JSON.stringify(detail) : String(res.text || '').slice(0, 200));
+  return `the server said ${res.status}${text ? `: ${text}` : ''}`;
+}
+
+// ---------------------------------------------------------------- engines
+
+// The strict secret check: every scanner rule, matched raw. No allow
+// markers and no placeholder exemptions, so `example` next to a token does
+// not let it through.
+function strictSecretHit(text) {
+  let rules = [];
+  try { rules = require('./security-scan').SECRET_RULES || []; } catch {}
+  return String(text || '').split('\n').some((part) => rules.some((rule) => {
+    try { rule.re.lastIndex = 0; return rule.re.test(part); } catch { return true; }
+  }));
+}
+
+// Long encoded runs: 40+ base64 characters holding at least one digit, plus
+// or equals sign (plain words and slash paths have none), or 40+ hex digits.
+const LONG_BASE64 = /[A-Za-z0-9+/=_-]{40,}/g;
+const LONG_HEX = /[0-9a-fA-F]{40,}/;
+function hasEncodedRun(line) {
+  if (LONG_HEX.test(line)) return true;
+  for (const m of String(line).match(LONG_BASE64) || []) if (/[0-9+=]/.test(m)) return true;
+  return false;
+}
+
+const PRIVATE_KEY_BEGIN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY( BLOCK)?-----/;
+const PRIVATE_KEY_END = /-----END [A-Z0-9 ]*PRIVATE KEY( BLOCK)?-----/;
+
+// Every message bound for an Atris model passes through here, so no prompt
+// part (seeded lines, cited code, source blocks, candidate JSON) can skip
+// it. Whole private key blocks go, BEGIN through END (to the end of the
+// message when END never comes). Then any line with a secret rule match,
+// read as is or with JSON escapes undone, or with a long encoded run goes.
+const HIDDEN_LINE = '[line hidden: looks like a secret]';
+function redactOutgoing(message) {
+  let hidden = 0;
+  const lines = String(message || '').split('\n');
+  let inKey = false;
+  const out = lines.map((line) => {
+    const variants = [line, line.replace(/\\"/g, '"').replace(/\\'/g, "'"), line.replace(/\\n/g, '\n')];
+    if (!inKey && variants.some((v) => PRIVATE_KEY_BEGIN.test(v))) {
+      inKey = !variants.some((v) => PRIVATE_KEY_END.test(v));
+      hidden += 1;
+      return HIDDEN_LINE;
+    }
+    if (inKey) {
+      if (PRIVATE_KEY_END.test(line)) inKey = false;
+      hidden += 1;
+      return HIDDEN_LINE;
+    }
+    if (variants.some((v) => PRIVATE_KEY_END.test(v) || strictSecretHit(v) || hasEncodedRun(v))) {
+      hidden += 1;
+      return HIDDEN_LINE;
+    }
+    return line;
+  });
+  return { text: out.join('\n'), hidden };
+}
+
+// One turn on an Atris model. The reply streams as server-sent events: text
+// arrives as text_delta, the final answer as result, and the receipt carries
+// what the turn was charged.
+async function runAtrisTurn({ model, prompt, token, base = apiBase(), timeoutMs = 15 * 60 * 1000, maxOutputTokens = null }) {
+  let buffer = '';
+  let text = '';
+  let result = null;
+  let credits = 0;
+  let billed = false;
+  const errors = [];
+  const readBilling = (billing) => {
+    if (!billing || typeof billing !== 'object') return;
+    billed = true;
+    if (billing.billed === false) return;
+    const c = Number(billing.credits_charged);
+    if (Number.isFinite(c) && c > 0) credits += c;
+  };
+  const handle = (block) => {
+    const data = block.split(/\r?\n/).filter((l) => l.startsWith('data:')).map((l) => l.replace(/^data:\s?/, '')).join('\n').trim();
+    if (!data || data === '[DONE]') return;
+    let ev;
+    try { ev = JSON.parse(data); } catch { return; }
+    if (!ev || typeof ev !== 'object') return;
+    if ((ev.type === 'text_delta' || ev.type === 'text') && ev.content) text += ev.content;
+    if (ev.type === 'result' && ev.result) result = String(ev.result);
+    if (ev.type === 'error' || ev.error) errors.push(String(ev.error || ev.message || 'stream error'));
+    readBilling((ev.receipt && ev.receipt.billing) || ev.billing);
+  };
+  const onData = (chunk) => {
+    buffer += chunk;
+    let at = buffer.indexOf('\n\n');
+    while (at !== -1) { handle(buffer.slice(0, at)); buffer = buffer.slice(at + 2); at = buffer.indexOf('\n\n'); }
+  };
+  const { text: message } = redactOutgoing(prompt);
+  const body = { message, model, max_turns: 1, disable_connector_tools: true };
+  if (Number.isInteger(maxOutputTokens) && maxOutputTokens >= 16) body.max_output_tokens = Math.min(8192, maxOutputTokens);
+  let res;
+  try {
+    res = await request('POST', `${base}/atris2/turn`, { token, body, accept: 'text/event-stream', timeoutMs, onData });
+  } catch (e) {
+    return { ok: false, stdout: '', reason: e.message, credits_charged: 0, billed: false };
+  }
+  if (res.status < 200 || res.status >= 300) return { ok: false, stdout: '', reason: httpError(res), credits_charged: 0, billed: res.status === 402 ? false : billed };
+  if (buffer.trim()) handle(buffer);
+  // A plain JSON reply (no stream) still counts.
+  if (!text && !result && res.json && typeof res.json === 'object') {
+    result = String(res.json.result || res.json.output || res.json.text || '');
+    readBilling((res.json.receipt && res.json.receipt.billing) || res.json.billing);
+  }
+  const stdout = result || text;
+  if (!stdout && errors.length) return { ok: false, stdout: '', reason: errors.join('; '), credits_charged: credits, billed };
+  return { ok: Boolean(stdout), stdout, reason: stdout ? undefined : 'empty answer', credits_charged: credits, billed };
+}
+
+const CAP_REASON = 'stopped at the approved credit limit';
+
+// The spend guard every hosted call goes through. `max` is the approved
+// limit. Before a call starts, its own worst case (quoted at its exact size
+// and output limit) is held against the limit along with every call still
+// running; a call that could pass the limit never starts. After a call, the
+// receipt's charge is counted, or the worst case when no receipt came back.
+function spendGuard({ max = 0, quoteCall } = {}) {
+  return { max, spent: 0, held: 0, blocked: 0, calls: 0, limits: {}, quoteCall };
+}
+
+// A runJobs for runAudit: atris:* jobs go to the backend, anything else to
+// the local engine runner.
+function atrisJobRunner({ token, base = null, localRunJobs = null, spend = null } = {}) {
+  return async (jobs, { root, concurrency = 3, timeoutMs } = {}) => {
+    const answers = new Array(jobs.length);
+    const hosted = [];
+    const local = [];
+    jobs.forEach((job, i) => (/^atris:/i.test(String(job.engine || '')) ? hosted : local).push(i));
+    if (local.length) {
+      const run = localRunJobs || ((js, o) => {
+        const { runEngineAskJobs } = require('./engine-ask');
+        return runEngineAskJobs(js, o);
+      });
+      const got = await run(local.map((i) => jobs[i]), { root, concurrency, timeoutMs });
+      local.forEach((i, k) => { answers[i] = got[k]; });
+    }
+    const url = base || apiBase();
+    const one = async (job) => {
+      const model = job.engine;
+      const outTokens = Number.isInteger(job.max_output_tokens) ? job.max_output_tokens : 8192;
+      if (!spend) return runAtrisTurn({ model, prompt: job.prompt, token, base: url, timeoutMs, maxOutputTokens: outTokens });
+      const bytes = Buffer.byteLength(redactOutgoing(job.prompt).text);
+      const limit = spend.limits[model];
+      if (limit && bytes > limit) { spend.blocked += 1; return { ok: false, stdout: '', reason: `message is larger than the size this run was priced for (${bytes} of ${limit} bytes)`, credits_charged: 0 }; }
+      let worst;
+      try { worst = await (spend.quoteCall || ((m, i, o) => quoteCall(m, i, o, { token, base: url })))(model, bytes, outTokens); } catch (e) { spend.blocked += 1; return { ok: false, stdout: '', reason: `no price for this call: ${e.message}`, credits_charged: 0 }; }
+      if (spend.spent + spend.held + worst > spend.max) { spend.blocked += 1; return { ok: false, stdout: '', reason: CAP_REASON, credits_charged: 0 }; }
+      spend.held += worst;
+      spend.calls += 1;
+      let answer;
+      try { answer = await runAtrisTurn({ model, prompt: job.prompt, token, base: url, timeoutMs, maxOutputTokens: outTokens }); } finally { spend.held -= worst; }
+      spend.spent += answer.billed ? Number(answer.credits_charged) || 0 : worst;
+      return answer;
+    };
+    let next = 0;
+    const work = async () => {
+      while (next < hosted.length) {
+        const i = hosted[next++];
+        answers[i] = await one(jobs[i]);
+      }
+    };
+    await Promise.all(Array.from({ length: Math.max(1, Math.min(concurrency, hosted.length)) }, work));
+    return answers;
+  };
+}
+
+// ---------------------------------------------------------------- quote
+
+// The price of one call at these exact counts, capped by the backend's own
+// most-per-request when it reports one.
+async function quoteCall(model, inputTokens, outputTokens, { token, base = apiBase(), timeoutMs = 15000 } = {}) {
+  const qs = new URLSearchParams({ model, input_tokens: String(Math.ceil(inputTokens)), output_tokens: String(Math.ceil(outputTokens)) });
+  const res = await request('GET', `${base}/atris2/billing/quote?${qs}`, { token, timeoutMs });
+  if (res.status < 200 || res.status >= 300 || !res.json || !Number.isFinite(Number(res.json.credits))) {
+    throw new Error(`could not get a price for ${model}: ${httpError(res)}`);
+  }
+  return Number(res.json.credits);
+}
+
+// Prices every hosted row of a spend estimate: each call at its largest
+// allowed size and full output limit, times the calls. Throws when any quote
+// fails, so a run never spends without a price shown.
+async function quoteEstimate(estimate, { token, base = apiBase(), timeoutMs = 15000 } = {}) {
+  const rows = [];
+  for (const row of estimate.calls || []) {
+    const per = await quoteCall(row.model, row.input_tokens, row.output_tokens, { token, base, timeoutMs });
+    rows.push({ ...row, credits_per_call: per, credits: per * row.calls });
+  }
+  const credits = rows.reduce((n, r) => n + r.credits, 0);
+  const limits = {};
+  for (const r of rows) if (r.max_input_bytes) limits[r.model] = Math.max(limits[r.model] || 0, r.max_input_bytes);
+  return { rows, credits, limits };
+}
+
+function describeQuote(quote) {
+  const parts = quote.rows.map((r) => `${r.calls} ${r.role === 'hunter' ? 'search' : 'check'} call${r.calls === 1 ? '' : 's'} on ${r.model} at most ${r.credits_per_call} credit${r.credits_per_call === 1 ? '' : 's'} each`);
+  return [
+    `this review runs on atris models and costs at most ${quote.credits} credits`,
+    `  ${parts.join('; ')}`,
+    '  the run stops before it could pass that. most runs spend far less',
+    '  your code is sent to atris models to be read. lines that look like secrets are hidden first',
+  ].join('\n');
+}
+
+// ---------------------------------------------------------------- upload
+
+function readJsonFile(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+// The upload guarantee: POST /api/sentinel/runs carries only plain
+// sentences, file:line locations and counts. Never source, traces, code
+// lines or identifiers. Every sentence passes the allowlist below or is
+// replaced whole with FALLBACK_SENTENCE; nothing is cleaned up and kept.
+//
+// Accepted limit: a model could still describe a secret in ordinary words
+// ("the password is the word swordfish followed by seven"). No filter can
+// tell that from a normal sentence, so the prompts ask for sentences with
+// no code, identifiers, file contents or secrets, and this is where the
+// guarantee stops.
+const FALLBACK_SENTENCE = 'See the full report on your machine.';
+const PROSE_CHARS = /^[A-Za-z0-9 .,'():-]+$/;
+
+function plain(value, max = 500) {
+  const s = String(value == null ? '' : value).replace(/\s+/g, ' ').trim();
+  if (!s) return '';
+  if (s.length > max) return FALLBACK_SENTENCE;
+  if (!PROSE_CHARS.test(s)) return FALLBACK_SENTENCE;
+  if (/[A-Za-z0-9]\(/.test(s)) return FALLBACK_SENTENCE; // a call shape: word(
+  if (s.replace(/[A-Za-z]'(?=[A-Za-z])/g, '').includes("'")) return FALLBACK_SENTENCE; // quotes, not apostrophes
+  if (/\([^)]*[,'][^)]*\)/.test(s)) return FALLBACK_SENTENCE; // argument lists
+  if (/[A-Za-z0-9]\.[A-Za-z0-9]/.test(s)) return FALLBACK_SENTENCE; // a.b: paths, members, versions
+  if (/[a-z][A-Z]/.test(s)) return FALLBACK_SENTENCE; // camelCase
+  if (/[A-Za-z0-9]{20,}/.test(s)) return FALLBACK_SENTENCE; // tokens and long ids
+  if (strictSecretHit(s)) return FALLBACK_SENTENCE;
+  return s;
+}
+
+// file:line from a trace step, kept as is when it is a plain repo path.
+function location(sink) {
+  if (!sink || typeof sink.file !== 'string') return '';
+  const file = sink.file.trim();
+  if (!/^[\w./@+-]+$/.test(file) || file.split('/').includes('..') || file.length > 280) return '';
+  return `${file}${Number.isInteger(sink.line) && sink.line > 0 ? `:${sink.line}` : ''}`;
+}
+
+function hardeningFromReport(text) {
+  const lines = String(text || '').split('\n');
+  const start = lines.findIndex((l) => /^##\s+Hardening notes/i.test(l));
+  if (start === -1) return [];
+  const out = [];
+  for (const l of lines.slice(start + 1)) {
+    if (/^##\s/.test(l)) break;
+    const m = l.match(/^\s*-\s+(.*)$/);
+    const note = m ? plain(m[1], 400) : '';
+    if (note) out.push(note);
+  }
+  return [...new Set(out)].slice(0, 50);
+}
+
+function needsFromMarkdown(text) {
+  const out = [];
+  let cur = null;
+  let inBlocked = false;
+  for (const l of String(text || '').split('\n')) {
+    const h = l.match(/^##\s+(.*)$/);
+    if (h) { cur = { title: plain(h[1], 300), blocked_on: '' }; out.push(cur); inBlocked = false; continue; }
+    if (!cur) continue;
+    if (/^Blocked on:/i.test(l)) { inBlocked = true; continue; }
+    if (/^\S.*:$/.test(l)) { inBlocked = false; continue; }
+    const m = l.match(/^-\s+(.*)$/);
+    if (inBlocked && m && !cur.blocked_on) cur.blocked_on = plain(m[1], 400);
+  }
+  return out;
+}
+
+function count(v) {
+  const n = Number(v);
+  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : 0;
+}
+
+// The contract body (POST /api/sentinel/runs), built from a run folder.
+function buildUploadBody(dir) {
+  const meta = readJsonFile(path.join(dir, 'run-metadata.json'));
+  if (!meta) throw new Error(`no run-metadata.json in ${dir}`);
+  const records = readJsonFile(path.join(dir, 'findings.json')) || [];
+  let report = '';
+  try { report = fs.readFileSync(path.join(dir, 'REPORT.md'), 'utf8'); } catch {}
+  let nvText = '';
+  try { nvText = fs.readFileSync(path.join(dir, 'NEEDS-VALIDATION.md'), 'utf8'); } catch {}
+
+  const cov = meta.coverage || {};
+  const counts = meta.counts || {};
+  const sev = counts.severity || {};
+  const rank = Object.fromEntries(SEVERITIES.map((s, i) => [s, i]));
+  const confirmed = records.filter((r) => r && r.verdict === 'confirmed')
+    .sort((a, b) => (rank[(a.severity || {}).overall] ?? 9) - (rank[(b.severity || {}).overall] ?? 9));
+  const findings = confirmed.slice(0, MAX_UPLOAD_FINDINGS).map((r, i) => {
+    const trace = Array.isArray(r.trace) ? r.trace : [];
+    const sink = trace[trace.length - 1] || {};
+    const severity = SEVERITIES.includes((r.severity || {}).overall) ? r.severity.overall : 'informational';
+    return {
+      id: `f-${require('crypto').createHash('sha256').update(String(r.fingerprint || `f${i + 1}`)).digest('hex').slice(0, 12)}`,
+      severity,
+      title: plain(r.title, 300),
+      location: location(sink),
+      // Only the plain summary leaves; the code-level strategy stays local.
+      fix: plain((r.remediation || {}).summary, 600) || FALLBACK_SENTENCE,
+      status: 'open',
+    };
+  });
+  let needs = records.filter((r) => r && r.verdict === 'needs_validation').map((r) => ({
+    title: plain(r.title, 300),
+    blocked_on: plain(Array.isArray(r.blockers) && r.blockers[0] ? r.blockers[0] : '', 400),
+  }));
+  if (!needs.length && nvText) needs = needsFromMarkdown(nvText);
+  const engines = meta.engines || {};
+  const body = {
+    repo: String(meta.repo || path.basename(path.dirname(dir))),
+    run_id: String(meta.run_id || path.basename(dir)),
+    started_at: meta.started_at || null,
+    finished_at: meta.finished_at || null,
+    profile: String(meta.profile || 'standard'),
+    source: usesAtrisModels({ engines }) ? 'atris-models' : 'cli-local',
+    coverage: { in_scope: count(cov.in_scope), done: count(cov.done), deferred: count(cov.deferred), blocked: count(cov.blocked) },
+    counts: {
+      confirmed: count(counts.confirmed),
+      needs_validation: count(counts.needs_validation),
+      rejected: count(counts.rejected),
+      severity: Object.fromEntries(SEVERITIES.map((s) => [s, count(sev[s])])),
+    },
+    findings,
+    needs_validation: needs.slice(0, MAX_UPLOAD_FINDINGS),
+    hardening: hardeningFromReport(report),
+    credits_used: Number(meta.credits_used) > 0 ? Number(meta.credits_used) : 0,
+  };
+  while (Buffer.byteLength(JSON.stringify(body)) > MAX_UPLOAD_BYTES && (body.findings.length || body.needs_validation.length || body.hardening.length)) {
+    if (body.hardening.length) body.hardening.pop();
+    else if (body.needs_validation.length) body.needs_validation.pop();
+    else body.findings.pop();
+  }
+  return body;
+}
+
+async function uploadRun(dir, { token, base = apiBase(), timeoutMs = 20000 } = {}) {
+  if (!token) return { ok: false, reason: 'not logged in' };
+  let body;
+  try { body = buildUploadBody(dir); } catch (e) { return { ok: false, reason: e.message }; }
+  try {
+    const res = await request('POST', `${base}/sentinel/runs`, { token, body, timeoutMs });
+    if (res.status < 200 || res.status >= 300) return { ok: false, reason: httpError(res), body };
+    return { ok: true, id: res.json && res.json.id ? String(res.json.id) : null, body };
+  } catch (e) {
+    return { ok: false, reason: e.message, body };
+  }
+}
+
+// ---------------------------------------------------------------- schedule
+
+function schedulePlan({ target, every, homeDir = os.homedir(), platform = process.platform, atrisBin, envPath = process.env.PATH || '' }) {
+  if (!SCHEDULE_EVERY[every]) throw new Error('--every must be day or week');
+  const { planKeep } = require('./campaign-keep');
+  return planKeep({
+    root: target,
+    home: path.join(homeDir, '.atris', 'sentinel'),
+    platform,
+    homeDir,
+    atrisBin,
+    envPath,
+    job: {
+      name: 'sentinel-review',
+      args: ['sentinel', '--quick', '--scheduled'],
+      every_seconds: SCHEDULE_EVERY[every],
+      marker: 'ATRIS_SENTINEL_REVIEW',
+    },
+  });
+}
+
+// What the owner approved when the timer went on: which engines, and for
+// atris models the most credits one run may spend. A scheduled run reads
+// this and nothing else; with no record it does not run at all.
+function scheduleKey(target) {
+  let real = path.resolve(target);
+  try { real = fs.realpathSync(real); } catch {}
+  return require('crypto').createHash('sha256').update(real).digest('hex').slice(0, 16);
+}
+
+function approvalPath(target, homeDir = os.homedir()) {
+  return path.join(homeDir, '.atris', 'sentinel', 'schedules', `${scheduleKey(target)}.json`);
+}
+
+function writeApproval(target, approval, homeDir) {
+  const file = approvalPath(target, homeDir);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify({ target: path.resolve(target), ...approval }, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(tmp, file);
+  return file;
+}
+
+function readApproval(target, homeDir) {
+  const a = readJsonFile(approvalPath(target, homeDir));
+  if (!a || (a.engine !== 'atris' && a.engine !== 'local')) return null;
+  if (a.engine === 'atris' && !(Number(a.max_credits) > 0)) return null;
+  return a;
+}
+
+function removeApproval(target, homeDir) {
+  const file = approvalPath(target, homeDir);
+  const had = fs.existsSync(file);
+  if (had) fs.unlinkSync(file);
+  return had;
+}
+
+module.exports = {
+  FALLBACK_SENTENCE,
+  writeApproval,
+  readApproval,
+  removeApproval,
+  CAP_REASON,
+  redactOutgoing,
+  spendGuard,
+  quoteCall,
+  SCHEDULE_EVERY,
+  authToken,
+  apiBase,
+  resolveEngines,
+  atrisJobRunner,
+  quoteEstimate,
+  describeQuote,
+  buildUploadBody,
+  uploadRun,
+  schedulePlan,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.82.2",
+  "version": "3.82.3",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof. project memory your coding agents share across sessions.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",