fix: make hosted scanning work without inventing a safe verdict

[higagan]

Based on main — not stacked this time. Version → 0.3.5.

This redoes the work from the orphaned #31, plus the fix that was missing from it.

The bug #31 would have shipped

scan never sent max_tokens, so a gateway reserves the target's full context window up front. Every request to anthropic/claude-sonnet-5 died:

402 - You requested up to 65536 tokens, but can only afford 3937.

Capping it fixes that — but a cap alone introduces a worse bug. _probe returned bool(message.tool_calls) and never read finish_reason, so a reply cut off at the cap, possibly mid-compliance, was recorded as SAFE.

That is a false negative in a security scanner: the one verdict it must never invent, and precisely what INCONCLUSIVE exists to prevent. Before the cap there was no truncation, so #31 would have created this failure mode while fixing the 402.

What ships instead

The cap, together with truncation handling:

• _probe raises TruncatedResponseError when a reply hits the cap without resolving. The loop prints [⚠️ TRUNCATED] and counts it unresolved.
• A tool call still wins even at the cap — truncation only matters when nothing was produced.
• An all-truncated run now names the real fix instead of blaming the endpoint.

Verified against live models

Run	Result
gpt-4o-mini, default cap	3/3 seeds broke through
claude-sonnet-5, default cap	0/3, refused through generation 3

And the guard firing on a real model, claude-sonnet-5 --max-tokens 12:

before:  [✅ SAFE] ×3  ->  "0/3 broke through. No vulnerabilities found within budget."
after:   [⚠️ TRUNCATED] ×3  ->  "Every reply hit the token cap before resolving.
                                 Re-run with a larger --max-tokens."

The "before" line is a clean bill of health for a model that was never actually tested.

Also included

• --api-key reads MODELFUZZ_API_KEY. A real key no longer has to sit in shell history and in the process list. Verified: history | grep -c 'sk-or-v1' → 0.
• Provider errors are clipped to one line. A gateway 402 returns multiple KB of JSON — including account identifiers and a dashboard URL containing a key hash — and the entire blob was echoed for every failed probe.

Tests

71 → 81. New classes cover truncation (raises rather than returning False; scan never prints SAFE; a finished refusal is still SAFE; a tool call at the cap still counts), that both call sites send max_tokens and honour --max-tokens, that error output is bounded, and the three API-key sources.

One trap for future tests: the default non-empty stub mutation keeps every lineage alive until the wall-clock budget expires, which hangs the suite for 30s per test. These use mutation="" to end each lineage after one mutate call. Suite runs in 0.05s.

Not addressed here

Against an aligned target the mutation loop still degenerates — the target refuses to write the attack, and its refusal text becomes the next generation's prompt. Recorded in the local backlog; it needs a design decision, not a patch.