@arjunkhera/atlas 0.3.45 → 0.3.48

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.3.45",
+  "version": "0.3.48",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/cli.mjs

@@ -44,7 +44,7 @@ const ATLAS_VERSION = packagePackageVersion(PACKAGE_ROOT);
 
 const HELP = `atlas — the door into a repo's Atlas files
 
-  atlas tooling write --root <repo>    write both Atlas files into a repo
+  atlas tooling write --root <repo>    write the Atlas files into a repo
   atlas tooling pr --root <repo>       the same, as one pull request
       --replace-unknown                also replace a copy that is in no release
       --workflow                       rewrite only the workflow, for a repo whose check is current
@@ -140,8 +140,10 @@ const HELP = `atlas — the door into a repo's Atlas files
                                        compare the judge's verdict with the sealed tasks and the runs; exit 0 only when all pass
 
   atlas install                        install Atlas for every folder on this Mac
+      --cloud                          in a cloud setup script: skip the checks that need a started session
   atlas upgrade [--version <v>]        check, show and install a newer release
   atlas doctor                         is Atlas installed and working here
+      --cloud                          before the first cloud session: skip the checks that need a started session
 
 Atlas ${ATLAS_VERSION}. Check version ${CHECK_VERSION}; it reads spec ${Object.keys(SPECS).join(', ')}.
 A person merges every file the tooling writer writes.
@@ -169,9 +171,9 @@ export const FLAGS = Object.freeze({
   upkeep: { root: 'optional', event: 'value', json: 'switch' },
   gate: { repo: 'value', root: 'optional', 'dry-run': 'switch', off: 'switch', on: 'switch' },
   judge: { tasks: 'value', verdict: 'value', seal: 'value', runs: 'value', out: 'value', repo: 'value', budget: 'value', model: 'value' },
-  install: { local: 'switch', from: 'value', 'skip-global': 'switch', yes: 'switch' },
+  install: { local: 'switch', from: 'value', 'skip-global': 'switch', yes: 'switch', cloud: 'switch' },
   upgrade: { version: 'optional', yes: 'switch' },
-  doctor: {},
+  doctor: { cloud: 'switch' },
 });
 
 // Every command takes --help.
@@ -230,7 +232,7 @@ function toolingCommand(chosen) {
     for (const row of result.rows) line(`  ${row.state.padEnd(10)} ${row.path}  sha256 ${row.sha256.slice(0, 12)}…`);
     line('');
     line(result.changed
-      ? 'Both files come from the package. No hand step, and no edit by hand afterwards.'
+      ? 'The files come from the package. No hand step, and no edit by hand afterwards.'
       : 'Nothing changed. Both files already match the package.');
     return 0;
   } catch (error) {

package/door/lib/install.mjs

@@ -140,9 +140,12 @@ export async function install({ packageRoot, options = {}, line = console.log, e
   const installArgs = ['plugin', 'install', PLUGIN_ID, '--scope', 'user'];
   exec('claude', installArgs);
   line('');
-  for (const text of connectionSteps(env)) line(text);
+  // A cloud setup script runs before any session: the key comes from the
+  // environment variable, and no tools server has started yet (item 92cfbba3).
+  if (options.cloud) line('Installed. In a cloud session the key comes from the environment, and the lead checks the version at its first reply.');
+  else for (const text of connectionSteps(env)) line(text);
   line('');
-  return doctor({ packageRoot, options, line, env, exec });
+  return doctor({ packageRoot, options: { cloud: Boolean(options.cloud) }, line, env, exec });
 }
 
 // ---------------------------------------------------------------- upgrade
@@ -151,13 +154,15 @@ export async function install({ packageRoot, options = {}, line = console.log, e
 export const blobSha = (bytes) => createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
 export const sha512Integrity = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
 
-function filesUnder(root) {
+function filesUnder(root, skip = () => false) {
   const out = new Map();
   const walk = (dir) => {
     for (const entry of readdirSync(dir)) {
       const full = join(dir, entry);
+      const path = relative(root, full).split('\\').join('/');
+      if (skip(path)) continue;
       if (statSync(full).isDirectory()) walk(full);
-      else out.set(relative(root, full).split('\\').join('/'), readFileSync(full));
+      else out.set(path, readFileSync(full));
     }
   };
   walk(root);
@@ -201,6 +206,36 @@ export function matchTree({ tree, files }) {
   return problems;
 }
 
+// Claude Code writes `.in_use/` into a plugin copy to mark it in use. It is
+// not part of the package, so the proof of a loaded copy skips it.
+const COPY_MARKER = /^\.in_use(\/|$)/;
+const firstLines = (error, count = 3) => String(error?.stderr || error?.message || error).trim().split('\n').slice(0, count).join(' ');
+
+// Is the copy at packageRoot the copy that a master release run built? The
+// same proof as the upgrade, run on files already loaded. It reads only.
+// The proof runs from the copy it checks, so it catches stale, broken or
+// drifted files, not a package made to lie (security review of atlas#187).
+// "unproven" is the upgrade's refusal: no master run built this version.
+// "not checked" is never a pass: the caller says the reason.
+export function proveCopy({ packageRoot, exec = defaultExec }) {
+  try {
+    const { version } = packageJson(packageRoot);
+    const repo = repoOf(packageRoot);
+    const gh = (args) => JSON.parse(exec('gh', args));
+    let run;
+    try { run = findReleaseRun({ gh, repo, version }); } catch (error) { return { state: 'not checked', reason: `GitHub did not answer: ${firstLines(error)}` }; }
+    if (!run) return { state: 'unproven', reason: `no successful release run on a commit of master built ${version}. It may have been published from a branch.` };
+    let tree;
+    try { tree = gh(['api', '--method', 'GET', `repos/${repo}/git/trees/${run.head_sha}?recursive=1`]).tree; } catch (error) { return { state: 'not checked', reason: `GitHub did not give the file tree: ${firstLines(error)}` }; }
+    const files = filesUnder(packageRoot, (path) => COPY_MARKER.test(path));
+    const problems = matchTree({ tree, files });
+    const found = { run: run.id, commit: run.head_sha };
+    return problems.length ? { state: 'differs', ...found, problems: problems.slice(0, 20) } : { state: 'match', ...found, files: files.size };
+  } catch (error) {
+    return { state: 'not checked', reason: `the proof stopped: ${firstLines(error)}` };
+  }
+}
+
 export async function upgrade({ packageRoot, options = {}, line = console.log, env = process.env, exec = defaultExec, ask = defaultAsk }) {
   const { name, version: installed } = packageJson(packageRoot);
   const repo = repoOf(packageRoot);
@@ -276,11 +311,18 @@ export function doctor({ packageRoot, options = {}, line = console.log, env = pr
   }
 
   // Off the cloud, the key lives only in the connection file. The cloud passes it as a variable.
-  if (env.CLAUDE_CODE_REMOTE !== 'true') {
+  if (env.CLAUDE_CODE_REMOTE !== 'true' && !options.cloud) {
     const connection = readConnection({ HOME: env.HOME });
     check('connection', connection.state === 'ok', connection.state === 'ok' ? `the Engram connection file is in place; the key expires ${connection.expires}` : connection.message);
   }
 
+  // A cloud setup runs before the first session, so the three checks of a
+  // started tools server cannot pass yet. The lead checks at its first reply.
+  if (options.cloud) {
+    for (const row of rows) line(`${row.pass ? 'PASS' : 'FAIL'}  ${row.name.padEnd(12)} ${row.detail}`);
+    line('SKIP  tools server, engram and gh: no session has started yet');
+    return rows.every((row) => row.pass) ? 0 : 1;
+  }
   let health = null;
   try { health = JSON.parse(readFileSync(join(env.HOME, '.atlas', 'health.json'), 'utf8')); } catch { /* never started */ }
   check('tools server', Boolean(health), health ? `last started ${health.started_at}, Atlas ${health.package_version}` : 'the Atlas tools server has not started yet. Open a Claude Code session, then run "atlas doctor" again.');