atris 3.12.1 → 3.13.0

package/README.md

@@ -27,7 +27,7 @@ Then read the workspace's `atris/atris.md` and follow it exactly. `atris.md` is
 
 | File | Purpose |
 |------|---------|
-| `atris/atris.md` | God file. Protocol and source of truth |
+| `atris/atris.md` | Main instructions for agents working in this repo |
 | `atris/MAP.md` | Navigation index with file:line refs |
 | `atris/TODO.md` | Shared task queue |
 | `atris/logs/YYYY/YYYY-MM-DD.md` | Daily log, inbox, notes, completions |
@@ -67,7 +67,7 @@ atris
 
 `atris init` scaffolds the workspace, including `atris/wiki/`. `atris` loads context and hands the workflow off to `atris/atris.md`.
 
-If you're still shaping the idea, use `atris brainstorm`. If you want Atris to keep cycling, use `atris run` or `atris autopilot`. If you want the repo brain kept honest, use `atris loop`. `atris activate` now surfaces wiki state from `atris/wiki/STATUS.md` when it exists.
+If you're still shaping the idea, use `atris brainstorm`. If you want Atris to keep cycling, use `atris run` or `atris autopilot`. If you want project memory checked for stale pages and missing context, use `atris loop`. `atris activate` surfaces wiki state from `atris/wiki/STATUS.md` when it exists.
 
 Core loop: `plan` -> `do` -> `review`
 
@@ -84,9 +84,9 @@ atris business onboard --website https://blondish.world --contact "Joel Zimmerma
 atris align --fix
 ```
 
-That creates the cloud business, writes `.atris/business.json`, initializes `.atris/state/` for events, episodes, and scorecards, and scaffolds the local `atris/` workspace under `~/arena/atris-business/<slug>/` with starter team lanes, a default recap artifact, and a first-loop starter queue in `atris/TODO.md`.
+That creates the cloud business, writes `.atris/business.json`, initializes `.atris/state/` for events and run history, and scaffolds the local `atris/` workspace under `~/arena/atris-business/<slug>/` with starter roles, a default recap template, and an initial task queue in `atris/TODO.md`.
 
-If you do not have a neat source pack yet, `atris business onboard` is the low-friction intake step: give it a website, a named human, a few notes, or even just run it in a folder with loose files, and it seeds raw intake, a starter brief, a first loop, a safe next action, and an operator one-pager for you.
+If you do not have a neat source pack yet, `atris business onboard` is the easiest intake step: give it a website, a named human, a few notes, or run it in a folder with loose files. Atris turns that into raw intake, a starter brief, a first workflow, a safe next action, and a short operator brief.
 
 You can also use bare input:
 
@@ -120,26 +120,27 @@ atris business record atris/reports/2026-04-12-operator-recap.md --outcome mixed
 | `atris ingest` | Stage raw evidence into `atris/context/` and compile into `atris/wiki/` |
 | `atris loop` | Refresh wiki health, stale/orphan signals, and next ingest candidates |
 | `atris wiki` | Full wiki namespace: ingest, query, lint, search, log, and loop |
-| `atris experiments` | Run Karpathy-style keep/revert packs |
+| `atris receipt` | Save evidence from an agent run |
+| `atris experiments` | Run small experiments and compare results |
 
 ## Built-In Systems
 
 - `atris learn` stores structured project memory in `atris/learnings.jsonl`
 - `atris wiki` keeps repo memory in `atris/wiki/` by default, with `--cloud` when you want the remote workspace path
 - `atris ingest` now stages local source packs under `atris/context/_ingest/`, writes a manifest receipt, and refreshes `atris/wiki/STATUS.md` plus `log.md`
-- `atris wiki --private` uses `.atris/presidio/` for local-only sensitive notes and operating memory
+- `atris wiki --private` stores local-only sensitive notes under `.atris/presidio/`
 - `atris loop` refreshes `atris/wiki/STATUS.md` and `atris/wiki/log.md`, flags stale/orphan pages, and suggests the next ingest
 - `atris activate` loads the current wiki status so the next session starts with project memory, not just tasks
-- `atris experiments` runs Karpathy-style keep/revert loops in `atris/experiments/`
+- `atris experiments` runs small test packs in `atris/experiments/`
 - `atris pull` and `atris push` sync cloud workspaces and journals
 
 ## Verifiable Feedback Loop
 
 Under the hood, Atris can keep score on real repo work.
 
-- Endgame tasks can carry a `Verify:` command, so work can end on a deterministic check instead of pure prose.
-- `atris autopilot` can run that check after review, record a reward in the journal, and append a local scorecard when a horizon closes.
-- Future horizon picks can weight against recent scorecards, so the loop learns from repo-local history without claiming model retraining.
+- Tasks can carry a `Verify:` command, so work can end on a deterministic check instead of pure prose.
+- `atris autopilot` can run that check after review and record the result in the journal.
+- Future task picks can use recent results, so Atris learns from repo-local history without claiming model retraining.
 
 ## Benchmark Harness
 
@@ -167,7 +168,7 @@ What to inspect:
 - receipts land in `atris/experiments/endstate-baseline/artifacts/` and
   `atris/experiments/endstate-stack/artifacts/`
 - scores append to each pack's `results.tsv`
-- `atris experiments compare endstate` prints the latest side-by-side scorecard
+- `atris experiments compare endstate` prints the latest side-by-side comparison
 - `atris experiments replay endstate` runs the full public dry-run rehearsal
 - the benchmark contract lives at `atris/features/endstate/contract.md`
 - the verification log lives at `atris/features/endstate/validate.md`
@@ -198,7 +199,7 @@ For Codex, copy any skill folder into `~/.codex/skills/`.
 ## v3.2.0
 
 - **Staleness gate** — tasks tagged `[unverified]` are skipped at the moment of use, not pruned eagerly. Three-state model: actionable / unverified / deleted.
-- **Lesson gate** — `isLessonResolved` checks whether a lesson already shipped before proposing new horizons from it. Prevents the loop from re-solving solved problems.
+- **Lesson gate** — `isLessonResolved` checks whether a lesson already shipped before proposing new work from it. Prevents the loop from re-solving solved problems.
 - **`atris release`** — new command: tags the version, bumps package.json, creates a GitHub release, and drafts a `/launch` post in one shot.
 - **Shell injection fix** — `checkStaleness` switched from `execSync` string interpolation to `execFileSync` with args arrays. Markdown-derived content (task titles, inbox items) no longer reaches a shell.
 - **Codex hardening** — `atris activate` and `atris` entry point detect Codex environments and write `AGENTS.md` so Codex sessions start with workspace context.

package/bin/atris.js

@@ -247,7 +247,7 @@ function showHelp() {
   console.log('Optional helpers:');
   console.log('  brainstorm - Explore ideas conversationally before planning');
   console.log('  autopilot  - Guided loop that can clarify TODOs and run plan → do → review');
-  console.log('  visualize  - Legacy visualization helper (prefer "atris plan")');
+  console.log('  visualize  - Generate a Slack/deck-ready visual from a prompt');
   console.log('');
   console.log('Experiments:');
   console.log('  experiments init [slug]     - Prepare atris/experiments/ or scaffold a pack');
@@ -272,7 +272,7 @@ function showHelp() {
   console.log('  wake [business]    - Resume workspace (agents restart)');
   console.log('');
   console.log('Business:');
-  console.log('  business init <name>   - Create canonical business workspace (cloud + local)');
+  console.log('  business init <name>   - RECOMMENDED: create business environment (cloud + local)');
   console.log('  business onboard       - Onboard from sparse input (--name, --website, --contact)');
   console.log('  business add <slug>    - Connect a business');
   console.log('  business list          - Show connected businesses');
@@ -280,7 +280,7 @@ function showHelp() {
   console.log('  business team [slug]   - Show members, roles, and admin access');
   console.log('  business health <slug> - Health report (members, workspace, issues)');
   console.log('  business audit         - One-line health summary of all businesses');
-  console.log('  business create <name> - Create new business; add --workspace for canonical local scaffold');
+  console.log('  business create <name> - Cloud-only business record; add --workspace to also scaffold local');
   console.log('  business connect <svc> - Wire a skill/integration');
   console.log('  business notify <mode> - Set notification mode (digest/silent/push)');
   console.log('  business deploy <slug> - Push local business to cloud');
@@ -291,6 +291,7 @@ function showHelp() {
   console.log('');
   console.log('Cloud & agents:');
   console.log('  computer   - Talk directly to the AI computer (bash or agent exec)');
+  console.log('  receipt    - Save evidence from an agent run');
   console.log('  console    - Start/attach always-on coding console (tmux daemon)');
   console.log('  agent      - Select which Atris agent to use');
   console.log('  chat       - Chat with the selected Atris agent');
@@ -432,10 +433,10 @@ const { planAtris: planCmd, doAtris: doCmd, reviewAtris: reviewCmd } = require('
 // Check if this is a known command or natural language input
 const knownCommands = ['init', 'log', 'status', 'analytics', 'visualize', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'chat', 'console', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
-                       'clean', 'verify', 'search', 'skill', 'member', 'app', 'learn', 'plugin', 'experiments', 'pull', 'push', 'align', 'terminal', 'computer', 'diff', 'business', 'sync',
+                       'clean', 'verify', 'search', 'skill', 'member', 'app', 'learn', 'plugin', 'experiments', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'align', 'terminal', 'computer', 'diff', 'business', 'sync',
                        'ingest', 'query', 'lint', 'loop',
                        'gmail', 'calendar', 'twitter', 'slack', 'integrations', 'setup', 'clean-workspace', 'cw',
-                       'fork', 'browse', 'publish', 'sleep', 'wake', 'feedback', 'wiki', 'code-review', 'cr', 'soul', 'fleet'];
+                       'fork', 'browse', 'publish', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet'];
 
 // Check if command is an atris.md spec file - triggers welcome visualization
 function isSpecFile(cmd) {
@@ -868,10 +869,9 @@ if (command === 'init') {
 } else if (command === 'shell-init') {
   require('../commands/auth').shellInit();
 } else if (command === 'visualize') {
-  console.log('ℹ️  "atris visualize" is a legacy helper. Visualization is now built into "atris plan".');
-  console.log('   Prefer: atris plan');
-  console.log('');
-  require('../commands/visualize').visualizeAtris();
+  require('../commands/visualize').visualizeAtris(process.argv.slice(3))
+    .then(() => process.exit(0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'run') {
   const args = process.argv.slice(3);
   if (args.includes('--help') || args.includes('-h')) {
@@ -1160,6 +1160,10 @@ if (command === 'init') {
   const subcommand = process.argv[3];
   const args = process.argv.slice(4);
   require('../commands/experiments').experimentsCommand(subcommand, ...args);
+} else if (command === 'receipt' || command === 'proof' || command === 'openclaw') {
+  const subcommand = process.argv[3];
+  const args = process.argv.slice(4);
+  require('../commands/proof').proofCommand(subcommand, ...args);
 } else if (command === 'setup') {
   require('../commands/setup').setupAtris()
     .then(() => process.exit(0))
@@ -1188,6 +1192,10 @@ if (command === 'init') {
   require('../commands/feedback').feedbackCommand()
     .then(() => process.exit(0))
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'errors') {
+  require('../commands/errors').errorsCommand()
+    .then(() => process.exit(0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else {
   console.log(`Unknown command: ${command}`);
   console.log('Run "atris help" to see available commands');

package/commands/business.js

@@ -13,6 +13,20 @@ function getBusinessConfigPath() {
   return path.join(dir, 'businesses.json');
 }
 
+function slugify(name) {
+  return String(name || '')
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9\s-]/g, '')
+    .replace(/\s+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+function isHelpToken(arg) {
+  return arg === '--help' || arg === '-h' || arg === 'help' || arg === '-?';
+}
+
 function loadBusinesses() {
   const p = getBusinessConfigPath();
   if (!fs.existsSync(p)) return {};
@@ -774,7 +788,45 @@ function detectBusinessSlug(explicitSlug) {
   }
 }
 
+async function findExistingBusinessBySlug(slug, token) {
+  if (!slug) return null;
+
+  // Local cache first — no network round-trip needed.
+  const local = loadBusinesses();
+  if (local[slug]) {
+    return { id: local[slug].business_id, name: local[slug].name, slug, source: 'local' };
+  }
+  for (const v of Object.values(local)) {
+    if (v && v.slug === slug) {
+      return { id: v.business_id, name: v.name, slug, source: 'local' };
+    }
+  }
+
+  if (!token) return null;
+
+  // Cloud lookup — covers businesses the user is a member of but hasn't added.
+  const direct = await apiRequestJson(`/business/by-slug/${encodeURIComponent(slug)}`, {
+    method: 'GET',
+    token,
+  });
+  if (direct.ok && direct.data && direct.data.id) {
+    return { id: direct.data.id, name: direct.data.name, slug: direct.data.slug || slug, source: 'cloud' };
+  }
+
+  const list = await apiRequestJson('/business/', { method: 'GET', token });
+  if (list.ok && Array.isArray(list.data)) {
+    const match = list.data.find(b => b && b.slug === slug);
+    if (match) return { id: match.id, name: match.name, slug: match.slug, source: 'cloud' };
+  }
+
+  return null;
+}
+
 async function addBusiness(slug) {
+  if (!slug || isHelpToken(slug)) {
+    console.error('Usage: atris business add <slug>');
+    process.exit(1);
+  }
   if (!slug) {
     console.error('Usage: atris business add <slug>');
     process.exit(1);
@@ -1008,7 +1060,7 @@ function listBusinessesLocal(opts = {}) {
 }
 
 async function removeBusiness(slug) {
-  if (!slug) {
+  if (!slug || isHelpToken(slug)) {
     console.error('Usage: atris business remove <slug>');
     process.exit(1);
   }
@@ -1262,8 +1314,11 @@ async function businessAudit() {
 }
 
 async function createBusinessInternal(name, flags = [], mode = 'auto') {
-  if (!name) {
+  if (!name || isHelpToken(name) || String(name).startsWith('-')) {
     console.error('Usage: atris business create <name> [--description "..."] [--workspace] [--here|--root <dir>]');
+    if (name && String(name).startsWith('-') && !isHelpToken(name)) {
+      console.error(`\n  Refusing to create a business named "${name}" — looks like a flag, not a name.`);
+    }
     process.exit(1);
   }
 
@@ -1275,6 +1330,29 @@ async function createBusinessInternal(name, flags = [], mode = 'auto') {
 
   const options = parseCreateBusinessFlags(flags);
   const description = options.description;
+  const force = flags.includes('--force') || flags.includes('--allow-duplicate');
+
+  // Pre-flight: refuse to create a duplicate by slug. The backend will silently
+  // suffix `-1`, `-2`, etc., which produces ghost businesses when users actually
+  // wanted to attach to an existing one. Guide them to `atris pull` instead.
+  if (!force) {
+    const desiredSlug = slugify(name);
+    if (desiredSlug) {
+      const existing = await findExistingBusinessBySlug(desiredSlug, creds.token);
+      if (existing) {
+        console.error(`\nA business with slug "${desiredSlug}" already exists.`);
+        console.error(`  Name: ${existing.name || desiredSlug}`);
+        if (existing.id) console.error(`  ID:   ${existing.id}`);
+        console.error('');
+        console.error('To set up a local workspace for it, run:');
+        console.error(`  atris pull ${desiredSlug}                       # into ./${desiredSlug}`);
+        console.error(`  atris pull ${desiredSlug} --into <path>         # into a custom path`);
+        console.error('');
+        console.error(`To create a NEW business anyway (will be slugged "${desiredSlug}-1"), pass --force.`);
+        process.exit(1);
+      }
+    }
+  }
 
   console.log(`Creating business: ${name}...`);
 
@@ -1832,12 +1910,52 @@ async function quickstart() {
      (get 1 email/day instead of every notification)
 
   Templates: saas, agency, ecommerce, content, restaurant
+
+  Rule of thumb:
+     atris business init "<name>"    = cloud + local business computer workspace
+     atris business create "<name>"  = cloud-only unless you pass --workspace
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 `);
 }
 
 
+function printBusinessHelp() {
+  console.log('Usage: atris business <command> [args]');
+  console.log('');
+  console.log('  quickstart           ← Start here! 3-command guide');
+  console.log('');
+  console.log('  init <name>          RECOMMENDED: create a business environment (cloud + local)');
+  console.log('  workspace <name>     Alias for init');
+  console.log('  create <name>        Cloud-only business record; add --workspace to also scaffold local');
+  console.log('  add <slug>           Register an existing cloud business');
+  console.log('  list                 Show registered businesses');
+  console.log('  team [slug]          Show members, roles, and admin access');
+  console.log('  status <slug>        Quick status check');
+  console.log('  health [slug]        Full health dashboard');
+  console.log('  audit                Audit all businesses');
+  console.log('  connect <service>    Connect a skill/integration');
+  console.log('  notify <mode>        Set notification mode (digest/silent/push)');
+  console.log('  deploy <slug>        Push local business to cloud');
+  console.log('  onboard              Seed brief, person, first loop, safe next action, and one-pager from sparse input');
+  console.log('  record <report>      Append recap state into events, episodes, and scorecards');
+  console.log('  remove <slug>        Unregister locally');
+  console.log('');
+  console.log('  Already-attached business? Run `atris pull <slug>` to scaffold a local workspace.');
+}
+
 async function businessCommand(subcommand, ...args) {
+  // Help intercept — without this, `atris business init --help` would treat
+  // `--help` as a business name and create one. Same for any subcommand that
+  // takes a positional name/slug.
+  if (!subcommand || isHelpToken(subcommand)) {
+    printBusinessHelp();
+    return;
+  }
+  if (args.length > 0 && isHelpToken(args[0])) {
+    printBusinessHelp();
+    return;
+  }
+
   switch (subcommand) {
     case 'add':
       await addBusiness(args[0]);
@@ -1907,25 +2025,10 @@ async function businessCommand(subcommand, ...args) {
       await quickstart();
       break;
     default:
-      console.log('Usage: atris business <command> [args]');
-      console.log('');
-      console.log('  quickstart           ← Start here! 3-command guide');
-      console.log('');
-      console.log('  init <name>          Create a business environment (cloud + local)');
-      console.log('  workspace <name>     Alias for init');
-      console.log('  create <name>        Create the cloud business; add --workspace for a local business environment');
-      console.log('  add <slug>           Register an existing cloud business');
-      console.log('  list                 Show registered businesses');
-      console.log('  team [slug]          Show members, roles, and admin access');
-      console.log('  status <slug>        Quick status check');
-      console.log('  health [slug]        Full health dashboard');
-      console.log('  audit                Audit all businesses');
-      console.log('  connect <service>    Connect a skill/integration');
-      console.log('  notify <mode>        Set notification mode (digest/silent/push)');
-      console.log('  deploy <slug>        Push local business to cloud');
-      console.log('  onboard              Seed brief, person, first loop, safe next action, and one-pager from sparse input');
-      console.log('  record <report>      Append recap state into events, episodes, and scorecards');
-      console.log('  remove <slug>        Unregister locally');
+      console.error(`Unknown subcommand: ${subcommand}`);
+      console.error('');
+      printBusinessHelp();
+      process.exitCode = 1;
   }
 }
 

package/commands/computer.js

@@ -52,8 +52,40 @@ const KNOWN_CHAT_COMMANDS = new Set([
   '/start',
   '/status',
   '/worker',
+  '/workflow',
 ]);
 
+const CODEOPS_WORKFLOW_PROMPT = `
+## Atris CodeOps Workflow
+
+You are running inside Atris CodeOps with full computer permissions (permission_mode=bypassPermissions).
+Use those permissions to inspect, edit, test, commit, push, and open PRs when the task calls for it.
+
+Do not behave like an open-ended chat.
+Every coding or repo operation must follow the scientific workflow:
+OBSERVE -> HYPOTHESIS -> PLAN -> ACTION -> VALIDATION -> EVIDENCE -> NEXT STATE.
+
+For a new coding request, first show a concise PLAN with Files, Checks, Risk, and Merge policy.
+If the user has not clearly approved execution, ask for approval before editing.
+If the user explicitly says to execute, proceed after the concise plan.
+
+After work, always report:
+- edited_files
+- commands_run
+- validation_result
+- evidence
+- pr_url if any
+- pr_state
+- merge_state
+- next_task
+
+Use one of these next states:
+planned, executing, validated, pr_opened, merge_ready, merge_blocked_checks, merge_blocked_policy, merged, failed, needs_human.
+
+Never hide failures.
+A blocked check or missing permission is evidence, not success.
+`.trim();
+
 function color(code, value) {
   if (process.env.NO_COLOR || !process.stdout.isTTY) return String(value);
   return `\x1b[${code}m${value}\x1b[0m`;
@@ -165,6 +197,7 @@ function printCloudHelp() {
   console.log('  /start               Show the beginner flow again');
   console.log('  /help                Show this menu');
   console.log('  /status              Show cloud computer status');
+  console.log('  /workflow            Show the CodeOps workflow contract');
   console.log('  /files [path]        List files in the workspace');
   console.log('  /run <cmd>           Run shell without the model');
   console.log('  /audit [n]           Show recent runs, output, and charges');
@@ -201,6 +234,48 @@ function printCloudStartPanel(ctx, worker, model, billingLabel, authSummary = nu
   console.log(ui.dim('Plain English goes to Atris. Slash commands control the computer.'));
 }
 
+function appendSystemPrompt(basePrompt, extraPrompt) {
+  if (!extraPrompt) return basePrompt || null;
+  if (basePrompt && basePrompt.includes('## Atris CodeOps Workflow')) return basePrompt;
+  if (!basePrompt) return extraPrompt;
+  return `${String(basePrompt).trim()}\n\n${extraPrompt}`;
+}
+
+function codeOpsCloudOptions(options = {}) {
+  return {
+    ...options,
+    worker: options.worker || 'claude',
+    mode: 'codeops',
+    systemPrompt: appendSystemPrompt(options.systemPrompt, CODEOPS_WORKFLOW_PROMPT),
+  };
+}
+
+function printCodeOpsStartPanel(ctx, worker, model, billingLabel, authSummary = null) {
+  console.log('');
+  console.log(ui.bold('Atris CodeOps Computer'));
+  console.log(`${ctx.businessName}  ${ui.dim('/workspace persists, full permissions enabled')}`);
+  console.log(`Lane: ${ui.bold(formatWorkerName(worker))}  ${ui.dim(formatCloudSelection({ worker, model }))}`);
+  console.log(`Billing: ${billingLabel}`);
+  if (authSummary) console.log(`${authSummary.label}  ${ui.dim(authSummary.detail)}`);
+  console.log(`${ui.green('Workflow locked')}  ${ui.dim('observe -> plan -> act -> validate -> evidence -> next')}`);
+  console.log('');
+  console.log(ui.bold('Start here'));
+  console.log('  Type a coding goal in plain English.');
+  console.log('  CodeOps will plan first, then execute after approval or explicit proceed language.');
+  console.log('  Use /workflow to see the contract, /run for shell, /audit for run history, /exit to leave.');
+  console.log('');
+}
+
+function printCodeOpsWorkflowContract() {
+  console.log('');
+  console.log(ui.bold('CodeOps workflow'));
+  console.log('  observe -> hypothesis -> plan -> action -> validation -> evidence -> next state');
+  console.log('');
+  console.log('  Required final evidence: edited_files, commands_run, validation_result, pr_url, pr_state, merge_state, next_task.');
+  console.log('  Allowed states: planned, executing, validated, pr_opened, merge_ready, merge_blocked_checks, merge_blocked_policy, merged, failed, needs_human.');
+  console.log('  Full permissions stay on; the workflow contract controls how the computer uses them.');
+}
+
 function buildLocalBridgeSystemPrompt(sessionId, localRoot, allowBash) {
   const endpoint = `/api/cli/sessions/${sessionId}/file-op`;
   const bashLine = allowBash
@@ -1386,6 +1461,8 @@ async function computerExec(token, prompt, ctx = null, options = {}) {
         workspace_id: ctx.workspaceId,
         ...(options.worker ? { worker: options.worker } : {}),
         ...(options.model ? { model: options.model } : {}),
+        ...(options.systemPrompt ? { system_prompt: options.systemPrompt } : {}),
+        ...(options.allowedTools ? { allowed_tools: options.allowedTools } : {}),
       },
       timeoutMs: 40000,
     });
@@ -1742,6 +1819,10 @@ async function computerChat(token, ctx, initialOptions = {}) {
     return;
   }
 
+  const isCodeOps = initialOptions.mode === 'codeops' || ctx.slug === 'atris-codeops';
+  const chatSystemPrompt = isCodeOps
+    ? appendSystemPrompt(initialOptions.systemPrompt, CODEOPS_WORKFLOW_PROMPT)
+    : initialOptions.systemPrompt;
   let sessionId = `biz-${ctx.businessId.slice(0, 8)}-${Date.now().toString(36)}`;
   printCloudWordmark();
   const selection = await chooseCloudLane(token, ctx, initialOptions);
@@ -1758,12 +1839,16 @@ async function computerChat(token, ctx, initialOptions = {}) {
     return;
   }
 
-  printCloudStartPanel(ctx, worker, model, billingLabel, authSummary);
+  if (isCodeOps) {
+    printCodeOpsStartPanel(ctx, worker, model, billingLabel, authSummary);
+  } else {
+    printCloudStartPanel(ctx, worker, model, billingLabel, authSummary);
+  }
 
   const rl = readline.createInterface({
     input: process.stdin,
     output: process.stdout,
-    prompt: 'cloud> ',
+    prompt: isCodeOps ? 'codeops> ' : 'cloud> ',
   });
 
   rl.prompt();
@@ -1782,7 +1867,11 @@ async function computerChat(token, ctx, initialOptions = {}) {
       if (line === '/start') {
         billingLabel = await describeBillingMode(token, ctx, worker);
         authSummary = activeWorker(worker) === 'claude' ? await describeClaudeAuth(token, ctx) : null;
-        printCloudStartPanel(ctx, worker, model, billingLabel, authSummary);
+        if (isCodeOps) {
+          printCodeOpsStartPanel(ctx, worker, model, billingLabel, authSummary);
+        } else {
+          printCloudStartPanel(ctx, worker, model, billingLabel, authSummary);
+        }
         rl.prompt();
         continue;
       }
@@ -1796,6 +1885,11 @@ async function computerChat(token, ctx, initialOptions = {}) {
         rl.prompt();
         continue;
       }
+      if (line === '/workflow') {
+        printCodeOpsWorkflowContract();
+        rl.prompt();
+        continue;
+      }
       if (line === '/pwd') {
         await computerRun(token, 'pwd', ctx);
         rl.prompt();
@@ -1889,7 +1983,12 @@ async function computerChat(token, ctx, initialOptions = {}) {
         }
       }
 
-      sessionId = await sendBusinessChat(token, ctx, line, sessionId, false, rl, { worker, model });
+      sessionId = await sendBusinessChat(token, ctx, line, sessionId, false, rl, {
+        worker,
+        model,
+        systemPrompt: chatSystemPrompt,
+        allowedTools: initialOptions.allowedTools,
+      });
       rl.prompt();
     }
   } catch (error) {
@@ -2318,7 +2417,7 @@ async function runComputer() {
     console.log('  local-byo       Open LOCAL BYO Claude mode; Anthropic tokens, no cloud audit');
     console.log('  --cloud         Open CLOUD workspace mode in the bound business workspace');
     console.log('  cloud           Open CLOUD workspace mode in the bound business workspace');
-    console.log('  codeops         Open Atris CodeOps cloud workspace if your account has access');
+    console.log('  codeops         Open Atris CodeOps workflow computer if your account has access');
     console.log('  --worker        Cloud worker override: claude | openai');
     console.log('  --model         Cloud model override');
     console.log('  claude|codex    Legacy local console backends');
@@ -2351,6 +2450,9 @@ async function runComputer() {
     console.log('  atris computer --cloud --worker openai --model gpt-5.4');
     console.log('  atris computer cloud');
     console.log('  atris computer codeops');
+    console.log('  atris computer codeops status');
+    console.log('  atris computer codeops run "pwd"');
+    console.log('  atris computer codeops exec "Plan a safe repo fix"');
     console.log('  atris computer status');
     console.log('  atris computer wake');
     console.log('  atris computer run "ls -la /workspace"');
@@ -2370,7 +2472,44 @@ async function runComputer() {
       console.error('Ask an Atris CodeOps admin to add you to the atris-codeops business.');
       return;
     }
-    await computerChat(token, codeopsCtx, { worker: 'claude', ...cloudOptions });
+    const codeopsOptions = codeOpsCloudOptions(cloudOptions);
+    const codeopsSub = args[1];
+    const codeopsRest = args.slice(2).join(' ');
+    if (!codeopsSub || codeopsSub === 'chat') {
+      await computerChat(token, codeopsCtx, codeopsOptions);
+      return;
+    }
+    switch (codeopsSub) {
+      case '--help':
+      case 'help':
+        console.log('Usage: atris computer codeops [chat|status|wake|sleep|run|grep|ls|cat|exec|audit|workflow]');
+        console.log('');
+        console.log('Examples:');
+        console.log('  atris computer codeops');
+        console.log('  atris computer codeops status');
+        console.log('  atris computer codeops run "pwd && git status --short"');
+        console.log('  atris computer codeops exec "Plan the smallest safe fix, then wait"');
+        return;
+      case 'status': return computerStatus(token, codeopsCtx);
+      case 'wake': return computerWake(token, codeopsCtx);
+      case 'sleep': return computerSleep(token, codeopsCtx);
+      case 'run': return computerRun(token, codeopsRest, codeopsCtx);
+      case 'grep': return computerGrep(token, codeopsRest, codeopsCtx);
+      case 'ls': return computerLs(token, codeopsRest || undefined, codeopsCtx);
+      case 'cat': return computerCat(token, codeopsRest, codeopsCtx);
+      case 'exec': return computerExec(token, codeopsRest, codeopsCtx, codeopsOptions);
+      case 'audit': {
+        const limit = codeopsRest ? Number.parseInt(codeopsRest, 10) : 10;
+        return computerAudit(token, codeopsCtx, Number.isFinite(limit) ? limit : 10);
+      }
+      case 'workflow':
+        printCodeOpsWorkflowContract();
+        return;
+      default:
+        console.error(`Unknown CodeOps subcommand: ${codeopsSub}`);
+        console.log('Run: atris computer codeops help');
+        return;
+    }
     return;
   }
 

package/commands/errors.js

@@ -0,0 +1,155 @@
+/**
+ * Errors command for Atris CLI — admin dashboard over atris_error_events.
+ *
+ * Usage:
+ *   atris errors                      List errors from last 24h, grouped by signature
+ *   atris errors --hours 72           Widen the window (max 720h / 30d)
+ *   atris errors --limit 1000         Raise the raw-event cap for grouping
+ *   atris errors show <id>            Full detail (stack trace, message) for one event
+ *
+ * Requires admin role on the user row.
+ */
+
+const { loadCredentials } = require('../utils/auth');
+const { apiRequestJson } = require('../utils/api');
+
+function getToken() {
+  const creds = loadCredentials();
+  if (!creds || !creds.token) {
+    console.error('Not logged in. Run: atris login');
+    process.exit(1);
+  }
+  return creds.token;
+}
+
+function extractFlag(args, ...names) {
+  const remaining = [];
+  let value = null;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const eq = a.indexOf('=');
+    const key = eq >= 0 ? a.slice(0, eq) : a;
+    if (names.includes(key)) {
+      value = eq >= 0 ? a.slice(eq + 1) : args[++i];
+    } else {
+      remaining.push(a);
+    }
+  }
+  return [value, remaining];
+}
+
+async function listErrors(args) {
+  const [hoursArg, r1] = extractFlag(args, '--hours', '-H');
+  const [limitArg, r2] = extractFlag(r1, '--limit', '-L');
+  const hours = hoursArg ? parseInt(hoursArg, 10) : 24;
+  const limit = limitArg ? parseInt(limitArg, 10) : 500;
+
+  const token = getToken();
+  const result = await apiRequestJson(`/errors?hours=${hours}&limit=${limit}`, {
+    method: 'GET',
+    token,
+  });
+
+  if (!result.ok) {
+    console.error(`Error: ${result.error || 'Failed to fetch errors'}`);
+    process.exit(1);
+  }
+
+  const data = result.data || {};
+  const groups = data.groups || [];
+
+  if (groups.length === 0) {
+    console.log(`No errors in the last ${hours}h. Clean.`);
+    return;
+  }
+
+  console.log(
+    `Errors — last ${data.window_hours}h — ` +
+      `${data.total_events} events across ${data.unique_signatures} signatures\n`,
+  );
+
+  groups.forEach((g, idx) => {
+    const s = g.sample || {};
+    const shortId = (s.id || '').substring(0, 8);
+    const last = s.created_at ? s.created_at.substring(0, 16).replace('T', ' ') : '';
+    const status = s.status_code ? ` [${s.status_code}]` : '';
+    const msg = (s.message || '').replace(/\s+/g, ' ').substring(0, 140);
+
+    console.log(`${idx + 1}. x${g.count}  ${g.signature}${status}`);
+    if (last) console.log(`   last: ${last} UTC  latest id: ${shortId}`);
+    if (msg) console.log(`   "${msg}"`);
+    console.log('');
+  });
+
+  console.log(
+    `Run \`atris errors show <id>\` for full stack trace of a specific event.`,
+  );
+}
+
+async function showError(errorId) {
+  if (!errorId) {
+    console.error('Usage: atris errors show <id>');
+    console.error('(id must be a full UUID — get one from `atris errors` output)');
+    process.exit(1);
+  }
+
+  const token = getToken();
+  const result = await apiRequestJson(`/errors/${encodeURIComponent(errorId)}`, {
+    method: 'GET',
+    token,
+  });
+
+  if (!result.ok) {
+    console.error(`Error: ${result.error || 'Failed to fetch error'}`);
+    process.exit(1);
+  }
+
+  const e = result.data || {};
+  console.log(`Error ${e.id || errorId}`);
+  console.log(`  type:    ${e.error_type || '?'}`);
+  console.log(`  method:  ${e.request_method || '?'}`);
+  console.log(`  path:    ${e.request_path || '?'}`);
+  console.log(`  status:  ${e.status_code || '?'}`);
+  console.log(`  when:    ${e.created_at || '?'}`);
+  console.log(`  source:  ${e.source || '?'}`);
+  if (e.user_id) console.log(`  user:    ${e.user_id}`);
+  console.log('');
+  console.log('Message:');
+  console.log('  ' + (e.message || '(none)').split('\n').join('\n  '));
+  console.log('');
+  if (e.stack_trace) {
+    console.log('Stack trace:');
+    console.log('  ' + e.stack_trace.split('\n').join('\n  '));
+  }
+}
+
+function printHelp() {
+  console.log('');
+  console.log('Usage:');
+  console.log('  atris errors                         List errors from last 24h, grouped');
+  console.log('  atris errors --hours 72              Widen the window (max 720h / 30d)');
+  console.log('  atris errors --limit 1000            Raise the raw-event cap');
+  console.log('  atris errors show <full-uuid>        Full detail for one event');
+  console.log('');
+  console.log('Admin role required.');
+  console.log('');
+}
+
+async function errorsCommand() {
+  const args = process.argv.slice(3);
+  const sub = args[0];
+
+  if (sub === '--help' || sub === '-h' || sub === 'help') {
+    printHelp();
+    return;
+  }
+
+  if (sub === 'show') {
+    await showError(args[1]);
+    return;
+  }
+
+  await listErrors(args);
+}
+
+module.exports = { errorsCommand };

package/commands/proof.js

@@ -0,0 +1,115 @@
+const fs = require('fs');
+const path = require('path');
+
+function readBusinessBinding(cwd = process.cwd()) {
+  const bindingPath = path.join(cwd, '.atris', 'business.json');
+  if (!fs.existsSync(bindingPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(bindingPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function slugify(value) {
+  return String(value || 'business-workflow')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '') || 'business-workflow';
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function writeJson(filePath, value) {
+  ensureDir(path.dirname(filePath));
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function doctor(cwd = process.cwd()) {
+  const binding = readBusinessBinding(cwd);
+  console.log('Receipt check');
+  console.log(`business binding: ${binding ? `${binding.name || binding.slug || binding.business_id} ready` : 'missing'}`);
+  console.log(`receipt folder: ${fs.existsSync(path.join(cwd, '.atris', 'receipts')) ? 'ready' : 'missing'}`);
+  console.log('');
+  console.log('Next: atris receipt init business-workflow');
+}
+
+function init(taskSlug = 'business-workflow', cwd = process.cwd()) {
+  const binding = readBusinessBinding(cwd);
+  if (!binding) {
+    console.error('No business binding found. Run: atris business init <name> --here');
+    process.exitCode = 1;
+    return;
+  }
+
+  const slug = slugify(taskSlug);
+  const root = path.join(cwd, '.atris');
+  const taskPath = path.join(root, 'tasks', `${slug}.json`);
+  const receiptsDir = path.join(root, 'receipts');
+
+  ensureDir(receiptsDir);
+  fs.writeFileSync(path.join(receiptsDir, '.gitkeep'), '');
+  writeJson(taskPath, {
+    schema: 'atris.receipt_task.v1',
+    slug,
+    goal: 'Run one business-computer task and save what happened.',
+    workspace: {
+      business_id: binding.business_id || binding.id || null,
+      workspace_id: binding.workspace_id || null,
+      name: binding.name || null,
+      slug: binding.slug || null,
+    },
+    runtime: {
+      proof_command: 'atris computer proof',
+      replay_command: 'atris experiments replay endstate',
+    },
+    verify: [
+      'atris computer proof',
+      'atris experiments replay endstate',
+    ],
+  });
+
+  console.log(`Receipt task ready: ${slug}`);
+  console.log(`Task: ${path.relative(cwd, taskPath)}`);
+  console.log(`Receipts: ${path.relative(cwd, receiptsDir)}`);
+}
+
+function run(args = []) {
+  const dryRun = args.includes('--dry-run');
+  console.log('Receipt run');
+  console.log('1. atris computer proof');
+  console.log('2. atris experiments replay endstate');
+  if (dryRun) {
+    console.log('Dry run only; no receipts written.');
+    return;
+  }
+  console.log('Run those commands, then save the receipt under .atris/receipts/.');
+}
+
+function proofCommand(subcommand = 'doctor', ...args) {
+  switch (subcommand || 'doctor') {
+    case 'doctor':
+      return doctor();
+    case 'init':
+      return init(args[0] || 'business-workflow');
+    case 'proof':
+      return run(args);
+    case 'help':
+    case '--help':
+    case '-h':
+      console.log('Usage: atris receipt [doctor|init <slug>|run --dry-run]');
+      return;
+    case 'run':
+      return run(args);
+    default:
+      console.error(`Unknown receipt command: ${subcommand}`);
+      console.log('Usage: atris receipt [doctor|init <slug>|run --dry-run]');
+      process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  proofCommand,
+};

package/commands/pull.js

@@ -703,8 +703,10 @@ async function pullBusiness(slug) {
     name: businessName,
   }, null, 2));
 
-  // Wire skills → .claude/skills/ so they work as slash commands
-  const skillsDir = path.join(outputDir, 'skills');
+  // Wire skills → .claude/skills/ so they work as slash commands.
+  // Source of truth is atris/skills/ (vendor-neutral, syncs to cloud).
+  // .claude/skills/ is a locally-generated adapter Claude Code reads from.
+  const skillsDir = path.join(outputDir, 'atris', 'skills');
   const claudeSkillsDir = path.join(outputDir, '.claude', 'skills');
 
   if (fs.existsSync(skillsDir)) {

package/commands/push.js

@@ -367,6 +367,12 @@ async function pushAtris() {
 
     if (!result.ok) {
       if (result.status === 403) {
+        const detail = result.errorMessage || result.error || (result.data && result.data.detail) || '';
+        if (detail && /plan required|business, max, or enterprise/i.test(detail)) {
+          console.error(`\n  Access denied: ${detail}`);
+          await emit('access_denied', { error_detail: detail });
+          process.exit(1);
+        }
         // Permission denied — retry with only team/ and journal/ files
         const allowed = filesToPush.filter(f => f.path.startsWith('/team/') || f.path.startsWith('/journal/'));
         skipped = filesToPush.filter(f => !f.path.startsWith('/team/') && !f.path.startsWith('/journal/'));

package/commands/visualize.js

@@ -1,20 +1,24 @@
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 const { getLogPath } = require('../lib/journal');
+const { ensureValidCredentials } = require('../utils/auth');
+const { apiRequestJson } = require('../utils/api');
+const { loadConfig } = require('../utils/config');
 
-function visualizeAtris() {
-  const { logFile, dateFormatted } = getLogPath();
+const DEFAULT_MODEL = 'gpt-image-2';
+const DEFAULT_SIZE = '1536x1024';
+const DEFAULT_QUALITY = 'high';
+
+function legacyVisualizeInbox() {
+  const { logFile } = getLogPath();
 
-  // Check if log exists
   if (!fs.existsSync(logFile)) {
     console.log('✗ No journal entry for today. Run "atris log" to create one.');
     process.exit(1);
   }
 
-  // Read the log file
   const logContent = fs.readFileSync(logFile, 'utf8');
-
-  // Extract Inbox section
   const inboxMatch = logContent.match(/## Inbox\n([\s\S]*?)(?=\n##|$)/);
   if (!inboxMatch || !inboxMatch[1].trim()) {
     console.log('✗ No items in Inbox. Add ideas to your journal first.');
@@ -35,7 +39,6 @@ function visualizeAtris() {
     process.exit(1);
   }
 
-  // Display visualization template
   console.log('');
   console.log('┌─────────────────────────────────────────────────────────────┐');
   console.log('│ Atris Visualize — Break Down & Approval Gate                │');
@@ -68,7 +71,320 @@ function visualizeAtris() {
   console.log('');
 }
 
+function parseVisualizeArgs(args = []) {
+  const options = {
+    model: DEFAULT_MODEL,
+    size: DEFAULT_SIZE,
+    quality: DEFAULT_QUALITY,
+    outputFormat: 'png',
+    dryRun: false,
+    open: false,
+    timeoutMs: 180000,
+  };
+  const promptParts = [];
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--') {
+      promptParts.push(...args.slice(i + 1));
+      break;
+    }
+    if (arg === '--help' || arg === '-h') options.help = true;
+    else if (arg === '--dry-run') options.dryRun = true;
+    else if (arg === '--open') options.open = true;
+    else if (arg === '--no-open') options.open = false;
+    else if (arg === '--raw') options.raw = true;
+    else if (arg === '--agent' && args[i + 1]) options.agentId = args[++i];
+    else if (arg.startsWith('--agent=')) options.agentId = arg.slice('--agent='.length);
+    else if (arg === '--model' && args[i + 1]) options.model = args[++i];
+    else if (arg.startsWith('--model=')) options.model = arg.slice('--model='.length);
+    else if (arg === '--size' && args[i + 1]) options.size = args[++i];
+    else if (arg.startsWith('--size=')) options.size = arg.slice('--size='.length);
+    else if (arg === '--quality' && args[i + 1]) options.quality = args[++i];
+    else if (arg.startsWith('--quality=')) options.quality = arg.slice('--quality='.length);
+    else if (arg === '--out' && args[i + 1]) options.out = args[++i];
+    else if (arg.startsWith('--out=')) options.out = arg.slice('--out='.length);
+    else if (arg === '--timeout' && args[i + 1]) options.timeoutMs = Number(args[++i]) * 1000;
+    else if (arg.startsWith('--timeout=')) options.timeoutMs = Number(arg.slice('--timeout='.length)) * 1000;
+    else if (arg === '--format' && args[i + 1]) options.outputFormat = args[++i];
+    else if (arg.startsWith('--format=')) options.outputFormat = arg.slice('--format='.length);
+    else promptParts.push(arg);
+  }
+
+  return { prompt: promptParts.join(' ').trim(), options };
+}
+
+function showVisualizeHelp() {
+  console.log('');
+  console.log('Usage: atris visualize <prompt> [options]');
+  console.log('');
+  console.log('Generate a Slack/deck-ready business visual from workspace context.');
+  console.log('');
+  console.log('Options:');
+  console.log('  --model <name>     Image model (default: gpt-image-2)');
+  console.log('  --size <WxH>       Output size (default: 1536x1024)');
+  console.log('  --quality <level>  Quality (default: high)');
+  console.log('  --out <path>       Save path (default: atris/reports/visuals/<slug>.png)');
+  console.log('  --agent <id>       Agent id for backend image endpoint');
+  console.log('  --dry-run          Print generated prompt without calling the backend');
+  console.log('  --open             Open the saved PNG after generation');
+  console.log('  --raw              Send your prompt as-is, without workspace prompt shaping');
+  console.log('');
+  console.log('No prompt keeps the legacy inbox visualization helper.');
+  console.log('');
+}
+
+function readTextIfExists(filePath, maxChars) {
+  try {
+    if (!fs.existsSync(filePath)) return '';
+    return fs.readFileSync(filePath, 'utf8').slice(0, maxChars);
+  } catch {
+    return '';
+  }
+}
+
+function readBusinessMeta(cwd = process.cwd()) {
+  const businessPath = path.join(cwd, '.atris', 'business.json');
+  try {
+    if (!fs.existsSync(businessPath)) return {};
+    return JSON.parse(fs.readFileSync(businessPath, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+function findRelevantContextFiles(cwd, prompt) {
+  const roots = [
+    path.join(cwd, 'atris', 'context'),
+    path.join(cwd, 'atris', 'wiki'),
+  ];
+  const words = new Set(
+    prompt.toLowerCase().split(/[^a-z0-9]+/).filter(w => w.length >= 4)
+  );
+  const files = [];
+
+  function walk(dir) {
+    if (!fs.existsSync(dir)) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile() && entry.name.endsWith('.md')) files.push(full);
+    }
+  }
+
+  roots.forEach(walk);
+  return files
+    .map(file => {
+      const rel = path.relative(cwd, file);
+      const haystack = rel.toLowerCase();
+      let score = 0;
+      for (const word of words) {
+        if (haystack.includes(word)) score += 3;
+      }
+      const body = readTextIfExists(file, 1200).toLowerCase();
+      for (const word of words) {
+        if (body.includes(word)) score += 1;
+      }
+      return { file, rel, score };
+    })
+    .filter(item => item.score > 0)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, 4);
+}
+
+function collectWorkspaceContext(prompt, cwd = process.cwd()) {
+  const business = readBusinessMeta(cwd);
+  const chunks = [];
+  if (business.name || business.slug) {
+    chunks.push(`Workspace: ${business.name || business.slug} (${business.slug || 'no-slug'})`);
+  }
+
+  const mapSnippet = readTextIfExists(path.join(cwd, 'atris', 'MAP.md'), 1400);
+  if (mapSnippet) chunks.push(`MAP excerpt:\n${mapSnippet}`);
+
+  const todoSnippet = readTextIfExists(path.join(cwd, 'atris', 'TODO.md'), 1000);
+  if (todoSnippet) chunks.push(`TODO excerpt:\n${todoSnippet}`);
+
+  const relevant = findRelevantContextFiles(cwd, prompt);
+  for (const item of relevant) {
+    chunks.push(`${item.rel}:\n${readTextIfExists(item.file, 900)}`);
+  }
+
+  return chunks.join('\n\n---\n\n').slice(0, 6000);
+}
+
+function classifyArtifact(prompt) {
+  const p = prompt.toLowerCase();
+  if (/security|compliance|soc2|soc 2|questionnaire|risk|posture/.test(p)) return 'security posture';
+  if (/wbr|weekly|metric|metrics|revenue|p&l|pnl|forecast|dashboard/.test(p)) return 'metric story';
+  if (/onboard|setup|connect|workflow|process|flow|steps|how to/.test(p)) return 'workflow';
+  if (/architecture|system|infra|stack|api|database|service/.test(p)) return 'architecture';
+  if (/compare|comparison|versus|\bvs\b|tradeoff/.test(p)) return 'comparison';
+  if (/status|update|recap|progress|roadmap/.test(p)) return 'status update';
+  return 'business explainer';
+}
+
+function slugify(input) {
+  return String(input || 'visual')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 54) || 'visual';
+}
+
+function defaultOutputPath(prompt, cwd = process.cwd()) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+  const visualsDir = fs.existsSync(path.join(cwd, 'atris'))
+    ? path.join(cwd, 'atris', 'reports', 'visuals')
+    : path.join(cwd, 'visuals');
+  return path.join(visualsDir, `${slugify(prompt)}-${stamp}.png`);
+}
+
+function resolveOutputPath(out, prompt, cwd = process.cwd()) {
+  if (!out) return defaultOutputPath(prompt, cwd);
+  return path.isAbsolute(out) ? out : path.join(cwd, out);
+}
+
+function buildImagePrompt(userPrompt, options = {}, cwd = process.cwd()) {
+  if (options.raw) return userPrompt;
+
+  const artifactType = classifyArtifact(userPrompt);
+  const context = collectWorkspaceContext(userPrompt, cwd);
+  const contextBlock = context ? `\nWorkspace context to respect:\n${context}\n` : '';
+
+  return `Use case: productivity-visual
+Asset type: Slack-shareable and deck-ready business artifact
+Artifact type: ${artifactType}
+Primary request: ${userPrompt}
+${contextBlock}
+Design requirements:
+- Create a polished, modern SaaS-style visual on a clean light background.
+- Use business-appropriate typography, generous spacing, and a restrained palette.
+- Make the visual useful at Slack preview size: large labels, short text, no tiny paragraphs.
+- Prefer a clear structure: flow, comparison, architecture diagram, metric story, or status map depending on the request.
+- If rendering text, keep it concise and accurate; do not invent unsupported names, numbers, claims, or logos.
+- Do not use real third-party logos unless the user explicitly asks.
+- Avoid decorative stock-art scenes. The output should feel like a usable work artifact.
+- Include enough visual hierarchy that a busy operator can understand it in 5 seconds.
+`;
+}
+
+async function resolveAgentId(token, explicitAgentId) {
+  if (explicitAgentId) return { id: explicitAgentId, label: explicitAgentId };
+
+  const agentsResult = await apiRequestJson('/agent/my-agents', { method: 'GET', token });
+  const agents = agentsResult.data?.my_agents || agentsResult.data?.agents || [];
+  const activeAgents = agents.filter(agent => agent.status !== 'inactive' && agent.id);
+  const agentById = new Map(activeAgents.map(agent => [agent.id, agent]));
+  const fromAccessible = (agentId, fallbackLabel) => {
+    if (!agentId || !agentById.has(agentId)) return null;
+    const agent = agentById.get(agentId);
+    return { id: agent.id, label: agent.name || fallbackLabel || agent.id };
+  };
+
+  const config = loadConfig();
+  const configAgent = fromAccessible(config.agent_id, config.agent_name);
+  if (configAgent) return configAgent;
+
+  const business = readBusinessMeta();
+  const localBusinessAgent = fromAccessible(business.agent_id, business.agent_name);
+  if (localBusinessAgent) return localBusinessAgent;
+
+  if (business.slug) {
+    const list = await apiRequestJson('/business/', { method: 'GET', token });
+    const businesses = Array.isArray(list.data) ? list.data : [];
+    const match = businesses.find(b => b.slug === business.slug || b.name === business.name);
+    const agentId = match?.agent_id || match?.default_agent_id || match?.agent?.id;
+    const businessAgent = fromAccessible(agentId, match?.agent_name || match?.agent?.name);
+    if (businessAgent) return businessAgent;
+  }
+
+  if (activeAgents.length === 1) return { id: activeAgents[0].id, label: activeAgents[0].name || activeAgents[0].id };
+  if (activeAgents.length > 1) return { id: activeAgents[0].id, label: activeAgents[0].name || activeAgents[0].id };
+
+  throw new Error('No agent found. Run "atris agent" or pass --agent <agent_id>.');
+}
+
+function writeImageFile(base64Image, outputPath) {
+  const clean = String(base64Image || '').replace(/^data:image\/[a-zA-Z0-9.+-]+;base64,/, '');
+  if (!clean) throw new Error('Backend returned no image data.');
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  fs.writeFileSync(outputPath, Buffer.from(clean, 'base64'));
+}
+
+function maybeOpenImage(outputPath) {
+  if (process.platform === 'darwin') spawnSync('open', [outputPath], { stdio: 'ignore' });
+  else if (process.platform === 'win32') spawnSync('cmd', ['/c', 'start', '', outputPath], { stdio: 'ignore' });
+  else spawnSync('xdg-open', [outputPath], { stdio: 'ignore' });
+}
+
+async function generateVisual(prompt, options = {}) {
+  const outputPath = resolveOutputPath(options.out, prompt);
+  const imagePrompt = buildImagePrompt(prompt, options);
+
+  if (options.dryRun) {
+    console.log('Atris Visualize dry run');
+    console.log(`Model:  ${options.model}`);
+    console.log(`Size:   ${options.size}`);
+    console.log(`Output: ${outputPath}`);
+    console.log('');
+    console.log(imagePrompt.trim());
+    return { outputPath, imagePrompt, dryRun: true };
+  }
+
+  const ensured = await ensureValidCredentials(apiRequestJson);
+  const creds = ensured.error ? null : ensured.credentials;
+  if (!creds?.token) {
+    const detail = ensured.detail || ensured.error;
+    throw new Error(detail ? `Authentication failed: ${detail}. Run "atris login".` : 'Not logged in. Run "atris login".');
+  }
+
+  const agent = await resolveAgentId(creds.token, options.agentId);
+  console.log(`Generating visual with ${options.model} via agent ${agent.label}...`);
+
+  const result = await apiRequestJson(`/agent/${agent.id}/image/generate`, {
+    method: 'POST',
+    token: creds.token,
+    timeoutMs: options.timeoutMs,
+    body: {
+      prompt: imagePrompt,
+      n: 1,
+      size: options.size,
+      model: options.model,
+      quality: options.quality,
+      output_format: options.outputFormat,
+    },
+  });
+
+  if (!result.ok) {
+    throw new Error(`Image generation failed (${result.status}): ${result.error || result.text || 'unknown error'}`);
+  }
+
+  const image = result.data?.images?.[0];
+  writeImageFile(image, outputPath);
+  console.log(`Saved: ${outputPath}`);
+  if (options.open) maybeOpenImage(outputPath);
+  return { outputPath, imagePrompt, model: result.data?.model_used || options.model };
+}
+
+async function visualizeAtris(args = process.argv.slice(3)) {
+  const { prompt, options } = parseVisualizeArgs(args);
+  if (options.help) {
+    showVisualizeHelp();
+    return;
+  }
+  if (!prompt) {
+    legacyVisualizeInbox();
+    return;
+  }
+  await generateVisual(prompt, options);
+}
 
 module.exports = {
-  visualizeAtris
+  visualizeAtris,
+  parseVisualizeArgs,
+  buildImagePrompt,
+  classifyArtifact,
+  resolveOutputPath,
+  generateVisual,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.12.1",
+  "version": "3.13.0",
   "description": "Atris — an operating system for intelligence. Integrates with any agent.",
   "main": "bin/atris.js",
   "bin": {