atris 3.35.0 → 3.36.0

package/lib/auto-accept-certified.js

@@ -4,18 +4,26 @@ const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { taskProofState, taskProofExecutionState } = require('./task-proof');
+const { extractReceiptEvidence } = require('./receipt-evidence');
 const reviewIntegrity = require('./review-integrity');
+const { computeTrustTier } = require('./trust-tiers');
 
 const AGENT_CERTIFICATION_REVIEW_PASSES = 2;
 // Kept for compat with older callers/tests; the pass-count landing lane it
 // once powered is gone. Passes alone never land work, an independent
 // reviewer does.
 const AUTO_ACCEPT_HIGH_CONFIDENCE_PASSES = 3;
-const DENIED_TAGS = new Set(['billing', 'deploy', 'feedback', 'voice', 'security', 'customer', 'external']);
+const DENIED_TAGS = new Set(['billing', 'deploy', 'feedback', 'security', 'customer', 'external']);
 
 const SIMPLE_VERIFY_TOKEN_RE = /^[a-zA-Z0-9_./:@=+-]+$/;
 const GIT_WORKTREE_PATH_RE = /^[a-zA-Z0-9_./@=+-]+$/;
 const GIT_REV_TOKEN_RE = /^[a-zA-Z0-9_./@=+~^-]+$/;
+const SAFE_RELATIVE_PATH_RE = /^[a-zA-Z0-9_./-]+$/;
+const SAFE_ENV_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+const SAFE_ENV_VALUE_RE = /^[A-Za-z0-9._/:-]*$/;
+const PYTHON_SHORT_FLAG_RE = /^-[a-zA-Z-]+$/;
+const PYTHON_LONG_FLAG_RE = /^--[a-zA-Z-]+(?:=[A-Za-z0-9._:-]+)?$/;
+const NODE_TEST_PATTERN_RE = /^[A-Za-z0-9 _.,:!?@#%&=+|()[\]{}*^$~\\/-]+$/;
 
 function hasUnsafePathSegment(token) {
   const text = String(token || '');
@@ -58,11 +66,63 @@ function safeNodePathArgs(args) {
   return args.every(token => safeRelativePathToken(token));
 }
 
+function safeCdPathToken(token) {
+  const text = String(token || '');
+  return Boolean(text)
+    && !text.startsWith('-')
+    && !text.includes(':')
+    && SAFE_RELATIVE_PATH_RE.test(text)
+    && !hasUnsafePathSegment(text);
+}
+
+function safePythonPathToken(token) {
+  const text = String(token || '');
+  return Boolean(text)
+    && SAFE_RELATIVE_PATH_RE.test(text)
+    && !/^[a-zA-Z]:[\\/]/.test(text);
+}
+
+function safePythonBinaryToken(token) {
+  const text = String(token || '');
+  return text === 'python'
+    || text === 'python3'
+    || (safePythonPathToken(text) && /(^|\/)venv\/bin\/python3?$/.test(text));
+}
+
+function safePythonRelativePathToken(token) {
+  const text = String(token || '');
+  return Boolean(text)
+    && !text.startsWith('-')
+    && !text.includes(':')
+    && SAFE_RELATIVE_PATH_RE.test(text)
+    && !hasUnsafePathSegment(text);
+}
+
+function safePythonFlagToken(token) {
+  const text = String(token || '');
+  return PYTHON_SHORT_FLAG_RE.test(text) || PYTHON_LONG_FLAG_RE.test(text);
+}
+
+function safePytestArg(token) {
+  return safePythonRelativePathToken(token) || safePythonFlagToken(token);
+}
+
+function safePythonScriptPath(token) {
+  const text = String(token || '');
+  return text.startsWith('scripts/')
+    && text.endsWith('.py')
+    && safePythonRelativePathToken(text);
+}
+
+function safePythonScriptArg(token) {
+  return safePythonRelativePathToken(token) || safePythonFlagToken(token);
+}
+
 function safeNodeTestArgs(args) {
   let expectPattern = false;
   for (const token of args) {
     if (expectPattern) {
-      if (!safeVerifyToken(token) || hasUnsafePathSegment(token)) return false;
+      if (!NODE_TEST_PATTERN_RE.test(token) || token.length > 500) return false;
       expectPattern = false;
       continue;
     }
@@ -72,7 +132,7 @@ function safeNodeTestArgs(args) {
     }
     if (String(token || '').startsWith('--test-name-pattern=')) {
       const pattern = String(token).slice('--test-name-pattern='.length);
-      if (!pattern || !safeVerifyToken(pattern) || hasUnsafePathSegment(pattern)) return false;
+      if (!pattern || !NODE_TEST_PATTERN_RE.test(pattern) || pattern.length > 500) return false;
       continue;
     }
     if (!safeRelativePathToken(token)) return false;
@@ -105,15 +165,60 @@ function isAllowedAtrisCleanDryRun(argv) {
     && argv[4] === '--json';
 }
 
+// `atris verify artifact <path>` is read-only by contract: it reads one file
+// and prints substance checks. Allow the path plus numeric/json flags only;
+// quoted --objective text stays outside the strict re-execution allowlist.
+function isAllowedAtrisVerifyArtifact(argv) {
+  let rest = null;
+  if (argv[0] === 'atris' && argv[1] === 'verify' && argv[2] === 'artifact') rest = argv.slice(3);
+  if (argv[0] === 'node' && argv[1] === 'bin/atris.js' && argv[2] === 'verify' && argv[3] === 'artifact') rest = argv.slice(4);
+  if (!rest || !rest.length || !safeRelativePathToken(rest[0])) return false;
+  let index = 1;
+  while (index < rest.length) {
+    const token = rest[index];
+    if (token === '--json') { index += 1; continue; }
+    if ((token === '--min-lines' || token === '--max-age-hours') && /^\d{1,6}$/.test(rest[index + 1] || '')) {
+      index += 2;
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+
 function isInsidePath(candidate, root) {
   const relative = path.relative(root, candidate);
   return relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative));
 }
 
-function validateGitWorktreePath(argv, workspaceRoot) {
+function parentArenaDir(workspace) {
+  let cursor = path.resolve(workspace);
+  while (cursor && cursor !== path.dirname(cursor)) {
+    if (path.basename(cursor) === 'arena') return cursor;
+    cursor = path.dirname(cursor);
+  }
+  return path.dirname(path.resolve(workspace));
+}
+
+function validateCommandCwd(parsed, workspaceRoot) {
+  const workspace = path.resolve(workspaceRoot || process.cwd());
+  if (!parsed.cwd) return { ok: true, cwd: workspace };
+  const target = path.resolve(workspace, parsed.cwd);
+  if (!isInsidePath(target, workspace)) return { ok: false, reason: 'verify_command_not_allowed' };
+  try {
+    if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) {
+      return { ok: false, reason: 'verify_workdir_missing' };
+    }
+  } catch {
+    return { ok: false, reason: 'verify_workdir_missing' };
+  }
+  return { ok: true, cwd: target };
+}
+
+function validateGitWorktreePath(argv, workspaceRoot, commandCwd) {
   if (!(argv[0] === 'git' && argv[1] === '-C')) return { ok: true };
   const workspace = path.resolve(workspaceRoot || process.cwd());
-  const target = path.resolve(workspace, argv[2]);
+  const target = path.resolve(commandCwd || workspace, argv[2]);
   const allowedRoot = path.dirname(workspace);
   if (!isInsidePath(target, workspace) && !isInsidePath(target, allowedRoot)) {
     return { ok: false, reason: 'verify_command_not_allowed' };
@@ -122,6 +227,18 @@ function validateGitWorktreePath(argv, workspaceRoot) {
   return { ok: true };
 }
 
+function validatePythonBinaryPath(argv, workspaceRoot, commandCwd) {
+  const bin = argv[0];
+  if (bin === 'python' || bin === 'python3' || !safePythonBinaryToken(bin)) return { ok: true };
+  const workspace = path.resolve(workspaceRoot || process.cwd());
+  const target = path.resolve(commandCwd || workspace, bin);
+  const allowedRoot = parentArenaDir(workspace);
+  if (!isInsidePath(target, workspace) && !isInsidePath(target, allowedRoot)) {
+    return { ok: false, reason: 'verify_command_not_allowed' };
+  }
+  return { ok: true };
+}
+
 function reviewPassCount(task) {
   const metadata = task.metadata || {};
   const review = task.review || {};
@@ -189,20 +306,114 @@ function distinctReviewActors(task) {
   return reviewIntegrity.reviewEventActors(task);
 }
 
-function parseVerifyCommand(verify) {
-  const cmd = String(verify || '').trim();
-  if (!cmd) return { ok: false, reason: 'no_verify_command' };
-  if (/[;&|`$<>\n\r]/.test(cmd)) return { ok: false, reason: 'verify_command_not_allowed' };
-  const argv = cmd.split(/\s+/).filter(Boolean);
-  if (!argv.length || argv.some((token, index) => {
+function parseCdPrefix(cmd) {
+  const match = cmd.match(/^cd\s+(\S+)\s+&&\s+(.+)$/);
+  if (!match) return { ok: true, command: cmd };
+  const cwd = match[1];
+  const command = String(match[2] || '').trim();
+  if (!safeCdPathToken(cwd) || !command) {
+    return { ok: false, reason: 'verify_command_not_allowed' };
+  }
+  return { ok: true, cwd, command };
+}
+
+function parseLeadingEnv(tokens) {
+  const env = {};
+  let index = 0;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    const equals = token.indexOf('=');
+    if (equals <= 0) break;
+    const key = token.slice(0, equals);
+    const value = token.slice(equals + 1);
+    if (!SAFE_ENV_KEY_RE.test(key) || !SAFE_ENV_VALUE_RE.test(value)) {
+      return { ok: false, reason: 'verify_command_not_allowed' };
+    }
+    env[key] = value;
+    index += 1;
+  }
+  return { ok: true, env, argv: tokens.slice(index) };
+}
+
+function safeVerifyArgv(argv) {
+  if (argv[0] === 'node' && argv[1] === '--test') {
+    return safeNodeTestArgs(argv.slice(2));
+  }
+  return argv.every((token, index) => {
+    if (safePythonBinaryToken(argv[0]) && index === 0) return true;
     if (argv[0] === 'git' && argv[1] === '-C' && index === 2) {
-      return !safeGitWorktreePathToken(token);
+      return safeGitWorktreePathToken(token);
     }
     if (argv[0] === 'git' && ['diff', '-C'].includes(argv[1]) && index >= (argv[1] === '-C' ? 5 : 3)) {
-      return !safeGitRevToken(token);
+      return safeGitRevToken(token);
+    }
+    return safeVerifyToken(token);
+  });
+}
+
+// Parse enough shell quoting to recover direct argv without ever invoking a
+// shell. Operators are rejected outside quotes; quoted test-name regexes are
+// passed as one literal argument to spawnSync({ shell: false }).
+function tokenizeVerifyCommand(command) {
+  const tokens = [];
+  let current = '';
+  let quote = null;
+  let started = false;
+  const flush = () => {
+    if (!started) return;
+    tokens.push(current);
+    current = '';
+    started = false;
+  };
+  for (const char of String(command || '')) {
+    if (quote) {
+      if (char === quote) quote = null;
+      else if (char === '\n' || char === '\r') return { ok: false, reason: 'verify_command_not_allowed' };
+      else current += char;
+      started = true;
+      continue;
     }
-    return !safeVerifyToken(token);
-  })) {
+    if (char === "'" || char === '"') {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      flush();
+      continue;
+    }
+    if (/[;&|`$<>\\]/.test(char)) return { ok: false, reason: 'verify_command_not_allowed' };
+    current += char;
+    started = true;
+  }
+  if (quote) return { ok: false, reason: 'verify_command_not_allowed' };
+  flush();
+  return { ok: true, tokens };
+}
+
+function isAllowedPythonCommand(argv) {
+  const [bin, first, second] = argv;
+  if (!safePythonBinaryToken(bin)) return false;
+  if (first === '-m' && second === 'pytest') {
+    return argv.slice(3).every(safePytestArg);
+  }
+  if (safePythonScriptPath(first)) {
+    return argv.slice(2).every(safePythonScriptArg);
+  }
+  return false;
+}
+
+function parseVerifyCommand(verify) {
+  const cmd = String(verify || '').trim();
+  if (!cmd) return { ok: false, reason: 'no_verify_command' };
+  const prefixed = parseCdPrefix(cmd);
+  if (!prefixed.ok) return prefixed;
+  const tokenized = tokenizeVerifyCommand(prefixed.command);
+  if (!tokenized.ok) return tokenized;
+  const envParsed = parseLeadingEnv(tokenized.tokens);
+  if (!envParsed.ok) return envParsed;
+  const argv = envParsed.argv;
+  if (!argv.length || !safeVerifyArgv(argv)) {
     return { ok: false, reason: 'verify_command_not_allowed' };
   }
   const [bin, first, second] = argv;
@@ -216,10 +427,20 @@ function parseVerifyCommand(verify) {
       || (/^scripts\/[a-zA-Z0-9_./-]+$/.test(first || '') && safeNodePathArgs(argv.slice(1)))
     ))
     || (bin === 'tsc' && argv.length === 1)
+    // Mission verifiers use `test -s <artifact>`; accept the read-only
+    // file-check shapes so honest verifiers are recordable at review time.
+    || (bin === 'test' && argv.length === 3 && (first === '-s' || first === '-f') && safeRelativePathToken(second))
     || isAllowedAtrisCleanDryRun(argv)
-    || isAllowedGitDiffCheck(argv);
+    || isAllowedAtrisVerifyArtifact(argv)
+    || isAllowedGitDiffCheck(argv)
+    || isAllowedPythonCommand(argv);
   if (!allowed) return { ok: false, reason: 'verify_command_not_allowed' };
-  return { ok: true, argv };
+  return {
+    ok: true,
+    argv,
+    ...(prefixed.cwd ? { cwd: prefixed.cwd } : {}),
+    ...(Object.keys(envParsed.env).length ? { env: envParsed.env } : {}),
+  };
 }
 
 function isAutoCertifyVerifyCommandAllowed(verify) {
@@ -229,10 +450,15 @@ function isAutoCertifyVerifyCommandAllowed(verify) {
 function runVerifyCommand(verify, workspaceRoot) {
   const parsed = parseVerifyCommand(verify);
   if (!parsed.ok) return parsed;
-  const gitPathCheck = validateGitWorktreePath(parsed.argv, workspaceRoot);
+  const cwdCheck = validateCommandCwd(parsed, workspaceRoot);
+  if (!cwdCheck.ok) return cwdCheck;
+  const gitPathCheck = validateGitWorktreePath(parsed.argv, workspaceRoot, cwdCheck.cwd);
   if (!gitPathCheck.ok) return gitPathCheck;
+  const pythonPathCheck = validatePythonBinaryPath(parsed.argv, workspaceRoot, cwdCheck.cwd);
+  if (!pythonPathCheck.ok) return pythonPathCheck;
   const result = spawnSync(parsed.argv[0], parsed.argv.slice(1), {
-    cwd: workspaceRoot,
+    cwd: cwdCheck.cwd,
+    env: parsed.env ? { ...process.env, ...parsed.env } : process.env,
     shell: false,
     encoding: 'utf8',
     timeout: 120000,
@@ -245,6 +471,15 @@ function runVerifyCommand(verify, workspaceRoot) {
   };
 }
 
+function runVerifyCommandCached(verify, workspaceRoot, cache = null) {
+  if (!(cache instanceof Map)) return runVerifyCommand(verify, workspaceRoot);
+  const key = `${path.resolve(workspaceRoot || process.cwd())}\u0000${String(verify || '').trim()}`;
+  if (cache.has(key)) return { ...cache.get(key), reused: true };
+  const result = runVerifyCommand(verify, workspaceRoot);
+  cache.set(key, result);
+  return { ...result, reused: false };
+}
+
 function strictVerifyMissingResult(ref) {
   return {
     eligible: false,
@@ -255,12 +490,41 @@ function strictVerifyMissingResult(ref) {
   };
 }
 
+// Receipts named in the proof are read back before landing. A forced
+// completion or an explicitly failing receipt blocks auto-accept in every
+// policy; a proof that names no receipts is unaffected (absence of a check
+// does not block, same rule as verify commands).
+function receiptEvidenceBlock(task, ref) {
+  const evidence = extractReceiptEvidence(latestProof(task), task.workspace_root || process.cwd());
+  if (!evidence) return null;
+  if (evidence.any_forced) {
+    return { eligible: false, ref, reason: 'forced_completion_needs_human', evidence };
+  }
+  const failing = evidence.receipts.find((entry) => entry.verifier_passed === false);
+  if (failing) {
+    return { eligible: false, ref, reason: 'receipt_verifier_failed', receipt: failing.path, evidence };
+  }
+  return null;
+}
+
 function evaluateAutoAccept(task, options = {}) {
-  const { strictVerify = true, minPasses = AGENT_CERTIFICATION_REVIEW_PASSES, acceptAll = false } = options;
+  const {
+    strictVerify = true,
+    minPasses = AGENT_CERTIFICATION_REVIEW_PASSES,
+    acceptAll = false,
+    executeVerify = true,
+    verifyCache = null,
+  } = options;
   const ref = task.display_id || task.legacy_ref || task.id;
   if (task.status !== 'review') return { eligible: false, ref, reason: 'not_in_review' };
   const metadata = task.metadata || {};
   const review = task.review || {};
+  const trustTier = computeTrustTier(
+    task.claimed_by || metadata.executed_by,
+    task.workspace_root || process.cwd(),
+  );
+  const tierRequiresStrictVerify = trustTier !== 'trusted';
+  const requiresStrictVerify = strictVerify || tierRequiresStrictVerify;
   const approval = String(review.approval_status || metadata.approval_status || 'pending').toLowerCase();
   if (approval && approval !== 'pending' && approval !== 'agent_certified') {
     return { eligible: false, ref, reason: `approval_${approval}` };
@@ -285,18 +549,36 @@ function evaluateAutoAccept(task, options = {}) {
     if (proofHasUnmergedPullRequestBoundary(proof)) {
       return unmergedPullRequestBoundaryResult(ref, proof);
     }
+    const proofCheck = taskProofState(proof);
+    if (proofCheck.code === 'suite_green_citation_required') {
+      return {
+        eligible: false,
+        ref,
+        reason: proofCheck.reason,
+        proof_state: proofCheck.code,
+        proof,
+      };
+    }
+    const evidenceBlock = receiptEvidenceBlock(task, ref);
+    if (evidenceBlock) return evidenceBlock;
     const verify = metadata.verify;
-    if (verify) {
-      const verifyResult = runVerifyCommand(verify, task.workspace_root || process.cwd());
+    if (tierRequiresStrictVerify && !verify) return strictVerifyMissingResult(ref);
+    if (verify && executeVerify) {
+      const verifyResult = runVerifyCommandCached(verify, task.workspace_root || process.cwd(), verifyCache);
       // A check that runs and fails blocks. So does a check whose worktree
       // is gone — otherwise the daily reap converts "has a failing check"
       // into "lands unchecked" the morning after it clears the worktree.
       // A check that merely isn't in the runnable allowlist counts as no
       // check at all.
-      if (verifyResult.reason === 'verify_failed' || verifyResult.reason === 'verify_worktree_missing') {
+      if ((tierRequiresStrictVerify && !verifyResult.ok)
+        || verifyResult.reason === 'verify_failed'
+        || verifyResult.reason === 'verify_worktree_missing') {
         return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
       }
     }
+    if (trustTier === 'probation' && !reviewIntegrity.hasIndependentReview(task)) {
+      return { eligible: false, ref, reason: 'probation_needs_review' };
+    }
     return {
       eligible: true,
       ref,
@@ -304,6 +586,7 @@ function evaluateAutoAccept(task, options = {}) {
       passes: reviewPassCount(task),
       proof,
       policy: 'all_but_protected',
+      verification_pending: tierRequiresStrictVerify && Boolean(verify) && !executeVerify,
     };
   }
 
@@ -317,8 +600,18 @@ function evaluateAutoAccept(task, options = {}) {
     return unmergedPullRequestBoundaryResult(ref, proof);
   }
   const proofCheck = taskProofState(proof);
-  if (!proofCheck.ok) return { eligible: false, ref, reason: proofCheck.reason, proof };
-  if (!strictVerify) {
+  if (!proofCheck.ok) {
+    return {
+      eligible: false,
+      ref,
+      reason: proofCheck.reason,
+      proof_state: proofCheck.code || null,
+      proof,
+    };
+  }
+  const evidenceBlock = receiptEvidenceBlock(task, ref);
+  if (evidenceBlock) return evidenceBlock;
+  if (!requiresStrictVerify) {
     const executionCheck = taskProofExecutionState(proof);
     if (!executionCheck.ok) {
       return {
@@ -326,7 +619,7 @@ function evaluateAutoAccept(task, options = {}) {
         ref,
         reason: executionCheck.reason,
         detail: executionCheck.detail,
-        next_action: 'run an allowed verifier with `atris task ready --verify` or keep strict auto-accept enabled so the verifier executes before landing',
+        next_action: 'run an allowed verifier with `atris task ready --verify "<cmd>" --result "<day-one PM sentence>"` or keep strict auto-accept enabled so the verifier executes before landing',
         proof,
       };
     }
@@ -337,31 +630,34 @@ function evaluateAutoAccept(task, options = {}) {
     return {
       eligible: false,
       ref,
-      reason: 'needs_independent_reviewer',
+      reason: trustTier === 'probation' ? 'probation_needs_review' : 'needs_independent_reviewer',
       passes,
       builder: reviewIntegrity.taskBuilder(task),
       actors: [...actors],
     };
   }
 
-  if (strictVerify) {
+  if (requiresStrictVerify) {
     const verify = metadata.verify;
     if (!verify) return strictVerifyMissingResult(ref);
-    const workspaceRoot = task.workspace_root || process.cwd();
-    const verifyResult = runVerifyCommand(verify, workspaceRoot);
-    if (!verifyResult.ok) {
-      return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
+    if (executeVerify) {
+      const workspaceRoot = task.workspace_root || process.cwd();
+      const verifyResult = runVerifyCommandCached(verify, workspaceRoot, verifyCache);
+      if (!verifyResult.ok) {
+        return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
+      }
     }
   }
 
   return {
     eligible: true,
     ref,
-    reason: strictVerify ? 'certified_strict_verify' : 'certified_independent_review',
+    reason: requiresStrictVerify ? 'certified_strict_verify' : 'certified_independent_review',
     passes,
     actors: [...actors],
     proof,
-    policy: strictVerify ? 'strict_verify' : 'independent_reviewer',
+    policy: requiresStrictVerify ? 'strict_verify' : 'independent_reviewer',
+    verification_pending: requiresStrictVerify && !executeVerify,
   };
 }
 
@@ -374,4 +670,5 @@ module.exports = {
   isAgentCertified,
   parseVerifyCommand,
   runVerifyCommand,
+  runVerifyCommandCached,
 };