atris 3.35.0 → 3.37.0

package/lib/zip.js

@@ -0,0 +1,221 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+
+const LOCAL_FILE_HEADER = 0x04034b50;
+const CENTRAL_DIRECTORY_HEADER = 0x02014b50;
+const END_OF_CENTRAL_DIRECTORY = 0x06054b50;
+const UTF8_FLAG = 0x0800;
+const DEFLATE = 8;
+const STORE = 0;
+
+let crcTable = null;
+
+function getCrcTable() {
+  if (crcTable) return crcTable;
+  crcTable = new Uint32Array(256);
+  for (let i = 0; i < 256; i += 1) {
+    let c = i;
+    for (let j = 0; j < 8; j += 1) {
+      c = (c & 1) ? (0xedb88320 ^ (c >>> 1)) : (c >>> 1);
+    }
+    crcTable[i] = c >>> 0;
+  }
+  return crcTable;
+}
+
+function crc32(data) {
+  const table = getCrcTable();
+  const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data || '');
+  let crc = 0xffffffff;
+  for (const byte of buffer) {
+    crc = table[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function dosDateTime(dateValue) {
+  const date = dateValue instanceof Date && Number.isFinite(dateValue.getTime())
+    ? dateValue
+    : new Date();
+  const year = Math.max(1980, Math.min(2107, date.getFullYear()));
+  const month = date.getMonth() + 1;
+  const day = date.getDate();
+  const hours = date.getHours();
+  const minutes = date.getMinutes();
+  const seconds = Math.floor(date.getSeconds() / 2);
+  return {
+    date: ((year - 1980) << 9) | (month << 5) | day,
+    time: (hours << 11) | (minutes << 5) | seconds,
+  };
+}
+
+function normalizeEntryName(name) {
+  return String(name || '').replace(/\\/g, '/');
+}
+
+function assertUInt32(value, label) {
+  if (!Number.isFinite(value) || value < 0 || value > 0xffffffff) {
+    throw new Error(`zip ${label} is too large`);
+  }
+}
+
+function createZipBuffer(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const name = normalizeEntryName(entry.name);
+    if (!name) throw new Error('zip entry name is required');
+    const nameBuffer = Buffer.from(name, 'utf8');
+    const data = Buffer.isBuffer(entry.data) ? entry.data : Buffer.from(entry.data || '');
+    const compressed = zlib.deflateRawSync(data);
+    const crc = crc32(data);
+    const { date, time } = dosDateTime(entry.mtime);
+
+    assertUInt32(data.length, 'entry');
+    assertUInt32(compressed.length, 'compressed entry');
+    assertUInt32(offset, 'offset');
+
+    const localHeader = Buffer.alloc(30);
+    localHeader.writeUInt32LE(LOCAL_FILE_HEADER, 0);
+    localHeader.writeUInt16LE(20, 4);
+    localHeader.writeUInt16LE(UTF8_FLAG, 6);
+    localHeader.writeUInt16LE(DEFLATE, 8);
+    localHeader.writeUInt16LE(time, 10);
+    localHeader.writeUInt16LE(date, 12);
+    localHeader.writeUInt32LE(crc, 14);
+    localHeader.writeUInt32LE(compressed.length, 18);
+    localHeader.writeUInt32LE(data.length, 22);
+    localHeader.writeUInt16LE(nameBuffer.length, 26);
+    localHeader.writeUInt16LE(0, 28);
+    localParts.push(localHeader, nameBuffer, compressed);
+
+    const centralHeader = Buffer.alloc(46);
+    centralHeader.writeUInt32LE(CENTRAL_DIRECTORY_HEADER, 0);
+    centralHeader.writeUInt16LE(20, 4);
+    centralHeader.writeUInt16LE(20, 6);
+    centralHeader.writeUInt16LE(UTF8_FLAG, 8);
+    centralHeader.writeUInt16LE(DEFLATE, 10);
+    centralHeader.writeUInt16LE(time, 12);
+    centralHeader.writeUInt16LE(date, 14);
+    centralHeader.writeUInt32LE(crc, 16);
+    centralHeader.writeUInt32LE(compressed.length, 20);
+    centralHeader.writeUInt32LE(data.length, 24);
+    centralHeader.writeUInt16LE(nameBuffer.length, 28);
+    centralHeader.writeUInt16LE(0, 30);
+    centralHeader.writeUInt16LE(0, 32);
+    centralHeader.writeUInt16LE(0, 34);
+    centralHeader.writeUInt16LE(0, 36);
+    centralHeader.writeUInt32LE(0, 38);
+    centralHeader.writeUInt32LE(offset, 42);
+    centralParts.push(centralHeader, nameBuffer);
+
+    offset += localHeader.length + nameBuffer.length + compressed.length;
+  }
+
+  const centralOffset = offset;
+  const centralSize = centralParts.reduce((sum, part) => sum + part.length, 0);
+  assertUInt32(centralOffset, 'central directory offset');
+  assertUInt32(centralSize, 'central directory');
+  if (entries.length > 0xffff) throw new Error('zip has too many entries');
+
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(END_OF_CENTRAL_DIRECTORY, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralSize, 12);
+  end.writeUInt32LE(centralOffset, 16);
+  end.writeUInt16LE(0, 20);
+
+  return Buffer.concat([...localParts, ...centralParts, end]);
+}
+
+function writeZipFile(filePath, entries) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, createZipBuffer(entries));
+}
+
+function findEndOfCentralDirectory(buffer) {
+  const start = Math.max(0, buffer.length - 22 - 0xffff);
+  for (let i = buffer.length - 22; i >= start; i -= 1) {
+    if (buffer.readUInt32LE(i) === END_OF_CENTRAL_DIRECTORY) return i;
+  }
+  throw new Error('invalid zip: missing central directory');
+}
+
+function assertReadable(buffer, offset, length, label) {
+  if (offset < 0 || length < 0 || offset + length > buffer.length) {
+    throw new Error(`invalid zip: truncated ${label}`);
+  }
+}
+
+function readZipBuffer(input) {
+  const buffer = Buffer.isBuffer(input) ? input : Buffer.from(input);
+  const endOffset = findEndOfCentralDirectory(buffer);
+  const entryCount = buffer.readUInt16LE(endOffset + 10);
+  const centralSize = buffer.readUInt32LE(endOffset + 12);
+  const centralOffset = buffer.readUInt32LE(endOffset + 16);
+  assertReadable(buffer, centralOffset, centralSize, 'central directory');
+
+  const entries = [];
+  let cursor = centralOffset;
+  for (let i = 0; i < entryCount; i += 1) {
+    assertReadable(buffer, cursor, 46, 'central directory entry');
+    if (buffer.readUInt32LE(cursor) !== CENTRAL_DIRECTORY_HEADER) {
+      throw new Error('invalid zip: malformed central directory');
+    }
+
+    const flags = buffer.readUInt16LE(cursor + 8);
+    const method = buffer.readUInt16LE(cursor + 10);
+    const compressedSize = buffer.readUInt32LE(cursor + 20);
+    const uncompressedSize = buffer.readUInt32LE(cursor + 24);
+    const nameLength = buffer.readUInt16LE(cursor + 28);
+    const extraLength = buffer.readUInt16LE(cursor + 30);
+    const commentLength = buffer.readUInt16LE(cursor + 32);
+    const localOffset = buffer.readUInt32LE(cursor + 42);
+    const nameStart = cursor + 46;
+    assertReadable(buffer, nameStart, nameLength + extraLength + commentLength, 'central directory name');
+    const name = buffer.slice(nameStart, nameStart + nameLength).toString('utf8');
+    cursor = nameStart + nameLength + extraLength + commentLength;
+
+    if (flags & 1) throw new Error(`invalid zip: encrypted entry ${name} is not supported`);
+    if (![STORE, DEFLATE].includes(method)) {
+      throw new Error(`invalid zip: unsupported compression method ${method} for ${name}`);
+    }
+
+    assertReadable(buffer, localOffset, 30, 'local file header');
+    if (buffer.readUInt32LE(localOffset) !== LOCAL_FILE_HEADER) {
+      throw new Error(`invalid zip: missing local header for ${name}`);
+    }
+    const localNameLength = buffer.readUInt16LE(localOffset + 26);
+    const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+    const dataStart = localOffset + 30 + localNameLength + localExtraLength;
+    assertReadable(buffer, dataStart, compressedSize, `file data for ${name}`);
+    const compressed = buffer.slice(dataStart, dataStart + compressedSize);
+    const data = method === STORE ? Buffer.from(compressed) : zlib.inflateRawSync(compressed);
+    if (data.length !== uncompressedSize) {
+      throw new Error(`invalid zip: size mismatch for ${name}`);
+    }
+    entries.push({ name, data });
+  }
+
+  return entries;
+}
+
+function readZipFile(filePath) {
+  return readZipBuffer(fs.readFileSync(filePath));
+}
+
+module.exports = {
+  createZipBuffer,
+  writeZipFile,
+  readZipBuffer,
+  readZipFile,
+  crc32,
+};

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "atris",
-  "version": "3.35.0",
+  "version": "3.37.0",
+  "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {
     "atris": "bin/atris.js",
@@ -54,6 +55,7 @@
   ],
   "scripts": {
     "test": "node --test",
+    "test:fast": "xargs node --test < test/fast-tests.txt",
     "lint:decks": "node scripts/lint-all-decks.js",
     "publish:release": "node scripts/publish-atris-release.js",
     "prepare": "cp scripts/pre-commit .git/hooks/pre-commit 2>/dev/null && cp scripts/commit-msg .git/hooks/commit-msg 2>/dev/null && cp scripts/prepare-commit-msg .git/hooks/prepare-commit-msg 2>/dev/null && chmod +x .git/hooks/pre-commit .git/hooks/commit-msg .git/hooks/prepare-commit-msg || true"

package/templates/loops/atris/loops/LOOPS.md

@@ -0,0 +1,55 @@
+# The Loops
+
+**Boot phrase:** "atris loops" or "run the loops" - audits every loop file live,
+routes every open loop back to an owner, and keeps the product improving from proof
+instead of memory.
+
+Missions are point-in-time. Loops are forever. A loop owns one thing that must always
+work and always improve, names the signal that proves it, and feeds the loops
+downstream of it. Every mission dispatched in this project should name the loop it
+serves; a mission that serves no loop is probably make-work.
+
+Each loop file follows the same contract, enforced by `atris loops audit`:
+
+- **Owner** - the `team/<member>` accountable for the loop.
+- **Wiki** - the knowledge page that keeps the loop context alive across sessions.
+- **Runner** - the named thing that executes the signal: script, CI, mission, tick.
+- **Protects** - the user-felt thing that must never break.
+- **Signal** - the receipt that proves it. Green is an exit code or a number, not vibes.
+- **Check** - optional shell command run by `atris loops audit`.
+- **Cadence** - when the loop runs: per-commit, per-tick, nightly, weekly.
+- **Feeds / Fed by** - the loop graph. No loop is an island.
+
+## The Starter Loops
+
+| # | Loop | Protects | Signal |
+|---|------|----------|--------|
+| 1 | [feedback](feedback.md) | user pain becomes tracked work | TODO: intake count, queue check, or triage command |
+| 2 | [quality](quality.md) | changes do not regress trust | TODO: test, lint, audit, or review gate |
+
+## The Graph
+
+```text
+users
+  |
+  v
+[feedback] ---- pain becomes tasks ----+
+  |                                    |
+  v                                    v
+[quality] <--------- fixes, reviews, receipts
+```
+
+Reading the graph: feedback is the intake. Quality is the ratchet. Feedback discovers
+breaks and turns them into work; quality proves the work made the project tighter.
+
+## Learning Rule
+
+Every error that reaches a loop exits as a dated line in that loop's **Log** before the
+work closes. The loop file is the owner member's training data: a class of error is
+allowed to happen once per lesson.
+
+## Operating Rule
+
+One tick = run `atris loops audit`, pick the first open loop, run or fix its signal,
+re-run the audit, and append a dated Log line with the receipt. When every loop is
+green, raise one bar instead of idling.

package/templates/loops/atris/loops/TICK.md

@@ -0,0 +1,24 @@
+# The Tick - loop protocol for ANY model
+
+This is the minimum viable evolutionary state of the project. Any agent can run this
+exactly. No step is optional, and no step requires guessing from memory.
+
+## The Tick
+
+1. `atris loops audit` - this is the source of truth. Never assess loop health from
+   prose, memory, or vibes.
+2. Pick the first open loop. If several are open, take the first listed.
+3. Do exactly what the loop's signal or Check says. Stay inside that loop's surface;
+   do not refactor unrelated files.
+4. `atris loops audit` again. The selected loop must improve or the failure must be
+   made explicit.
+5. Append one dated line to `## Log` in `atris/loops/<loop>.md`: what was open, what
+   changed, and the receipt command plus exit code.
+6. Move the owning task to proof-ready, or land according to this repo's policy.
+
+## Truth Rules
+
+- Claim green only by pasting the re-run audit output.
+- Never edit loop files, baselines, or checks to hide a failing signal.
+- If you cannot fix the first open loop, write why as a dated Log line and stop.
+- If all loops are green, tighten one signal so the system keeps improving.

package/templates/loops/atris/loops/feedback.md

@@ -0,0 +1,22 @@
+# Loop - Feedback
+
+**Owner:** `team/TODO-feedback-owner`
+**Wiki:** [systems/loops.md](../wiki/systems/loops.md) TODO: replace or extend with the owner context page.
+**Runner:** TODO: name the intake command, CI job, mission, or wake tick that owns this loop.
+
+**Protects:** TODO: every user pain, bug report, or operator note becomes tracked work
+or an explicit no-op decision.
+
+**Signal (green =):** TODO: define a numeric or exit-code signal, for example open
+feedback count, stale inbox count, or a triage command that exits 0.
+
+**Check:** `true`
+
+**Cadence:** TODO: per tick, daily, weekly, or per release.
+
+**Feeds:** quality.
+**Fed by:** users, support, operators, telemetry.
+
+## Log
+
+- {{DATE}}: TODO: first loop scaffold created; replace this line with the first real receipt.

package/templates/loops/atris/loops/quality.md

@@ -0,0 +1,22 @@
+# Loop - Quality
+
+**Owner:** `team/TODO-quality-owner`
+**Wiki:** [systems/loops.md](../wiki/systems/loops.md) TODO: replace or extend with the owner context page.
+**Runner:** TODO: name the test, audit, review lane, CI job, or mission that owns this loop.
+
+**Protects:** TODO: shipped changes do not make the project harder to trust, operate,
+or understand.
+
+**Signal (green =):** TODO: define the receipt, for example a focused test, lint,
+review gate, smoke check, or quality score with a threshold.
+
+**Check:** `true`
+
+**Cadence:** TODO: per commit, per PR, daily, or before release.
+
+**Feeds:** feedback, release confidence, owner trust.
+**Fed by:** feedback, reviews, incidents, failed checks.
+
+## Log
+
+- {{DATE}}: TODO: first loop scaffold created; replace this line with the first real receipt.

package/templates/loops/atris/wiki/systems/loops.md

@@ -0,0 +1,41 @@
+# The Loop System - how this project improves itself
+
+A loop owns one user-felt thing that must never break, names the receipt that proves it,
+has a team member accountable for it, and feeds the loops downstream. Missions are
+point-in-time; loops are forever. Source of truth: `atris/loops/LOOPS.md`.
+
+## The Closure Contract
+
+A loop is **closed** when all five hold; a project where every loop is closed is
+**self-improving**: breaks discover themselves, route to an owner, and land as fixes
+without waiting for a human to notice first.
+
+1. **Owner** - a `team/<member>/` directory exists. Someone wakes for it.
+2. **Wiki** - a knowledge page resolves, so context survives sessions.
+3. **Runner** - the named thing executes the signal: script, CI job, mission, or tick.
+4. **Signal** - green is an exit code or number, never vibes.
+5. **Fresh log** - a dated receipt in the loop file is newer than 14 days.
+
+`atris loops audit` enforces this contract and prints the self-improving verdict. If a
+loop file has `**Check:** \`<command>\``, the audit runs that command from the project
+root and reports its exit code.
+
+## Starter Owner Map
+
+| # | Loop | Owner | Runner class |
+|---|------|-------|--------------|
+| 1 | feedback | TODO-feedback-owner | TODO intake command, mission, or wake tick |
+| 2 | quality | TODO-quality-owner | TODO test, audit, review lane, or CI job |
+
+## Known Open Edges
+
+- Replace TODO owners with real `team/<member>/` directories.
+- Replace TODO runners with real commands or missions.
+- Replace `true` starter checks with project-native proof commands.
+- Add loops only when they protect a real user-felt thing.
+
+## Learning Rule
+
+An error closes only by becoming a dated Log line in its owning loop, with a receipt.
+Members wake with their loop file, this wiki, and recent receipts in context. Each
+lesson removes a class of error; the loop audit makes the next tick cheap.

package/utils/api.js

@@ -25,7 +25,11 @@ const DEFAULT_USER_AGENT = `${DEFAULT_CLIENT_ID} (node ${process.version}; ${os.
  * @returns {string} API base URL
  */
 function getApiBaseUrl() {
-  const raw = process.env.ATRIS_API_URL || 'https://api.atris.ai/api';
+  const backend = process.env.ATRIS_BACKEND_URL
+    ? process.env.ATRIS_BACKEND_URL.replace(/\/+$/, '')
+    : '';
+  const raw = process.env.ATRIS_API_URL
+    || (backend ? (backend.endsWith('/api') ? backend : `${backend}/api`) : 'https://api.atris.ai/api');
   return raw.replace(/\/$/, '');
 }
 

package/utils/auth.js

@@ -139,13 +139,25 @@ function shouldRefreshToken(token, bufferSeconds = TOKEN_REFRESH_BUFFER_SECONDS)
 }
 
 // Credentials management
+
+// Create a directory owner-only (0o700). Under the default umask (0o022) a bare
+// recursive mkdir yields 0o755, leaving ~/.atris and its profiles/sessions
+// world-traversable so any local user can enumerate tokens and workspace ids.
+function mkPrivateDir(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+  try {
+    fs.chmodSync(dir, 0o700);
+  } catch {
+    // Best effort: permissions may be unsupported on this platform.
+  }
+  return dir;
+}
+
 function getAtrisDir() {
   const homeDir = os.homedir();
-  const atrisDir = path.join(homeDir, '.atris');
-  if (!fs.existsSync(atrisDir)) {
-    fs.mkdirSync(atrisDir, { recursive: true });
-  }
-  return atrisDir;
+  return mkPrivateDir(path.join(homeDir, '.atris'));
 }
 
 function getCredentialsPath() {
@@ -153,11 +165,7 @@ function getCredentialsPath() {
 }
 
 function getSessionsDir() {
-  const dir = path.join(getAtrisDir(), 'sessions');
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  return dir;
+  return mkPrivateDir(path.join(getAtrisDir(), 'sessions'));
 }
 
 function getTerminalSessionId() {
@@ -248,11 +256,7 @@ function cleanStaleSessions() {
 }
 
 function getProfilesDir() {
-  const dir = path.join(getAtrisDir(), 'profiles');
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  return dir;
+  return mkPrivateDir(path.join(getAtrisDir(), 'profiles'));
 }
 
 function profileNameFromEmail(email) {
@@ -342,7 +346,7 @@ function loadCredentials() {
   const profileOverride = process.env.ATRIS_PROFILE;
   if (profileOverride) {
     const profile = loadProfile(profileOverride);
-    if (profile) return profile;
+    if (profile) return { ...profile, source_profile: profileOverride };
     const profiles = listProfiles();
     const q = profileOverride.toLowerCase();
     const match = profiles.find(p => p.toLowerCase() === q)
@@ -350,7 +354,7 @@ function loadCredentials() {
       || profiles.find(p => p.toLowerCase().includes(q));
     if (match) {
       const matched = loadProfile(match);
-      if (matched) return matched;
+      if (matched) return { ...matched, source_profile: match };
     }
   }
 
@@ -358,7 +362,7 @@ function loadCredentials() {
   const sessionProfile = getSessionProfile();
   if (sessionProfile) {
     const profile = loadProfile(sessionProfile);
-    if (profile) return profile;
+    if (profile) return { ...profile, source_profile: sessionProfile };
   }
 
   // 3. Global credentials.json
@@ -438,7 +442,27 @@ async function performTokenRefresh(credentials, apiRequestJson) {
   const email = refreshUser?.email || credentials.email;
   const userId = refreshUser?.id || credentials.user_id;
 
-  saveCredentials(accessToken, newRefreshToken, email, userId, provider);
+  // Refreshed tokens must land in the file they were loaded from. Writing a
+  // profile's refresh to the global credentials.json leaves the profile token
+  // to expire permanently (every ATRIS_PROFILE session then 401s forever).
+  const persistRefreshed = () => {
+    if (credentials.source_profile) {
+      const { source_profile, source, ...rest } = { ...credentials };
+      saveProfile(credentials.source_profile, {
+        ...rest,
+        token: accessToken,
+        refresh_token: newRefreshToken,
+        email,
+        user_id: userId,
+        provider,
+        saved_at: new Date().toISOString(),
+      });
+    } else {
+      saveCredentials(accessToken, newRefreshToken, email, userId, provider);
+    }
+  };
+
+  persistRefreshed();
   let latestCreds = loadCredentials();
 
   const validation = await validateAccessToken(accessToken, apiRequestJson);
@@ -456,7 +480,20 @@ async function performTokenRefresh(credentials, apiRequestJson) {
       updatedProvider !== latestCreds.provider ||
       updatedUserId !== latestCreds.user_id
     ) {
-      saveCredentials(accessToken, newRefreshToken, updatedEmail, updatedUserId, updatedProvider);
+      if (credentials.source_profile) {
+        const { source_profile, source, ...rest } = { ...credentials };
+        saveProfile(credentials.source_profile, {
+          ...rest,
+          token: accessToken,
+          refresh_token: newRefreshToken,
+          email: updatedEmail,
+          user_id: updatedUserId,
+          provider: updatedProvider,
+          saved_at: new Date().toISOString(),
+        });
+      } else {
+        saveCredentials(accessToken, newRefreshToken, updatedEmail, updatedUserId, updatedProvider);
+      }
       latestCreds = loadCredentials();
     }
   }
@@ -568,7 +605,6 @@ async function displayAccountSummary(apiRequestJson) {
   console.log(`User ID: ${userId}`);
   console.log(`Provider: ${provider}`);
   console.log(`Credentials saved: ${savedAt}`);
-  console.log(`Credential file: ${getCredentialsPath()}`);
 
   try {
     const agentsResponse = await fetchMyAgents(credentials.token, apiRequestJson);