atris 3.37.1 → 3.40.0

package/lib/lesson-preflight.js

@@ -0,0 +1,146 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ACTIVE_STATUSES = new Set(['observed', 'open', 'attempted']);
+const KEYWORD_STOP_WORDS = new Set([
+  'and', 'are', 'for', 'from', 'into', 'not', 'of', 'on', 'or', 'the', 'this', 'to', 'with', 'without',
+]);
+
+function readJson(filePath) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function readLessonText(filePath) {
+  let content = '';
+  try {
+    content = fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return new Map();
+  }
+
+  const bySlug = new Map();
+  for (const line of content.split(/\r?\n/)) {
+    const match = line.match(/^\s*-\s*\*\*\[([^\]]+)\]\s*([a-z0-9][a-z0-9-]*)\*\*\s*[—:-]+\s*(?:pass|fail)?\s*[—:-]*\s*(.*)$/i);
+    if (!match || bySlug.has(match[2])) continue;
+    const text = match[3].replace(/^\[resolved\]\s*/i, '').trim();
+    if (text) bySlug.set(match[2], text);
+  }
+  return bySlug;
+}
+
+function isPromptRule(mechanism) {
+  if (mechanism && typeof mechanism === 'object') {
+    const kind = String(mechanism.type || mechanism.kind || '').toLowerCase();
+    return kind === 'prompt-rule' || kind === 'prompt_rule' || mechanism.prompt_rule === true;
+  }
+  return /^\s*prompt[-_\s]?rule\b/i.test(String(mechanism || ''));
+}
+
+function lessonIsEligible(lesson) {
+  const status = String(lesson && lesson.status || '').toLowerCase();
+  if (ACTIVE_STATUSES.has(status)) return true;
+  return status === 'resolved' && isPromptRule(lesson.mechanism);
+}
+
+function normalizeFile(file) {
+  return String(file || '')
+    .trim()
+    .replace(/\\/g, '/')
+    .replace(/^\.\//, '')
+    .replace(/\/{2,}/g, '/')
+    .replace(/\/$/, '');
+}
+
+function pathSpecificity(file) {
+  const normalized = normalizeFile(file);
+  const segments = normalized.split('/').filter(Boolean).length;
+  return (segments * 100) + normalized.length;
+}
+
+function overlapStrength(appliesTo, file) {
+  const lessonPath = normalizeFile(appliesTo).toLowerCase();
+  const taskPath = normalizeFile(file).toLowerCase();
+  if (!lessonPath || !taskPath) return 0;
+  if (lessonPath === taskPath) return 3;
+  if (taskPath.endsWith(`/${lessonPath}`) || lessonPath.endsWith(`/${taskPath}`)) return 3;
+  if (taskPath.startsWith(`${lessonPath}/`) || lessonPath.startsWith(`${taskPath}/`)) return 2;
+  return 0;
+}
+
+function slugKeywords(slug) {
+  return [...new Set(String(slug || '').toLowerCase().split(/[^a-z0-9]+/)
+    .filter((word) => word.length >= 3 && !KEYWORD_STOP_WORDS.has(word)))];
+}
+
+function keywordAppears(text, keyword) {
+  const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(^|[^a-z0-9])${escaped}([^a-z0-9]|$)`, 'i').test(text);
+}
+
+function bestMatch({ slug, lesson, briefText, files }) {
+  const brief = String(briefText || '');
+  const briefLower = brief.toLowerCase().replace(/\\/g, '/');
+  const appliesTo = Array.isArray(lesson.applies_to) ? lesson.applies_to : [];
+  let best = null;
+
+  for (const lessonFile of appliesTo) {
+    const normalizedLessonFile = normalizeFile(lessonFile);
+    if (!normalizedLessonFile) continue;
+    for (const taskFile of files) {
+      const strength = overlapStrength(normalizedLessonFile, taskFile);
+      if (!strength) continue;
+      const score = 300000 + (strength * 10000) + pathSpecificity(normalizedLessonFile) - appliesTo.length;
+      if (!best || score > best.score) {
+        best = { score, why: `file overlaps ${normalizedLessonFile}` };
+      }
+    }
+    if (briefLower.includes(normalizedLessonFile.toLowerCase())) {
+      const score = 200000 + pathSpecificity(normalizedLessonFile) - appliesTo.length;
+      if (!best || score > best.score) {
+        best = { score, why: `brief mentions ${normalizedLessonFile}` };
+      }
+    }
+  }
+
+  const matchedKeywords = slugKeywords(slug).filter((keyword) => keywordAppears(brief, keyword));
+  if (matchedKeywords.length) {
+    const keywordLength = matchedKeywords.reduce((total, keyword) => total + keyword.length, 0);
+    const score = 100000 + (matchedKeywords.length * 1000) + keywordLength;
+    if (!best || score > best.score) {
+      best = { score, why: `brief mentions ${matchedKeywords.join(', ')}` };
+    }
+  }
+
+  return best;
+}
+
+function matchLessons({ briefText = '', files = [], root = process.cwd() } = {}) {
+  const metadata = readJson(path.join(root, 'atris', 'lessons.json'));
+  const lessonText = readLessonText(path.join(root, 'atris', 'lessons.md'));
+  const normalizedFiles = (Array.isArray(files) ? files : [files]).map(normalizeFile).filter(Boolean);
+  const matches = [];
+
+  for (const [slug, lesson] of Object.entries(metadata)) {
+    if (slug === '_schema' || !lesson || typeof lesson !== 'object') continue;
+    if (!lessonIsEligible(lesson)) continue;
+    const text = lessonText.get(slug);
+    if (!text) continue;
+    const matched = bestMatch({ slug, lesson, briefText, files: normalizedFiles });
+    if (!matched) continue;
+    matches.push({ slug, text, why_matched: matched.why, score: matched.score });
+  }
+
+  return matches
+    .sort((left, right) => right.score - left.score || left.slug.localeCompare(right.slug))
+    .slice(0, 5)
+    .map(({ slug, text, why_matched }) => ({ slug, text, why_matched }));
+}
+
+module.exports = { matchLessons };

package/lib/loop-doctor.js

@@ -20,8 +20,6 @@ const HEADLESS_CAPABLE_RUNNERS = new Set([
   'codex',
   'cursor',
   'devin',
-  'hermes',
-  'hermes-agent',
 ]);
 const FINDING_PRIORITY = {
   repeated_auth_failure: 500,
@@ -311,7 +309,7 @@ function missionLockPidAlive(pid) {
   }
 }
 
-function staleMissionLockFinding(root, nowIso, pidAlive = missionLockPidAlive) {
+function missionLockRecords(root, pidAlive = missionLockPidAlive) {
   const stateDir = path.join(root, '.atris', 'state');
   let names = [];
   try {
@@ -319,18 +317,21 @@ function staleMissionLockFinding(root, nowIso, pidAlive = missionLockPidAlive) {
   } catch {
     return [];
   }
-  const stale = [];
-  for (const name of names) {
+  return names.map((name) => {
     const file = path.join(stateDir, name);
     let lock = null;
     try { lock = JSON.parse(fs.readFileSync(file, 'utf8')); } catch {}
     const pid = Number(lock && lock.pid);
     if (!Number.isInteger(pid) || pid <= 0) {
-      stale.push({ lock: name, reason: 'unparseable', pid: null });
-    } else if (!pidAlive(pid)) {
-      stale.push({ lock: name, reason: 'dead-pid', pid });
+      return { lock: name, reason: 'unparseable', pid: null, stale: true };
     }
-  }
+    const alive = pidAlive(pid);
+    return { lock: name, reason: alive ? 'live-pid' : 'dead-pid', pid, stale: !alive };
+  });
+}
+
+function staleMissionLockFinding(root, nowIso, pidAlive = missionLockPidAlive) {
+  const stale = missionLockRecords(root, pidAlive).filter((lock) => lock.stale);
   if (!stale.length) return [];
   return [{
     kind: 'stale_mission_lock',
@@ -400,17 +401,8 @@ function scanLoopReceipts({ root = process.cwd(), now = new Date(), freshnessMs
 
 module.exports = {
   scanLoopReceipts,
-  repeatedFailureFindings,
-  authFailureFindings,
-  rewardFlatlineFinding,
-  zeroDueCapableFinding,
-  staleMissionLockFinding,
-  isDueCapableMission,
+  missionLockRecords,
   latestMissionRecords,
-  orderFindings,
   nonPositiveRewardPressure,
-  applyRewardPressure,
   FINDING_PRIORITY,
-  DEFAULT_RECEIPT_LIMIT,
-  DEFAULT_FINDING_FRESHNESS_MS,
 };

package/lib/manifest.js

@@ -251,9 +251,7 @@ module.exports = {
   buildManifest,
   computeLocalHashes,
   threeWayCompare,
-  getManifestPath,
   SKIP_DIRS,
   isIgnoredSyncPath,
   filterSyncFiles,
-  isSyncTextBuffer,
 };

package/lib/member-alive.js

@@ -227,6 +227,5 @@ function runAliveTick(name, opts = {}) {
 
 module.exports = {
   runAliveTick,
-  resolveMemberOperateScript,
   resolveAtrisBin,
 };

package/lib/member-switches.js

@@ -129,14 +129,9 @@ function memberArgFromArgv(argv = process.argv) {
 }
 
 module.exports = {
-  SWITCHES_REL,
-  switchesPath,
-  loadMemberSwitches,
-  saveMemberSwitches,
   isLocalMember,
   getMemberSwitch,
   isMemberAwake,
-  isMemberLoopAwake,
   setMemberAwake,
   setMemberLoopAwake,
   readLoopFlag,

package/lib/mission-artifact.js

@@ -498,7 +498,6 @@ function writeMissionArtifact(mission, options = {}) {
 }
 
 module.exports = {
-  buildMissionArtifactBlocks,
   missionArtifactPaths,
   writeMissionArtifact,
 };

package/lib/mission-human-asks.js

@@ -0,0 +1,28 @@
+'use strict';
+
+function normalizeHumanAsk(ask) {
+  if (typeof ask === 'string') {
+    return { text: ask, answered_at: null };
+  }
+  if (!ask || typeof ask !== 'object' || Array.isArray(ask)) {
+    return { text: String(ask || ''), answered_at: null };
+  }
+  return {
+    ...ask,
+    text: String(ask.text || ''),
+    answered_at: ask.answered_at || null,
+  };
+}
+
+function normalizeHumanAsks(asks) {
+  return Array.isArray(asks) ? asks.map(normalizeHumanAsk) : [];
+}
+
+function openHumanAsks(asks) {
+  return normalizeHumanAsks(asks).filter((ask) => ask.text.trim() && !ask.answered_at);
+}
+
+module.exports = {
+  normalizeHumanAsks,
+  openHumanAsks,
+};

package/lib/mission-protected-lane.js

@@ -0,0 +1,296 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { DENIED_TAGS } = require('./fleet');
+
+const PATH_SURFACES = [
+  ['middleware/proxy', /(?:^|[/_.-])(?:middleware|proxy)(?:[/_.-]|$)/i],
+  ['csp', /(?:^|[/_.-])csp(?:[/_.-]|$)/i],
+  ['auth', /(?:^|[/_.-])auth(?:entication|orization)?(?:[/_.-]|$)/i],
+  ['session', /(?:^|[/_.-])sessions?(?:[/_.-]|$)/i],
+  ['cookie', /(?:^|[/_.-])cookies?(?:[/_.-]|$)/i],
+  ['cors', /(?:^|[/_.-])cors(?:[/_.-]|$)/i],
+  ['sandbox', /(?:^|[/_.-])sandbox(?:[/_.-]|$)/i],
+  ['permission', /(?:^|[/_.-])permissions?(?:[/_.-]|$)/i],
+];
+
+const CONTENT_SURFACES = [
+  ['csp', /\bContent-Security-Policy\b/i],
+  ['csp nonce', /\bnonce\b/i],
+  ['iframe sandbox', /\bsandbox\s*=/i],
+  ['cookie', /\bSet-Cookie\b/i],
+  ['cors', /\bAccess-Control-Allow-[A-Za-z-]+\b/i],
+  ['public dynamic rendering', /\bforce-dynamic\b/i],
+  ['auth header', /\b(?:Authorization\s*[:=].*\bBearer\b|headers?\b[^\n]*\bauthorization\b|\bauthorization\b[^\n]*headers?\b)/i],
+];
+
+function normalizedTags(tags) {
+  const list = Array.isArray(tags) ? tags : [tags];
+  return list
+    .flatMap((tag) => String(tag || '').split(','))
+    .map((tag) => tag.trim().toLowerCase().replace(/_/g, '-'))
+    .filter(Boolean);
+}
+
+function changedPathsFromDiff(diff) {
+  const paths = [];
+  for (const line of String(diff || '').split(/\r?\n/)) {
+    const header = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+    if (header) {
+      paths.push(header[1], header[2]);
+      continue;
+    }
+    const file = line.match(/^(?:---|\+\+\+) (?:[ab]\/)?(.+)$/);
+    if (file && file[1] !== '/dev/null') paths.push(file[1]);
+  }
+  return Array.from(new Set(paths));
+}
+
+// Prose is not a protected surface. Docs, judge cards, wikis, journals and run
+// receipts routinely *describe* CSP or force-dynamic without changing any
+// behaviour — replaying this guard over 60 real commits, 5 of 6 hits were
+// markdown that merely mentioned the words. A guard that pauses on every judge
+// card gets switched off, which is worse than no guard. Content signals
+// therefore apply to code only; PATH signals still apply to every file.
+const CODE_FILE = /\.(?:[cm]?[jt]sx?|py|rb|go|rs|java|kt|swift|php|sh|bash|zsh|sql|ya?ml|toml|env)$/i;
+
+function isCodeFile(file) {
+  const f = String(file || '').trim();
+  if (!f || f === '/dev/null') return false;
+  if (/\.(?:md|mdx|markdown|txt|rst|adoc)$/i.test(f)) return false;
+  return CODE_FILE.test(f);
+}
+
+// Walk the diff file-by-file so a changed line is attributed to the file it
+// came from, then keep only lines from code files.
+function changedCodeLinesFromDiff(diff) {
+  const lines = [];
+  let inCode = false;
+  for (const line of String(diff || '').split(/\r?\n/)) {
+    const header = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+    if (header) {
+      inCode = isCodeFile(header[1]) || isCodeFile(header[2]);
+      continue;
+    }
+    if (/^(?:---|\+\+\+) /.test(line)) continue;
+    if (!inCode) continue;
+    if (/^[+-]/.test(line)) lines.push(line.slice(1));
+  }
+  return lines;
+}
+
+function matchProtectedMissionDiff(diff, { tags = [] } = {}) {
+  const matches = [];
+  const add = (surface, signal, detail) => {
+    if (matches.some((match) => match.surface === surface && match.signal === signal && match.detail === detail)) return;
+    matches.push({ surface, signal, detail });
+  };
+
+  for (const tag of normalizedTags(tags)) {
+    if (DENIED_TAGS.includes(tag)) add(tag, 'tag', tag);
+  }
+
+  for (const file of changedPathsFromDiff(diff)) {
+    for (const [surface, pattern] of PATH_SURFACES) {
+      if (pattern.test(file)) add(surface, 'path', file);
+    }
+  }
+
+  for (const line of changedCodeLinesFromDiff(diff)) {
+    for (const [surface, pattern] of CONTENT_SURFACES) {
+      if (pattern.test(line)) add(surface, 'content', 'changed line');
+    }
+  }
+
+  return {
+    protected: matches.length > 0,
+    surfaces: Array.from(new Set(matches.map((match) => match.surface))),
+    matches,
+  };
+}
+
+function runGitDiff(git, args, root) {
+  const result = git(args, root);
+  if (!result || result.error || result.status !== 0) {
+    const detail = result?.error?.message
+      || String(result?.stderr || result?.stdout || `git ${args.join(' ')} failed`).trim();
+    return { ok: false, detail: detail || 'git diff could not be read' };
+  }
+  return { ok: true, diff: String(result.stdout || '') };
+}
+
+function defaultGit(gitBin = 'git') {
+  return (args, root) => spawnSync(gitBin, args, {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 10000,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+}
+
+function readMissionDiff({
+  root = process.cwd(),
+  baseRef = '',
+  git = defaultGit(),
+  includeUnstaged = true,
+} = {}) {
+  const parts = [];
+  const staged = runGitDiff(git, ['diff', '--cached', '--no-ext-diff', '--unified=0', '--no-color', '--'], root);
+  if (!staged.ok) return staged;
+  parts.push(staged.diff);
+
+  if (includeUnstaged) {
+    const unstaged = runGitDiff(git, ['diff', '--no-ext-diff', '--unified=0', '--no-color', '--'], root);
+    if (!unstaged.ok) return unstaged;
+    parts.push(unstaged.diff);
+  }
+
+  if (baseRef) {
+    const committed = runGitDiff(git, ['diff', '--no-ext-diff', '--unified=0', '--no-color', baseRef, 'HEAD', '--'], root);
+    if (!committed.ok) return committed;
+    parts.push(committed.diff);
+  }
+
+  return { ok: true, diff: parts.filter(Boolean).join('\n') };
+}
+
+function protectedPause(reason, detail = {}) {
+  return {
+    ok: false,
+    allowed: false,
+    status: 'paused-for-review',
+    reason,
+    ...detail,
+  };
+}
+
+function unreadableMissionGuard(error) {
+  return protectedPause('mission diff could not be read; repair the tooling failure and rerun', {
+    status: 'paused-for-retry',
+    unreadable: true,
+    detail: error?.message || String(error || 'unknown diff read failure'),
+    surfaces: ['unreadable diff'],
+    matches: [],
+  });
+}
+
+function inspectMissionProtectedDiff({
+  root = process.cwd(),
+  baseRef = '',
+  tags = [],
+  readDiff = readMissionDiff,
+  git,
+  includeUnstaged = true,
+} = {}) {
+  let read;
+  try {
+    read = readDiff({ root, baseRef, tags, git, includeUnstaged });
+  } catch (error) {
+    return unreadableMissionGuard(error);
+  }
+  if (!read || read.ok !== true) {
+    return unreadableMissionGuard(read?.detail);
+  }
+
+  const matched = matchProtectedMissionDiff(read.diff, { tags });
+  if (matched.protected) {
+    return protectedPause(`protected mission surface requires human review: ${matched.surfaces.join(', ')}`, {
+      unreadable: false,
+      surfaces: matched.surfaces,
+      matches: matched.matches,
+    });
+  }
+  return {
+    ok: true,
+    allowed: true,
+    status: 'clear',
+    reason: 'mission diff contains no protected surface',
+    unreadable: false,
+    surfaces: [],
+    matches: [],
+  };
+}
+
+function guardMissionLanding(options = {}) {
+  const inspection = inspectMissionProtectedDiff(options);
+  if (!inspection.allowed) return inspection;
+  const land = typeof options.land === 'function' ? options.land : () => ({ ok: true, landed: true });
+  return { ...land(), protected_lane_guard: inspection };
+}
+
+function gitSubcommand(args) {
+  const consumesValue = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env']);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = String(args[index] || '');
+    if (consumesValue.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith('-')) continue;
+    return arg;
+  }
+  return '';
+}
+
+function prepareMissionGitGuard({
+  root = process.cwd(),
+  tags = [],
+  pathValue = process.env.PATH || '',
+} = {}) {
+  const resolved = spawnSync('sh', ['-c', 'command -v git'], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 5000,
+  });
+  const gitBin = String(resolved.stdout || '').trim();
+  if (resolved.status !== 0 || !gitBin) {
+    throw new Error('mission git guard could not resolve git');
+  }
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-mission-git-'));
+  const wrapper = path.join(dir, 'git');
+  const modulePath = __filename;
+  const config = { root: path.resolve(root), tags: normalizedTags(tags), gitBin };
+  const source = [
+    '#!/usr/bin/env node',
+    "'use strict';",
+    `const { spawnSync } = require('child_process');`,
+    `const guard = require(${JSON.stringify(modulePath)});`,
+    `const config = ${JSON.stringify(config)};`,
+    gitSubcommand.toString(),
+    defaultGit.toString(),
+    `const args = process.argv.slice(2);`,
+    `if (gitSubcommand(args) === 'commit') {`,
+    `  const result = guard.inspectMissionProtectedDiff({ root: config.root, tags: config.tags, includeUnstaged: false, git: defaultGit(config.gitBin) });`,
+    `  if (!result.allowed) {`,
+    `    process.stderr.write(result.reason + '\\n');`,
+    `    process.exit(78);`,
+    `  }`,
+    `}`,
+    `const child = spawnSync(config.gitBin, args, { cwd: process.cwd(), stdio: 'inherit' });`,
+    `if (child.error) { process.stderr.write(child.error.message + '\\n'); process.exit(1); }`,
+    `process.exit(child.status == null ? 1 : child.status);`,
+    '',
+  ].join('\n');
+  fs.writeFileSync(wrapper, source, { encoding: 'utf8', mode: 0o755 });
+
+  return {
+    env: { ...process.env, PATH: `${dir}${path.delimiter}${pathValue}` },
+    pathPrefix: dir,
+    cleanup() {
+      try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+    },
+  };
+}
+
+module.exports = {
+  defaultGit,
+  matchProtectedMissionDiff,
+  unreadableMissionGuard,
+  inspectMissionProtectedDiff,
+  guardMissionLanding,
+  prepareMissionGitGuard,
+};

package/lib/mission-room.js

@@ -842,6 +842,4 @@ module.exports = {
   buildMissionRoom,
   writeMissionRoomReceipt,
   missionRoomLines,
-  writeThinkingMemory,
-  collectMissionRoomContext,
 };

package/lib/mission-runtime-loop.js

@@ -322,6 +322,5 @@ function readAtrisGoalState(cwd = process.cwd()) {
 module.exports = {
   missionRunIntentFromMessage,
   runRuntimeMissionLoop,
-  formatRuntimeMissionLoopReceipt,
   readAtrisGoalState,
 };

package/lib/next-moves.js

@@ -844,37 +844,19 @@ function nextMoves(root = process.cwd(), limit = 3) {
 module.exports = {
   moveId,
   norm,
-  titleKey,
   isGenericInboxPlaceholder,
-  WEIGHT,
   SELF_IMPROVEMENT_SEED_TITLE,
-  cleanSuggestedTargetTitle,
-  suggestedTargetFromReportText,
   latestSuggestedTarget,
-  parseInboxTitles,
-  cleanInboxMoveTitle,
   readRoadmapOpenItems,
-  readWaitingWishCards,
-  readActionableMissionCards,
-  readActiveMissions,
-  readUnreviewedShippedWishCards,
-  readDreamCards,
   markDreamCardConsumed,
-  dreamCardId,
   readEndgameMove,
-  readActiveTasks,
-  isInternalNextMoveTask,
   readHandledTaskTitles,
   latestInboxItems,
   todayInboxItems,
-  gatherCandidates,
   pickNextMoves,
-  readNextParked,
   parkNextCard,
   nextCards,
-  addMissionOnlyFallback,
   nextMoves,
-  readDecisions,
   recordDecision,
   seedInboxFromMove,
   pickRoadmapSeed,