atris 3.53.0 → 3.56.0

package/commands/auth.js

@@ -1,22 +1,361 @@
-const { loadCredentials, saveCredentials, deleteCredentials, getCredentialsPath, openBrowser, promptUser, displayAccountSummary, loadProfile, listProfiles, profileNameFromEmail, deleteProfile, getTerminalSessionId, setSessionProfile, getSessionProfile, clearSessionProfile, cleanStaleSessions, getSessionsDir } = require('../utils/auth');
+const { loadCredentials, saveCredentials, deleteCredentials, getCredentialsPath, openBrowser, promptUser, displayAccountSummary, ensureValidCredentials, loadProfile, listProfiles, profileNameFromEmail, deleteProfile, saveProfile, getTokenExpiryEpochSeconds, getTerminalSessionId, setSessionProfile, getSessionProfile, clearSessionProfile, cleanStaleSessions, getSessionsDir } = require('../utils/auth');
 const { getAppBaseUrl, apiRequestJson } = require('../utils/api');
+const { isNonInteractive, wantsJson } = require('../lib/noninteractive');
+const { hasFlag, readFlag } = require('../lib/arg-parser');
 const fs = require('fs');
 const path = require('path');
 
+const AGENT_TOKEN_PATH = '/auth/agent-token';
+const DEFAULT_AGENT_SCOPES = ['x-search', 'youtube'];
+const DEFAULT_DAILY_CREDIT_CAP = 50;
+const NO_STORED_JWT_MESSAGE = 'not signed in. run atris login first.';
+
+function firstNonEmptyString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+function wantsAgentToken(args = []) {
+  if (hasFlag(args, '--agent')) return true;
+  const first = args.find((arg) => arg && !String(arg).startsWith('-'));
+  return first === 'agent-token';
+}
+
+function parseScopeList(raw) {
+  if (!raw) return [...DEFAULT_AGENT_SCOPES];
+  const scopes = String(raw).split(',').map((part) => part.trim()).filter(Boolean);
+  if (scopes.length === 0) {
+    throw new Error('scopes must list at least one value');
+  }
+  return scopes;
+}
+
+function parseDailyCreditCap(args) {
+  const present = args.some((arg) => arg === '--daily-credit-cap' || String(arg).startsWith('--daily-credit-cap='));
+  const raw = readFlag(args, '--daily-credit-cap', '');
+  if (!present) return DEFAULT_DAILY_CREDIT_CAP;
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error('daily credit cap must be a positive integer');
+  }
+  return value;
+}
+
+function parseAgentTokenArgs(args = []) {
+  return {
+    agent: wantsAgentToken(args),
+    scopes: parseScopeList(readFlag(args, '--scopes', '')),
+    dailyCreditCap: parseDailyCreditCap(args),
+    json: wantsJson(args),
+    help: hasFlag(args, '--help') || hasFlag(args, '-h') || args[0] === 'help',
+  };
+}
+
+function extractAgentAccessToken(data) {
+  if (!data || typeof data !== 'object') return null;
+  return firstNonEmptyString(
+    data.access_token,
+    data.token,
+    data.agent_access,
+    data.agent_token,
+    data.agent_access_token,
+  );
+}
+
+function expiryFromValue(value) {
+  if (typeof value === 'string' && value.trim()) return value.trim();
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    const ms = value > 1e12 ? value : value * 1000;
+    return new Date(ms).toISOString();
+  }
+  return null;
+}
+
+function extractAgentTokenMeta(data, requested, token) {
+  const payload = data && typeof data === 'object' ? data : {};
+  const scopes = Array.isArray(payload.scopes) && payload.scopes.length
+    ? payload.scopes.map(String)
+    : requested.scopes;
+  const rawCap = payload.daily_credit_cap;
+  const dailyCreditCap = Number.isFinite(Number(rawCap)) ? Number(rawCap) : requested.dailyCreditCap;
+  const expiresAt = expiryFromValue(payload.expires_at ?? payload.expiry ?? payload.expires ?? payload.exp)
+    || expiryFromValue(getTokenExpiryEpochSeconds(token));
+  return { scopes, dailyCreditCap, expiresAt };
+}
+
+function persistMintedAgentToken(credentials, token, extras = {}) {
+  const next = {
+    token,
+    refresh_token: extras.refresh_token || credentials.refresh_token || null,
+    email: credentials.email || null,
+    user_id: credentials.user_id || null,
+    provider: credentials.provider || null,
+    saved_at: extras.saved_at || new Date().toISOString(),
+  };
+  if (credentials.source_profile) {
+    saveProfile(credentials.source_profile, next);
+    return next;
+  }
+  saveCredentials(next.token, next.refresh_token, next.email, next.user_id, next.provider);
+  return next;
+}
+
+function printAgentTokenMint(meta, output) {
+  output('minted scoped agent token');
+  output(`scopes: ${meta.scopes.join(', ')}`);
+  output(`daily credit cap: ${meta.dailyCreditCap}`);
+  if (meta.expiresAt) output(`expires: ${meta.expiresAt}`);
+}
+
+function redactSecret(text, secret) {
+  if (!secret || !text) return text;
+  return String(text).split(secret).join('[redacted]');
+}
+
+async function postAgentToken(api, token, body) {
+  return api(AGENT_TOKEN_PATH, {
+    method: 'POST',
+    token,
+    body,
+    retries: 0,
+  });
+}
+
+async function mintScopedAgentToken(requested = {}, deps = {}) {
+  const api = deps.apiRequestJson || apiRequestJson;
+  const load = deps.loadCredentials || loadCredentials;
+  const persist = deps.persistMintedAgentToken || persistMintedAgentToken;
+  const now = deps.now || (() => new Date().toISOString());
+
+  const scopes = Array.isArray(requested.scopes)
+    ? requested.scopes.map((part) => String(part).trim()).filter(Boolean)
+    : parseScopeList(requested.scopes);
+  if (scopes.length === 0) {
+    return { ok: false, code: 'invalid_scopes', error: 'scopes must list at least one value' };
+  }
+  const dailyCreditCap = Number.isInteger(requested.dailyCreditCap) && requested.dailyCreditCap > 0
+    ? requested.dailyCreditCap
+    : DEFAULT_DAILY_CREDIT_CAP;
+
+  const credentials = load() || {};
+  const accessToken = firstNonEmptyString(credentials.token);
+  const refreshToken = firstNonEmptyString(credentials.refresh_token);
+  if (!accessToken && !refreshToken) {
+    return { ok: false, code: 'not_logged_in', error: NO_STORED_JWT_MESSAGE };
+  }
+
+  const body = {
+    scopes,
+    daily_credit_cap: dailyCreditCap,
+  };
+  let authToken = accessToken || refreshToken;
+  let result = await postAgentToken(api, authToken, body);
+  if (!result.ok && result.status === 401 && refreshToken && authToken !== refreshToken) {
+    authToken = refreshToken;
+    result = await postAgentToken(api, authToken, body);
+  }
+
+  if (!result.ok) {
+    const detail = redactSecret(result.error || 'agent token request failed', accessToken);
+    return {
+      ok: false,
+      code: 'mint_failed',
+      status: result.status || 0,
+      error: redactSecret(detail, refreshToken),
+    };
+  }
+
+  const minted = extractAgentAccessToken(result.data);
+  if (!minted) {
+    return { ok: false, code: 'missing_token', error: 'backend did not return an agent token' };
+  }
+
+  persist(credentials, minted, {
+    refresh_token: firstNonEmptyString(result.data && result.data.refresh_token) || refreshToken,
+    saved_at: now(),
+  });
+
+  return {
+    ok: true,
+    token: minted,
+    meta: extractAgentTokenMeta(result.data, { scopes, dailyCreditCap }, minted),
+  };
+}
+
+async function ensureBilledCommandAuth(scope, deps = {}) {
+  const wanted = String(scope || '').trim();
+  if (!wanted) {
+    return { ok: false, error: NO_STORED_JWT_MESSAGE };
+  }
+
+  const api = deps.apiRequestJson || apiRequestJson;
+  const ensureFn = deps.ensureValidCredentials || ensureValidCredentials;
+  const load = deps.loadCredentials || loadCredentials;
+  const mint = deps.mintScopedAgentToken || mintScopedAgentToken;
+
+  if (!deps.forceMint) {
+    const ensured = await ensureFn(api);
+    if (ensured && ensured.credentials && ensured.credentials.token) {
+      return {
+        ok: true,
+        token: ensured.credentials.token,
+        minted: false,
+        credentials: ensured.credentials,
+      };
+    }
+  }
+
+  const credentials = load() || {};
+  if (!firstNonEmptyString(credentials.token, credentials.refresh_token)) {
+    return { ok: false, error: NO_STORED_JWT_MESSAGE };
+  }
+
+  const minted = await mint({ scopes: [wanted] }, deps);
+  if (!minted.ok) {
+    return { ok: false, error: minted.error || NO_STORED_JWT_MESSAGE };
+  }
+  return {
+    ok: true,
+    token: minted.token,
+    minted: true,
+    credentials: load() || credentials,
+    meta: minted.meta,
+  };
+}
+
+async function mintAgentToken(args = [], deps = {}) {
+  const output = deps.output || console.log;
+  const outputError = deps.outputError || console.error;
+
+  let options;
+  try {
+    options = parseAgentTokenArgs(args);
+  } catch (error) {
+    const message = error.message || String(error);
+    if (wantsJson(args)) {
+      output(JSON.stringify({ ok: false, error: message }, null, 2));
+    } else {
+      outputError(message);
+    }
+    return 1;
+  }
+
+  const minted = await mintScopedAgentToken({
+    scopes: options.scopes,
+    dailyCreditCap: options.dailyCreditCap,
+  }, deps);
+
+  if (!minted.ok) {
+    if (options.json) {
+      output(JSON.stringify({
+        ok: false,
+        error: minted.code === 'not_logged_in' ? 'not_logged_in' : minted.error,
+        next: minted.code === 'not_logged_in' ? 'atris login' : undefined,
+        status: minted.status || undefined,
+      }, null, 2));
+    } else if (minted.code === 'not_logged_in') {
+      output('not signed in. run atris login first, then atris login --agent.');
+    } else {
+      outputError(minted.error);
+    }
+    return 1;
+  }
+
+  if (options.json) {
+    output(JSON.stringify({
+      ok: true,
+      minted: true,
+      scopes: minted.meta.scopes,
+      daily_credit_cap: minted.meta.dailyCreditCap,
+      expires_at: minted.meta.expiresAt,
+    }, null, 2));
+    return 0;
+  }
+
+  printAgentTokenMint(minted.meta, output);
+  return 0;
+}
+
+async function printWhoamiPayload(asJson) {
+  const ensured = await ensureValidCredentials(apiRequestJson);
+  if (ensured.error) {
+    if (asJson) {
+      console.log(JSON.stringify({
+        ok: false,
+        logged_in: false,
+        error: ensured.error,
+        detail: ensured.detail || null,
+      }, null, 2));
+    } else {
+      console.log('Status: Not logged in');
+      if (ensured.detail) console.log(`Reason: ${ensured.detail}`);
+      console.log('\nRun "atris login" to sign in.');
+    }
+    process.exit(1);
+  }
+
+  const { credentials, user } = ensured;
+  const email = user?.email || credentials?.email || 'unknown';
+  const userId = user?.id || credentials?.user_id || 'unknown';
+  const provider = user?.provider || credentials?.provider || 'unknown';
+  const savedAt = credentials?.saved_at || 'unknown';
+  const payload = {
+    ok: true,
+    logged_in: true,
+    email,
+    user_id: userId,
+    provider,
+    credentials_saved: savedAt,
+  };
+
+  if (asJson) {
+    console.log(JSON.stringify(payload, null, 2));
+    process.exit(0);
+  }
+
+  const summary = await displayAccountSummary(apiRequestJson);
+  if (summary.error) {
+    console.log('\nRun "atris login" to sign in.');
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 async function loginAtris(options = {}) {
   // Support: atris login --token <token> --force
   const args = process.argv.slice(3);
   const forceFlag = args.includes('--force') || args.includes('-f') || options.force;
   const tokenIndex = args.indexOf('--token');
   const directToken = tokenIndex !== -1 ? args[tokenIndex + 1] : options.token;
+  const asJson = wantsJson(args);
+  const nonInteractive = isNonInteractive(args);
 
   try {
     const existing = loadCredentials();
 
+    if (wantsAgentToken(args)) {
+      if (directToken) {
+        saveCredentials(
+          String(directToken).trim(),
+          existing?.refresh_token || null,
+          existing?.email || null,
+          existing?.user_id || null,
+          existing?.provider || 'manual',
+        );
+      }
+      const code = await mintAgentToken(args);
+      process.exit(code);
+    }
+
     // Direct token mode (non-interactive)
     if (directToken) {
       const trimmed = directToken.trim();
       saveCredentials(trimmed, null, existing?.email || null, existing?.user_id || null, existing?.provider || 'manual');
+      if (asJson) {
+        return printWhoamiPayload(true);
+      }
       console.log('Token saved. Validating…\n');
       const summary = await displayAccountSummary(apiRequestJson);
       if (summary.error) {
@@ -27,24 +366,48 @@ async function loginAtris(options = {}) {
       process.exit(0);
     }
 
+    // Already signed in without --force: behave like whoami (no menu).
+    // Print local identity without waiting on the network so headless agents
+    // never hang on a stale token validation.
     if (existing && !forceFlag) {
-      const label = existing.email || existing.user_id || 'unknown';
-      const profiles = listProfiles();
-      console.log(`Currently signed in as: ${label}`);
-      if (profiles.length > 1) {
-        console.log(`${profiles.length} accounts saved. Use "atris switch" to change.\n`);
+      const email = existing.email || null;
+      const userId = existing.user_id || null;
+      const provider = existing.provider || null;
+      if (asJson) {
+        console.log(JSON.stringify({
+          ok: true,
+          logged_in: true,
+          email,
+          user_id: userId,
+          provider,
+          credentials_saved: existing.saved_at || null,
+          next: 'atris whoami --json',
+        }, null, 2));
+        process.exit(0);
       }
-      console.log('  1. Add another account');
-      console.log('  2. Re-login to current account');
-      console.log('  3. Cancel\n');
+      console.log(`Currently signed in as: ${email || userId || 'unknown'}`);
+      if (provider) console.log(`Provider: ${provider}`);
+      console.log('Next: atris whoami');
+      process.exit(0);
+    }
 
-      const choice = await promptUser('Choice (1-3): ');
-      if (choice === '3' || (!choice)) {
-        console.log('Cancelled.');
-        process.exit(0);
+    if (nonInteractive) {
+      if (asJson) {
+        console.log(JSON.stringify({
+          ok: false,
+          logged_in: false,
+          error: 'login requires --token in non-interactive mode',
+          next: 'atris login --token <token>',
+        }, null, 2));
+      } else {
+        console.log('Not signed in.');
+        console.log('login needs a terminal for browser OAuth, or pass a token.');
+        console.log('Next: atris login --token <token>');
       }
-      // Both 1 and 2 proceed to OAuth — the difference is just the prompt
-    } else if (!existing) {
+      process.exit(1);
+    }
+
+    if (!existing) {
       console.log('Welcome to Atris! Let\'s get you signed in.\n');
     }
 
@@ -154,17 +517,21 @@ function logoutAtris() {
 }
 
 async function whoamiAtris() {
-  const { apiRequestJson } = require('../utils/api');
+  const args = process.argv.slice(3);
+  const asJson = wantsJson(args);
 
   try {
-    const summary = await displayAccountSummary(apiRequestJson);
-    if (summary.error) {
-      console.log('\nRun "atris login" to sign in.');
-      process.exit(1);
-    }
-    process.exit(0);
+    return await printWhoamiPayload(asJson);
   } catch (error) {
-    console.error(`Failed to fetch account: ${error.message || error}`);
+    if (asJson) {
+      console.log(JSON.stringify({
+        ok: false,
+        logged_in: false,
+        error: error.message || String(error),
+      }, null, 2));
+    } else {
+      console.error(`Failed to fetch account: ${error.message || error}`);
+    }
     process.exit(1);
   }
 }
@@ -318,16 +685,18 @@ function useAccount() {
   }
 }
 
-async function accountsCmd() {
-  const args = process.argv.slice(3);
-  const subCmd = args[0];
+async function accountsCmd(argv = null) {
+  const args = Array.isArray(argv) ? argv : process.argv.slice(3);
+  const { parseScopeFlag } = require('../lib/cli-scope');
+  const scope = parseScopeFlag(args);
+  const subCmd = scope.args[0];
 
   if (subCmd === 'add' || subCmd === 'login') {
     return loginAtris({ force: true });
   }
 
   if (subCmd === 'remove' || subCmd === 'rm') {
-    const target = args[1];
+    const target = scope.args[1];
     if (target === '--all') {
       const profiles = listProfiles();
       if (profiles.length === 0) {
@@ -386,34 +755,59 @@ async function accountsCmd() {
     process.exit(0);
   }
 
-  // Default: list accounts
-  return listAccountsCmd();
+  // Default: list accounts (workspace = active only; --global = all profiles)
+  return listAccountsCmd({ global: scope.global, json: scope.args.includes('--json') || args.includes('--json') });
 }
 
-function listAccountsCmd() {
+function listAccountsCmd(options = {}) {
   const profiles = listProfiles();
-  if (profiles.length === 0) {
-    console.log('No accounts saved. Run "atris login" to add one.');
-    process.exit(0);
-  }
-
   const current = loadCredentials();
   const currentUid = current?.user_id;
-  // Also check which profile name is active (env var or session)
   const envProfile = process.env.ATRIS_PROFILE;
   const sessionProfile = getSessionProfile();
+  const scopeKind = options.global ? 'global' : 'workspace';
 
-  console.log('\n  Accounts\n');
-  profiles.forEach(name => {
+  const rows = profiles.map((name) => {
     const profile = loadProfile(name);
     const email = profile?.email || 'unknown';
-    const isActive = profile?.user_id === currentUid;
-    if (isActive) {
-      console.log(`  ● ${name}  ${email}`);
+    const isActive = profile?.user_id === currentUid
+      || name === envProfile
+      || name === sessionProfile;
+    return { name, email, active: Boolean(isActive) };
+  });
+
+  const visible = options.global ? rows : rows.filter((row) => row.active);
+
+  if (options.json) {
+    console.log(JSON.stringify({
+      scope: scopeKind,
+      accounts: visible,
+      total_profiles: profiles.length,
+    }, null, 2));
+    process.exit(0);
+  }
+
+  if (visible.length === 0) {
+    if (profiles.length === 0) {
+      console.log('No accounts saved. Run "atris login" to add one.');
     } else {
-      console.log(`    ${name}  ${email}`);
+      console.log('No active account in this workspace.');
+      console.log('Pass --global to list all saved profiles, or atris switch <name>.');
+    }
+    process.exit(0);
+  }
+
+  console.log(`\n  Accounts (${scopeKind})\n`);
+  visible.forEach((row) => {
+    if (row.active) {
+      console.log(`  ● ${row.name}  ${row.email}`);
+    } else {
+      console.log(`    ${row.name}  ${row.email}`);
     }
   });
+  if (!options.global && profiles.length > visible.length) {
+    console.log(`\n  ${profiles.length - visible.length} more profile(s) hidden. Pass --global to list them.`);
+  }
   console.log(`\n  Switch:  atris switch <name>`);
   console.log(`  Add:     atris accounts add`);
   console.log(`  Remove:  atris accounts remove <name>\n`);
@@ -569,4 +963,20 @@ function shellInit() {
   console.log(lines.join('\n'));
 }
 
-module.exports = { loginAtris, logoutAtris, whoamiAtris, switchAccount, useAccount, accountsCmd, listAccountsCmd, resolveProfile, profileEmail, activateGlobal, switchSession, shellInit };
+module.exports = {
+  loginAtris,
+  logoutAtris,
+  whoamiAtris,
+  switchAccount,
+  useAccount,
+  accountsCmd,
+  resolveProfile,
+  profileEmail,
+  activateGlobal,
+  switchSession,
+  shellInit,
+  parseAgentTokenArgs,
+  mintAgentToken,
+  ensureBilledCommandAuth,
+  wantsAgentToken,
+};

package/commands/autoland.js

@@ -282,8 +282,10 @@ function verifyClosedTaskMissions(root, tasks, { limit = MAX_MISSION_AUTO_VERIFY
       'tick',
       mission.id,
       '--verify',
+      '--yes',
+      '--full',
       '--summary',
-      'All linked repair tasks are closed; autoland re-ran the mission verifier.',
+      'The linked repair tasks are closed, so the mission check ran again.',
       '--json',
     ]);
     const outcome = parseMissionVerifyResult(mission.id, result);

package/commands/autopilot-front.js

@@ -8,6 +8,7 @@ const fs = require('fs');
 const path = require('path');
 const { spawn } = require('child_process');
 const { pickRunnableMission, runBudgetSeconds } = require('./run-front');
+const { refuseHeadlessUnless, wantsJson, hasYesFlag } = require('../lib/noninteractive');
 
 const CLI_PATH = path.join(__dirname, '..', 'bin', 'atris.js');
 const DEFAULT_LEG_WALL_SECONDS = 3600;
@@ -120,19 +121,40 @@ function legPlan(root, legWallSeconds) {
   };
 }
 
-function driveLeg(root, legArgs, current) {
+function watchStopFile(root, child, { intervalMs = 2000 } = {}) {
+  const poll = setInterval(() => {
+    if (stopRequested(root)) {
+      try { child.kill('SIGTERM'); } catch {}
+    }
+  }, intervalMs);
+  if (poll.unref) poll.unref();
+  return () => clearInterval(poll);
+}
+
+function recordChildPid(root, state, pid) {
+  if (!state) return;
+  if (Number.isFinite(pid) && pid > 0) state.child_pid = pid;
+  else delete state.child_pid;
+  writeState(root, state);
+}
+
+function killPid(pid) {
+  if (!pidAlive(pid)) return false;
+  try { process.kill(pid, 'SIGTERM'); return true; } catch { return false; }
+}
+
+function driveLeg(root, legArgs, current, state) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, [CLI_PATH, ...legArgs], { cwd: root, stdio: 'inherit' });
     current.child = child;
+    recordChildPid(root, state, child.pid);
     // Stop fast: a stop file written by `atris autopilot stop` in another
     // terminal terminates the running leg, not just the loop between legs.
-    const poll = setInterval(() => {
-      if (stopRequested(root)) { try { child.kill('SIGTERM'); } catch {} }
-    }, 2000);
-    if (poll.unref) poll.unref();
+    const stopWatch = watchStopFile(root, child);
     const finish = (code) => {
-      clearInterval(poll);
+      stopWatch();
       current.child = null;
+      recordChildPid(root, state, null);
       resolve(Number.isFinite(code) ? code : 1);
     };
     child.on('error', () => finish(1));
@@ -144,10 +166,14 @@ function sleep(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
 
 function autopilotStop(root = process.cwd()) {
   requestStop(root);
-  const state = readState(root);
-  if (state && pidAlive(state.pid)) {
-    try { process.kill(state.pid, 'SIGTERM'); } catch {}
-    console.log(`Stopping autopilot (pid ${state.pid}).`);
+  const state = readState(root) || {};
+  const wrapperPid = Number(state.pid);
+  const childPid = Number(state.child_pid);
+  const killedChild = killPid(childPid);
+  const killedWrapper = wrapperPid !== childPid && killPid(wrapperPid);
+  if (killedChild || killedWrapper) {
+    const extra = killedChild && Number.isFinite(childPid) ? `, leg ${childPid}` : '';
+    console.log(`Stopping autopilot (pid ${Number.isFinite(wrapperPid) ? wrapperPid : childPid}${extra}).`);
   } else {
     console.log('No live autopilot process; stop marker written so the next start clears it.');
   }
@@ -194,6 +220,26 @@ async function autopilotFront(args = []) {
   if (args[0] === 'stop') return autopilotStop(root);
   if (args[0] === 'status') return autopilotStatus(root);
   if (args.includes('--help') || args.includes('-h') || args[0] === 'help') { showFrontHelp(); return 0; }
+  if (wantsJson(args) && !hasYesFlag(args)) {
+    const state = readState(root);
+    const alive = Boolean(state && pidAlive(state.pid));
+    console.log(JSON.stringify({
+      ok: false,
+      command: 'autopilot',
+      running: alive,
+      error: 'pass --yes to start',
+      usage: 'atris autopilot [--yes|--auto] [--once]',
+    }, null, 2));
+    return 2;
+  }
+  // Bare headless invoke used to start a mission loop and hang. --auto is
+  // the existing proceed flag pulse and spaceship already pass. --once is
+  // a duration, not consent: it still needs --yes off a TTY.
+  if (!args.includes('--auto') && refuseHeadlessUnless(args, {
+    allowYes: true,
+    allowOnce: false,
+    usage: 'Usage: atris autopilot [--yes|--auto] [--once]',
+  })) return 2;
 
   const existing = readState(root);
   if (existing && pidAlive(existing.pid) && existing.pid !== process.pid) {
@@ -245,7 +291,7 @@ async function autopilotFront(args = []) {
     console.log(`\nautopilot leg ${state.legs}: ${plan.label}`);
 
     const legStarted = Date.now();
-    const code = await driveLeg(root, plan.args, current);
+    const code = await driveLeg(root, plan.args, current, state);
     state.last_exit = code;
     writeState(root, state);
 
@@ -284,4 +330,5 @@ module.exports = {
   clearStop,
   readState,
   writeState,
+  watchStopFile,
 };