atris 3.56.0 → 3.56.2

package/lib/known-commands.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const knownCommands = ['init', 'doctor', 'install', 'workspace', 'log', 'logs', 'wish', 'ask', 'approve', 'stop', 'ready', 'check', 'drill', 'dream', 'now', 'goal', 'wtf', 'founder', 'orb', 'radar', 'who', 'stream', 'ctop', 'launchpad', 'status', 'analytics', 'revisions', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
+const knownCommands = ['init', 'doctor', 'install', 'workspace', 'log', 'logs', 'later', 'wish', 'ask', 'approve', 'stop', 'ready', 'check', 'drill', 'dream', 'now', 'goal', 'wtf', 'founder', 'orb', 'radar', 'who', 'stream', 'ctop', 'launchpad', 'status', 'analytics', 'revisions', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
                        'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'sync-checkout',

package/lib/pack-capabilities.js

@@ -6,6 +6,7 @@ const path = require('path');
 const dns = require('dns').promises;
 const net = require('net');
 const { randomUUID } = require('crypto');
+const { enforceConfigGuard } = require('./config-guard');
 
 const CAPABILITY_DEFINITIONS = Object.freeze({
   'pack.read': Object.freeze({
@@ -34,6 +35,7 @@ const TOOL_ORDER = Object.freeze([
 ]);
 
 const FILE_TOOLS = new Set(['Read', 'Glob', 'Grep', 'Edit', 'Write']);
+const PRE_TOOL_USE_MATCHER = 'Read|Glob|Grep|Edit|Write|WebFetch|Bash';
 const CLAUDE_SESSION_END_REASONS = new Set([
   'clear',
   'resume',
@@ -211,7 +213,7 @@ function buildClaudeCapabilityArgs(policy, options = {}) {
     },
     hooks: {
       PreToolUse: [{
-        matcher: 'Read|Glob|Grep|Edit|Write|WebFetch',
+        matcher: PRE_TOOL_USE_MATCHER,
         hooks: [{ type: 'command', command: `${hookCommand} pre` }],
       }],
       PostToolUse: [{
@@ -396,6 +398,7 @@ function beginPackRunReceipt(packDir, manifest, policy, options = {}) {
       runner: 'claude',
       builtInToolCeiling: true,
       packRootFileBoundary: true,
+      claudeSettingsGuard: true,
       preLaunchContextBoundary: true,
       declaredTreeSymlinksRejected: true,
       packOpeningSlashCommandsEscaped: true,
@@ -611,12 +614,18 @@ function denyPreToolUse(env, input, reason, now) {
   };
 }
 
+function decidePreToolUse(input, env) {
+  const configDecision = enforceConfigGuard(input, { cwd: env.root });
+  if (!configDecision.allowed) return configDecision;
+  return enforcePackRoot(input, env.root);
+}
+
 function runHook(mode, rawInput) {
   const env = hookEnvironment();
   const input = rawInput ? JSON.parse(rawInput) : {};
   const now = new Date().toISOString();
   if (mode === 'pre') {
-    const decision = enforcePackRoot(input, env.root);
+    const decision = decidePreToolUse(input, env);
     if (!decision.allowed) {
       return denyPreToolUse(env, input, decision.reason, now);
     }
@@ -645,7 +654,7 @@ async function runHookAsync(mode, rawInput, options = {}) {
   const env = hookEnvironment();
   const input = rawInput ? JSON.parse(rawInput) : {};
   const now = new Date().toISOString();
-  const fileDecision = enforcePackRoot(input, env.root);
+  const fileDecision = decidePreToolUse(input, env);
   if (!fileDecision.allowed) return denyPreToolUse(env, input, fileDecision.reason, now);
   const webDecision = await enforcePublicWeb(input, options);
   if (!webDecision.allowed) return denyPreToolUse(env, input, webDecision.reason, now);
@@ -677,6 +686,7 @@ module.exports = {
   finalizePackRunReceipt,
   receiptDirectory,
   classifyPackRunLifecycle,
+  enforceConfigGuard,
   enforcePackRoot,
   publicWebUrlPreflight,
   enforcePublicWeb,

package/lib/runner-command.js

@@ -9,6 +9,7 @@
 // first in precedence. Precedence: explicit model -> ATRIS_RUNNER_MODEL env ->
 // ATRIS_RUNNER_PROFILE -> legacy ATRIS_CLAUDE_MODEL env -> pinned default.
 const DEFAULT_CLAUDE_RUNNER_MODEL = 'claude-opus-4-8';
+const DEFAULT_FABLE_RUNNER_MODEL = 'claude-fable-5';
 const DEFAULT_CLAUDE_RUNNER_BIN = 'claude';
 
 // Canonical runner profiles. Each entry is the config an operator would pick
@@ -40,11 +41,11 @@ const RUNNER_PROFILE_DEFS = Object.freeze({
     model: '',
     commandTemplate: '{bin} --trust -p {prompt}',
   }),
-  // Compatibility names for fleet rosters. These map to real installed
-  // runners instead of retired or UI-only model names.
+  // Fable is a distinct Claude Code model, not a friendly name for whatever
+  // Claude model happens to be selected locally.
   fable: Object.freeze({
     bin: 'claude',
-    model: '',
+    model: DEFAULT_FABLE_RUNNER_MODEL,
     commandTemplate: '',
   }),
   composer: Object.freeze({
@@ -220,6 +221,7 @@ function buildRunnerCommand({ promptFile, allowedTools, model } = {}) {
 
 module.exports = {
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  DEFAULT_FABLE_RUNNER_MODEL,
   DEFAULT_CLAUDE_RUNNER_BIN,
   RUNNER_PROFILES,
   RUNNER_PROFILE_DEFS,

package/lib/scratch-root.js

@@ -43,6 +43,50 @@ function isGenericScratchRoot(dir) {
   }
 }
 
+function keyUnderScratchRoot(key, roots) {
+  for (const root of roots) {
+    if (key === root || key.startsWith(`${root}/`)) return true;
+  }
+  return false;
+}
+
+function isUnderGenericScratchRoot(dir) {
+  if (!dir) return false;
+  const roots = genericScratchRoots();
+  const key = pathKey(dir);
+  if (keyUnderScratchRoot(key, roots)) return true;
+  try {
+    return keyUnderScratchRoot(pathKey(fs.realpathSync(dir)), roots);
+  } catch {
+    return false;
+  }
+}
+
+function hasWorkspaceRoom(dir) {
+  const root = path.resolve(dir || '.');
+  return fs.existsSync(path.join(root, 'atris'))
+    || fs.existsSync(path.join(root, '.atris', 'business.json'));
+}
+
+// An empty child under /tmp (or another generic scratch root) is not a room.
+// --yes is consent to start, not a workspace unlock. A workspace that already
+// lives here (dogfood) still has atris/ or a business binding.
+function isUnboundScratchFolder(dir) {
+  if (!isUnderGenericScratchRoot(dir)) return false;
+  return !hasWorkspaceRoom(dir);
+}
+
+const UNBOUND_SCRATCH_MESSAGE = 'this folder is not a room';
+
+function refuseUnboundScratch(write = console.error) {
+  write(UNBOUND_SCRATCH_MESSAGE);
+  return 2;
+}
+
 module.exports = {
+  UNBOUND_SCRATCH_MESSAGE,
   isGenericScratchRoot,
+  isUnboundScratchFolder,
+  isUnderGenericScratchRoot,
+  refuseUnboundScratch,
 };

package/lib/workspace-scaffold.js

@@ -147,7 +147,9 @@ function ensureWorkspaceBrain(projectRoot = process.cwd(), { now = new Date() }
   }
 
   const year = String(now.getFullYear());
-  const today = now.toISOString().split('T')[0];
+  // Local calendar day, matching lib/file-ops getLogPath; toISOString is UTC
+  // and creates tomorrow's journal every evening west of Greenwich.
+  const today = `${year}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
   const journalFile = path.join(atrisDir, 'logs', year, `${today}.md`);
   if (writeIfMissing(journalFile, firstJournalMarkdown(today))) note(journalFile);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.56.0",
+  "version": "3.56.2",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {

package/utils/auth.js

@@ -86,6 +86,7 @@ function promptUser(question) {
 }
 
 const TOKEN_REFRESH_BUFFER_SECONDS = 300;
+const AGENT_TOKEN_EXPIRED_DETAIL = 'Agent token expired. Mint a new one: atris login --agent';
 
 /**
  * Decode and parse the claims from a JWT token.
@@ -164,6 +165,48 @@ function getCredentialsPath() {
   return path.join(getAtrisDir(), 'credentials.json');
 }
 
+function getPlacedAgentTokenPath() {
+  const override = process.env.ATRIS_AGENT_TOKEN_FILE;
+  if (override && override.trim()) return override.trim();
+  return path.join(os.homedir(), '.atris', 'agent-token.json');
+}
+
+function expiryTimeMs(value) {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return value > 1e12 ? value : value * 1000;
+  }
+  if (typeof value !== 'string' || !value.trim()) return null;
+  const trimmed = value.trim();
+  if (/^\d+(?:\.\d+)?$/.test(trimmed)) {
+    const numeric = Number(trimmed);
+    if (Number.isFinite(numeric)) return numeric > 1e12 ? numeric : numeric * 1000;
+  }
+  const parsed = Date.parse(trimmed);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function loadPlacedAgentToken() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(getPlacedAgentTokenPath(), 'utf8'));
+    const token = typeof parsed?.token === 'string' ? parsed.token.trim() : '';
+    if (!token || expiryTimeMs(parsed?.expires_at) === null) return null;
+    return {
+      token,
+      expires_at: parsed.expires_at,
+      scopes: Array.isArray(parsed.scopes) ? parsed.scopes : [],
+      provider: null,
+      source: 'agent_token_file',
+    };
+  } catch {
+    return null;
+  }
+}
+
+function isUnexpiredCredential(credentials) {
+  const expiresAt = expiryTimeMs(credentials?.expires_at);
+  return expiresAt !== null && expiresAt > Date.now();
+}
+
 function getSessionsDir() {
   return mkPrivateDir(path.join(getAtrisDir(), 'sessions'));
 }
@@ -332,17 +375,36 @@ function saveCredentials(token, refreshToken, email, userId, provider) {
 }
 
 function loadCredentials() {
-  // Priority: ATRIS_TOKEN env var → ATRIS_PROFILE env var → per-terminal session file → global credentials.json
+  // Priority: ATRIS_TOKEN env var → placed agent token → ATRIS_PROFILE env var
+  // → per-terminal session file → global credentials.json. A fresh placed token
+  // overrides a different env token because cloud images can carry a stale one.
 
   // 0. Raw token injection. Headless boxes (cloud business computers) have no
   //    browser for `atris login`; the runner injects a scoped token as env
   //    instead, so no credentials file ever lands on disk.
   const envToken = process.env.ATRIS_TOKEN;
-  if (envToken && envToken.trim()) {
-    return { token: envToken.trim(), provider: null, source: 'env' };
+  const normalizedEnvToken = envToken && envToken.trim();
+  const placedAgentToken = loadPlacedAgentToken();
+  if (
+    normalizedEnvToken &&
+    placedAgentToken &&
+    placedAgentToken.token !== normalizedEnvToken &&
+    isUnexpiredCredential(placedAgentToken)
+  ) {
+    return placedAgentToken;
+  }
+  if (normalizedEnvToken) {
+    return { token: normalizedEnvToken, provider: null, source: 'env' };
+  }
+
+  // 1. Backend-placed key for per-user cloud computers. Missing, malformed,
+  //    incomplete, and expired files are ignored so later sources keep their
+  //    existing order.
+  if (placedAgentToken && isUnexpiredCredential(placedAgentToken)) {
+    return placedAgentToken;
   }
 
-  // 1. Explicit env var override
+  // 2. Explicit env var override
   const profileOverride = process.env.ATRIS_PROFILE;
   if (profileOverride) {
     const profile = loadProfile(profileOverride);
@@ -358,14 +420,14 @@ function loadCredentials() {
     }
   }
 
-  // 2. Per-terminal session override (set by atris switch)
+  // 3. Per-terminal session override (set by atris switch)
   const sessionProfile = getSessionProfile();
   if (sessionProfile) {
     const profile = loadProfile(sessionProfile);
     if (profile) return { ...profile, source_profile: sessionProfile };
   }
 
-  // 3. Global credentials.json
+  // 4. Global credentials.json
   const credentialsPath = getCredentialsPath();
 
   if (!fs.existsSync(credentialsPath)) {
@@ -546,6 +608,20 @@ async function ensureValidCredentials(apiRequestJson, options = {}) {
     return { error: 'not_logged_in' };
   }
 
+  const selectedExpiry = expiryTimeMs(credentials.expires_at);
+  if (selectedExpiry !== null && selectedExpiry <= Date.now()) {
+    return { error: 'token_invalid', detail: AGENT_TOKEN_EXPIRED_DETAIL };
+  }
+
+  const claims = decodeJwtClaims(credentials.token);
+  if (claims?.type === 'agent_access') {
+    if (typeof claims.exp === 'number' && claims.exp <= Math.floor(Date.now() / 1000)) {
+      return { error: 'token_invalid', detail: AGENT_TOKEN_EXPIRED_DETAIL };
+    }
+    // Server-side scope enforcement on every real request is unchanged and remains the actual security boundary.
+    return { credentials, user: null, source: 'agent_token' };
+  }
+
   if (credentials.refresh_token && shouldRefreshToken(credentials.token)) {
     const proactive = await performTokenRefresh(credentials, apiRequestJson);
     if (proactive.ok) {
@@ -563,6 +639,7 @@ async function ensureValidCredentials(apiRequestJson, options = {}) {
 
     if (
       credentials.source !== 'env' &&
+      credentials.source !== 'agent_token_file' &&
       (updatedEmail !== credentials.email ||
         updatedProvider !== credentials.provider ||
         updatedUserId !== credentials.user_id)
@@ -671,6 +748,7 @@ async function displayAccountSummary(apiRequestJson) {
 }
 
 module.exports = {
+  AGENT_TOKEN_EXPIRED_DETAIL,
   decodeJwtClaims,
   getTokenExpiryEpochSeconds,
   shouldRefreshToken,