atris 3.58.6 → 3.58.7

package/utils/auth.js

@@ -202,6 +202,51 @@ function loadPlacedAgentToken() {
   }
 }
 
+function leftoverStoredAgentToken(parsed, envToken) {
+  if (!parsed || !envToken) return null;
+  const leftover = typeof parsed.agent_token === 'string' ? parsed.agent_token.trim() : '';
+  if (!leftover || leftover !== envToken) return null;
+  const expiresAt = parsed.agent_token_expires_at;
+  if (expiryTimeMs(expiresAt) === null) return null;
+  const scopes = Array.isArray(parsed.agent_token_scopes) ? parsed.agent_token_scopes : [];
+  return {
+    token: leftover,
+    expires_at: expiresAt,
+    scopes,
+    provider: null,
+    source: 'env',
+    agent_token: leftover,
+    agent_token_scopes: scopes,
+    agent_token_expires_at: expiresAt,
+  };
+}
+
+function loadLeftoverCredentialsAgentToken(envToken) {
+  if (!envToken) return null;
+  try {
+    return leftoverStoredAgentToken(JSON.parse(fs.readFileSync(getCredentialsPath(), 'utf8')), envToken);
+  } catch {
+    return null;
+  }
+}
+
+function resolveProfileOverride(profileOverride) {
+  if (!profileOverride) return null;
+  if (loadProfile(profileOverride)) return profileOverride;
+  const profiles = listProfiles();
+  const q = String(profileOverride).toLowerCase();
+  return profiles.find((name) => name.toLowerCase() === q)
+    || profiles.find((name) => name.toLowerCase().startsWith(q))
+    || profiles.find((name) => name.toLowerCase().includes(q))
+    || null;
+}
+
+function loadLeftoverProfileAgentToken(envToken) {
+  const name = resolveProfileOverride(process.env.ATRIS_PROFILE) || getSessionProfile();
+  if (!envToken || !name) return null;
+  return leftoverStoredAgentToken(loadProfile(name), envToken);
+}
+
 function isUnexpiredCredential(credentials) {
   const expiresAt = expiryTimeMs(credentials?.expires_at);
   return expiresAt !== null && expiresAt > Date.now();
@@ -417,7 +462,8 @@ async function repairLoginCredentials(credentials, apiRequestJson) {
 function readCredentials() {
   // Priority: ATRIS_TOKEN env var → placed agent token → ATRIS_PROFILE env var
   // → per-terminal session file → global credentials.json. A fresh placed token
-  // overrides a different env token because cloud images can carry a stale one.
+  // overrides env when the leftover is newer or when env only repeats that
+  // leftover, so billed auth still sees leftover scopes.
 
   // 0. Raw token injection. Headless boxes (cloud business computers) have no
   //    browser for `atris login`; the runner injects a scoped token as env
@@ -425,15 +471,24 @@ function readCredentials() {
   const envToken = process.env.ATRIS_TOKEN;
   const normalizedEnvToken = envToken && envToken.trim();
   const placedAgentToken = loadPlacedAgentToken();
-  if (
-    normalizedEnvToken &&
-    placedAgentToken &&
-    placedAgentToken.token !== normalizedEnvToken &&
-    isUnexpiredCredential(placedAgentToken)
-  ) {
+  if (normalizedEnvToken && placedAgentToken && isUnexpiredCredential(placedAgentToken)) {
+    // Fresh placed leftover wins over env, including when env repeats the same
+    // token, so billed auth still sees leftover scopes and does not remint.
     return placedAgentToken;
   }
   if (normalizedEnvToken) {
+    const leftoverCredentials = loadLeftoverCredentialsAgentToken(normalizedEnvToken);
+    if (leftoverCredentials && isUnexpiredCredential(leftoverCredentials)) {
+      // Env repeating leftover credentials.agent_token keeps leftover scopes
+      // and expiry so billed auth does not remint.
+      return leftoverCredentials;
+    }
+    const leftoverProfile = loadLeftoverProfileAgentToken(normalizedEnvToken);
+    if (leftoverProfile && isUnexpiredCredential(leftoverProfile)) {
+      // Env repeating leftover profile or session-profile agent_token keeps
+      // leftover scopes and expiry so billed auth does not remint.
+      return leftoverProfile;
+    }
     return { token: normalizedEnvToken, provider: null, source: 'env' };
   }