atris 3.58.7 → 3.58.8

package/utils/auth.js

@@ -156,6 +156,20 @@ function mkPrivateDir(dir) {
   return dir;
 }
 
+// Credential files hold login tokens. If they cannot be limited to the owner,
+// say so once per file instead of leaving them readable in silence.
+const permissionWarned = new Set();
+function restrictToOwner(filePath) {
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch (err) {
+    if (permissionWarned.has(filePath)) return;
+    permissionWarned.add(filePath);
+    const reason = err && err.code ? ` (${err.code})` : '';
+    console.error(`atris: could not limit ${filePath} to your user${reason}. other users on this machine may be able to read it.`);
+  }
+}
+
 function getAtrisDir() {
   const homeDir = os.homedir();
   return mkPrivateDir(path.join(homeDir, '.atris'));
@@ -349,7 +363,7 @@ function getProfilesDir() {
 
 function profileNameFromEmail(email) {
   if (!email) return null;
-  // "keshav@atrislabs.com" → "keshav"
+  // "alex@example.com" becomes "alex".
   const name = email.split('@')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-');
   return name || null; // Guard against emails like "@domain.com"
 }
@@ -357,7 +371,7 @@ function profileNameFromEmail(email) {
 function saveProfile(name, credentials) {
   const profilePath = path.join(getProfilesDir(), `${name}.json`);
   fs.writeFileSync(profilePath, JSON.stringify(credentials, null, 2));
-  try { fs.chmodSync(profilePath, 0o600); } catch {}
+  restrictToOwner(profilePath);
 }
 
 function loadProfile(name) {
@@ -413,11 +427,7 @@ function saveCredentials(token, refreshToken, email, userId, provider, extras =
   };
 
   fs.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2));
-  try {
-    fs.chmodSync(credentialsPath, 0o600);
-  } catch {
-    // Best effort: permissions may be unsupported on this platform.
-  }
+  restrictToOwner(credentialsPath);
 
   // Auto-save as named profile
   autoSaveProfile(credentials);

package/utils/backend-root.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { resolveWorkspaceRoot } = require('../lib/mission-root');
+const { loadConfig } = require('./config');
+
+const BACKEND_ROOT_HINT = 'set ATRIS_BACKEND_ROOT to the backend workspace.';
+
+function resolveBackendRoot(cwd = process.cwd()) {
+  const workspace = resolveWorkspaceRoot(cwd);
+  // ATRIS_BACKEND_DIR is the former spelling, accepted only here.
+  const environment = process.env.ATRIS_BACKEND_ROOT || process.env.ATRIS_BACKEND_DIR;
+  if (environment) {
+    const candidate = path.resolve(environment);
+    return fs.existsSync(candidate) && fs.statSync(candidate).isDirectory() ? candidate : null;
+  }
+
+  const config = loadConfig(workspace);
+  if (typeof config?.backend_root === 'string' && config.backend_root.trim()) {
+    const candidate = path.resolve(workspace, config.backend_root);
+    return fs.existsSync(candidate) && fs.statSync(candidate).isDirectory() ? candidate : null;
+  }
+
+  const sibling = path.resolve(workspace, '..', 'atrisos-backend');
+  if (fs.existsSync(sibling) && fs.statSync(sibling).isDirectory()) return sibling;
+  const installedSibling = path.resolve(__dirname, '..', '..', 'atrisos-backend');
+  return fs.existsSync(installedSibling) && fs.statSync(installedSibling).isDirectory() ? installedSibling : null;
+}
+
+module.exports = { BACKEND_ROOT_HINT, resolveBackendRoot };

package/utils/config.js

@@ -5,17 +5,18 @@ const path = require('path');
  * Get the path to atris/.config in the current project.
  * @returns {string} Config file path
  */
-function getConfigPath() {
-  const targetDir = path.join(process.cwd(), 'atris');
+function getConfigPath(root = process.cwd()) {
+  const targetDir = path.join(root, 'atris');
   return path.join(targetDir, '.config');
 }
 
 /**
  * Load config from atris/.config, returning empty object if missing/invalid.
+ * backend_root may name a backend folder relative to the workspace root.
  * @returns {Object} Config object
  */
-function loadConfig() {
-  const configPath = getConfigPath();
+function loadConfig(root = process.cwd()) {
+  const configPath = getConfigPath(root);
 
   if (!fs.existsSync(configPath)) {
     return {};

package/utils/owner-identity.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const os = require('os');
+const { spawnSync } = require('child_process');
+const { loadCredentials, profileNameFromEmail } = require('./auth');
+
+let cachedIdentity = null;
+
+function localUsername() {
+  try {
+    return os.userInfo().username;
+  } catch {
+    return process.env.USER || process.env.LOGNAME || null;
+  }
+}
+
+function gitUserName() {
+  const result = spawnSync('git', ['config', 'user.name'], { encoding: 'utf8' });
+  return result.status === 0 ? String(result.stdout || '').trim() : null;
+}
+
+function buildOwnerIdentity(credentials, username) {
+  const inheritedNames = String(process.env.ATRIS_OWNER_NAMES || '').split(',').map((name) => name.trim()).filter(Boolean);
+  const emailName = profileNameFromEmail(credentials?.email);
+  const configured = process.env.ATRIS_OPERATOR;
+  const fullName = credentials?.name || credentials?.full_name || credentials?.user_metadata?.full_name;
+  const loggedIn = Boolean(emailName || credentials?.username || credentials?.user_id || fullName);
+  const gitName = loggedIn ? null : gitUserName();
+  const gitFirstName = gitName ? gitName.split(/\s+/)[0] : null;
+  // Keep an existing local claim alias when it begins with the signed-in account name.
+  const localAlias = username && emailName?.length >= 4 && String(username).toLowerCase().startsWith(emailName)
+    ? username : null;
+  const values = [
+    ...inheritedNames, emailName, configured, credentials?.username, credentials?.user_id, fullName,
+    fullName?.replace(/\s+/g, ''), localAlias, gitName, gitName?.replace(/\s+/g, ''),
+    gitFirstName, loggedIn ? null : username,
+  ]
+    .filter(Boolean)
+    .map((value) => String(value).toLowerCase());
+  const slug = inheritedNames[0] || emailName || configured || gitFirstName || (loggedIn ? null : username);
+  return { slug: slug ? String(slug).toLowerCase() : null, names: values };
+}
+
+function ownerIdentity(credentials, username) {
+  if (arguments.length > 0) return buildOwnerIdentity(credentials, username === undefined ? localUsername() : username);
+  if (!cachedIdentity) cachedIdentity = buildOwnerIdentity(loadCredentials(), localUsername());
+  return cachedIdentity;
+}
+
+function resetOwnerIdentityCache() {
+  cachedIdentity = null;
+}
+
+function isOwner(value) {
+  const candidate = String(value || '').trim().toLowerCase();
+  if (['you', 'me', 'operator', 'human', 'owner'].includes(candidate)) return true;
+  const identity = ownerIdentity();
+  return identity.names.includes(candidate);
+}
+
+module.exports = { ownerIdentity, isOwner, resetOwnerIdentityCache };

package/atris/policies/LESSONS.md

@@ -1,13 +0,0 @@
-# LESSONS
-
-Purpose: Capture short, actionable lessons after REVIEW misses.
-
-## Rules
-- Add only after REVIEW when there was a miss, mismatch, or new constraint.
-- One line per lesson.
-- Format: YYYY-MM-DD | area | issue -> fix
-- Promote repeated lessons (2-3 times) into the relevant policy, then delete.
-
-## Entries
-- 2026-01-04 | meta | JSON edits break easily on quote boundaries → use Read tool to verify after Edit on .json files
-- 2026-01-28 | init | Meta-frameworks must be detected before base frameworks → Next.js check before React check (tests caught this)

package/atris/skills/autopilot/atris-autopilot.md

@@ -1,71 +0,0 @@
----
-description: Start autonomous loop - plan/do/review until done
-arguments:
-  - name: task
-    description: What to build (e.g., "Add dark mode toggle")
-    required: true
-  - name: max-iterations
-    description: Max loops before stopping (default 10)
-    required: false
----
-
-# Atris Autopilot
-
-You are entering **autonomous mode**. You will loop until the task is complete or max iterations reached.
-
-## Setup
-
-First, create the state file:
-
-```bash
-mkdir -p .claude
-cat > .claude/atris-autopilot.state.md << 'EOF'
----
-iteration: 1
-max_iterations: $ARGUMENTS.max-iterations|default:10
-completion_promise: <promise>COMPLETE</promise>
----
-
-$ARGUMENTS.task
-EOF
-```
-
-## Your Task
-
-**$ARGUMENTS.task**
-
-## Process
-
-Each iteration:
-1. **PLAN** — Read MAP.md, identify files, create approach
-2. **DO** — Implement ONE thing, commit changes
-3. **REVIEW** — Check acceptance criteria
-
-## Acceptance Criteria
-
-- Task implemented and working
-- Tests pass (if they exist)
-- Build passes
-- Code follows patterns in MAP.md
-
-## Rules
-
-- ONE thing per iteration (trust the loop)
-- Search MAP.md before grepping
-- Search codebase before assuming not implemented
-- Update TODO.md with progress
-- Log learnings to atris/logs/
-
-## Completion
-
-When ALL acceptance criteria pass, output exactly:
-
-```
-<promise>COMPLETE</promise>
-```
-
-This signals the stop hook to end the loop.
-
-## Start
-
-Read atris/MAP.md now. Then begin iteration 1.