atris 3.62.0 → 3.64.0

package/atris/features/README.md

@@ -86,6 +86,14 @@ None.
 
 ### Completed Features
 
+#### youtube-notes
+Free, fast, checked notes from any YouTube link
+- **Files:** commands/youtube.js, scripts/det/ytnotes, scripts/det/ytquote-repair.js, test/ytnotes.test.js, test/ytquote-repair.test.js, test/youtube.test.js, atris/features/youtube-notes/*
+- **Status:** complete; the `atris youtube bench` scorecard is in review
+- **Keywords:** youtube, notes, captions, transcript, whisper, quotes
+- **What:** `atris youtube notes <url>` reads the real English captions, transcribes on an Apple silicon Mac when there are none, writes with the fastest installed AI, and checks every quote against the transcript
+- **Completed:** 2026-09-28
+
 #### audit-gaps
 Close remaining audit gaps from self-audit
 - **Files:** atris/team/*/MEMBER.md, atris/features/README.md, atris/features/audit-gaps/*

package/atris/skills/README.md

@@ -34,6 +34,7 @@ cp -r atris/skills/[name] ~/.codex/skills/
 | backend | Backend architecture policy | `policies/atris-backend.md` |
 | blocks | Author Atris block documents: docs, decks, reports | - |
 | calendar | Google Calendar via AtrisOS API | - |
+| commerce | Quote a purchase or stock order; the person approves before anything is charged | - |
 | copy-editor | Detects and fixes AI writing patterns | - |
 | create-app | Build and deploy an Atris app from a description | - |
 | create-member | Create and manage MEMBER.md team members | - |

package/atris/skills/commerce/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: commerce
+description: "Buy or trade through Atris for a person: get a quote, show it, the person approves, check status, read their transactions. Use when asked to buy tickets, buy an item from a store, place a stock order, or list what someone bought or traded. Triggers on buy, purchase, order, trade, stock order, transactions, what did I spend."
+version: 1.0.0
+tags:
+  - commerce
+  - money
+---
+
+# Commerce: buy or trade through Atris
+
+You can quote and ask. Only the human can pay. Every dollar leaves only after
+the person acts themselves: a tap in their Link app, a payment page they
+fill in, or a text from their own phone.
+
+## Get a key
+
+The person mints a commerce key from their own signed-in CLI. It can ask for
+prices and start their approval. It can never pay.
+
+```bash
+atris login --agent --commerce --commerce-max-usd 150
+# scopes: commerce:quote, transactions:read
+# largest single quote: $150   (1 to 500, default 200)
+# this key can ask for prices and start your approval, it can never pay.
+```
+
+- Same machine: nothing else to do. The key is stored in its own slot
+  (`commerce_agent_token` in `~/.atris/credentials.json`), and `atris buy` and
+  `atris transactions` use it. Minting an x-search or YouTube key later does not
+  replace it.
+- Agent on another machine: add `--print-key` to show the key once. The person
+  hands it to the agent as `ATRIS_TOKEN` (CLI) or `ATRIS_API_KEY` (curl below).
+  Never paste it into a chat.
+- Narrower key: `--scopes commerce:quote` (quote, approve, status) or
+  `--scopes transactions:read` (history only).
+- Quotes over the key's cap are refused, and each key gets 50 quotes a day (UTC). A developer key (`atris api-key`) or the
+  person's own login also works, without those per-key limits.
+
+## The loop
+
+1. Quote. `atris buy quote --kind <kind> [fields]`.
+2. Show the person the summary, total, fee and approval text. Word for word on money.
+3. Only after they say yes, approve. `atris buy approve <id> [fields]`.
+4. Hand the person the approval link (Link or payment page). For trades, tell them to check their texts: Atris sends the one-time code only to their own text thread, never to you. Nothing else pays.
+5. Check `atris buy status <id>` until the state is `done`, `failed`, `refunded` or `unknown`.
+6. `atris transactions` lists everything they bought, paid in fees, traded or sent.
+
+Add `--json` to any command for the raw response.
+
+## Kinds
+
+| kind | quote flags | approve flags | human approves by |
+|---|---|---|---|
+| `ticket` | `--event-url` (vividseats.com), `--quantity`, `--min-each-usd`, `--max-each-usd` | `--pick` (1-3 or ticket_id), `--delivery-email` | Link app, or payment page |
+| `shop` | `--query` or `--url`, `--quantity` | `--options '<json>'`, `--delivery-email`, `--address '<json>'` (US, once), `--accept-extras` | Link app |
+| `trade` | `--side` buy/sell, `--symbol`, `--quantity` or `--dollars`, `--order-type` market/limit, `--limit-price` | none | replying to Atris's text with the exact phrase from their own phone, within 5 minutes |
+| `flight` | not wired yet, quotes are refused | | |
+
+Any field can also go in as JSON: `--intent '{"kind":"shop","query":"navy tee"}'` for quotes,
+`--details '{"pick":"1"}'` for approve. Flags win over the JSON.
+
+## Rails (enforced in code, not by you)
+
+- Approval is always human. An API key cannot confirm a trade or approve a Link spend.
+- Caps: purchases up to `TEXT_TICKETS_MAX_USD` (default $400) and $500 per Link spend. Stocks: per-order and per-day caps, the Robinhood risk policy, market hours, no shorting, stocks only.
+- Quotes expire: 30 minutes for purchases, 10 for trades. A trade quote stages at most one order. Ask again after that.
+- A trade already waiting for the person's yes blocks a new one. Let them confirm or let it expire.
+- No retries. If a result is `unknown`, money may have moved. Tell the person to check the store or Robinhood app. Never buy again to "fix" it.
+- No advice on trades. Carry out only the person's own instruction.
+- For Link-mode orders, status may carry `fee_payment_url`: the page where the person pays the Atris fee. The CLI prints it as "Pay the Atris fee".
+- Status values from quote and approve: `quoted`, `pending_approval`, `needs_input` (ask the person for the named field), `needs_setup` (send them the connect link), `refused` (read the message to them).
+
+## With the CLI
+
+```bash
+# Tickets
+atris buy quote --kind ticket --event-url "https://www.vividseats.com/..." --quantity 2
+atris buy approve ord_<uuid> --pick 1 --delivery-email sam@example.com
+# -> Approve in Link: https://...   Nothing has been charged yet.
+
+# A store item
+atris buy quote --kind shop --query "uniqlo supima crew tee navy" --quantity 1
+
+# A stock order
+atris buy quote --kind trade --side buy --symbol VTI --dollars 25
+atris buy approve trq_<token>
+# -> We texted you a confirm code. Reply to that text to place the trade.
+
+# Status and history
+atris buy status ord_<uuid>
+atris transactions --since 2026-09-01 --kind ticket,shop,trade --limit 50
+# Quotes nobody approved are left out; add --include-quotes to see them.
+```
+
+## With curl
+
+```bash
+KEY="Authorization: Bearer $ATRIS_API_KEY"
+API=https://api.atris.ai/api
+
+curl -s -X POST $API/commerce/quote -H "$KEY" -H 'content-type: application/json' \
+  -d '{"kind":"ticket","event_url":"https://www.vividseats.com/...","quantity":2}'
+curl -s -X POST $API/commerce/ord_<uuid>/approve -H "$KEY" -H 'content-type: application/json' \
+  -d '{"pick":"1","delivery_email":"sam@example.com"}'
+# -> {"status":"pending_approval","approval":{"how":"link_app","url":"https://..."}}
+
+curl -s -X POST $API/commerce/quote -H "$KEY" -H 'content-type: application/json' \
+  -d '{"kind":"trade","side":"buy","symbol":"VTI","dollars":25}'
+curl -s -X POST $API/commerce/trq_<token>/approve -H "$KEY"
+# -> {"status":"pending_approval","approval":{"how":"text_confirm","text":"Check your texts. ..."}}
+
+curl -s $API/commerce/ord_<uuid> -H "$KEY"
+curl -s "$API/transactions?since=2026-09-01&kinds=ticket,shop,trade&limit=50" -H "$KEY"
+# Quotes nobody approved are left out; add &include_quotes=true to see them.
+```
+
+Each transaction: `id, kind, when, what, amount_cents, currency, state, counterparty, receipt_url`.
+`sources` says which ledgers loaded; if one says `failed`, the list is partial. Say so.
+The CLI prints that as "Partial list: could not load ...".

package/atris/skills/x-search/SKILL.md

@@ -49,7 +49,9 @@ atris x-search person --name "Leah Bonvissuto" --handle leahbon
 atris x-search --help
 ```
 
-Add `--json` for the raw API payload. Curl below is the raw API for debugging only.
+Every cited post is looked up on X for free (the public embed endpoint, 5s cap), whatever layout the answer uses. A cited post whose words appear in the answer is checked: its `https://x.com/<handle>/status/<id> (checked)` link prints under that post, or in a `Checked posts:` list when the answer is a table or prose. A quote of 40+ characters that matches no real post says `(could not find this post on X, treat as unverified)`; if X could not be reached it says so and is never called fake. Citations no post uses print as `Other sources:`. The last line is `posts: N checked, N unverified, N unknown`. `--no-check` skips the lookup. Bench it with `atris x-search bench --free` (0 credits) or `--quick` (5 credits).
+
+Add `--json` for the raw API payload (plus a `checks` list). Curl below is the raw API for debugging only.
 
 ## Bootstrap (ALWAYS Run First)
 

package/ax

@@ -5,6 +5,7 @@ const http = require('http');
 const https = require('https');
 const os = require('os');
 const path = require('path');
+const { stateHome } = require('./lib/state-home');
 const readline = require('readline');
 const crypto = require('crypto');
 const { Readable } = require('stream');
@@ -230,7 +231,7 @@ function createRunLogger({ cwd = process.cwd(), mode = 'pro', kind = 'play', out
 
   const baseDir = fs.existsSync(path.join(cwd, 'atris'))
     ? path.join(cwd, 'atris', 'runs')
-    : path.join(os.homedir(), '.atris', 'runs');
+    : path.join(stateHome(), '.atris', 'runs');
   fs.mkdirSync(baseDir, { recursive: true });
   const logPath = path.join(baseDir, `ax-${kind}-${timestampForFile()}.log`);
   fs.appendFileSync(logPath, [
@@ -995,7 +996,7 @@ function normalizeMode(mode) {
 function autoPickLogPath(options = {}) {
   return options.pickLogPath
     || process.env.ATRIS_ROUTER_PICKS_PATH
-    || path.join(os.homedir(), '.atris', 'ax-auto-picks.jsonl');
+    || path.join(stateHome(), '.atris', 'ax-auto-picks.jsonl');
 }
 
 function autoMessageWords(message) {
@@ -2328,7 +2329,7 @@ function formatTaskPreviewRows(receipt, options = {}) {
 }
 
 function approvalStorePath(options = {}) {
-  return options.storePath || process.env.AX_APPROVAL_STORE || path.join(os.homedir(), '.atris', 'ax-approvals.json');
+  return options.storePath || process.env.AX_APPROVAL_STORE || path.join(stateHome(), '.atris', 'ax-approvals.json');
 }
 
 function approvalMaxAgeMs(options = {}) {

package/bin/atris.js

@@ -717,6 +717,8 @@ function showHelpAll() {
   console.log('  usage      - Show developer API usage');
   console.log('  api-key    - Create, list, rotate, or revoke a developer API key');
   console.log('  topup      - Buy credits and print a Stripe checkout URL');
+  console.log('  buy        - Quote a purchase or stock order; the person approves before anything is charged');
+  console.log('  transactions - List what you bought, paid in fees, traded, or sent');
   console.log('  design     - Extract a site design system, check brand adherence, search brands');
   console.log('  mcp        - Run the atris MCP server (stdio) for Claude Desktop and Cursor');
   console.log('');
@@ -1009,6 +1011,9 @@ function showAuthHelp(commandName) {
     console.log('  --agent                   Mint a scoped agent token from the stored login.');
     console.log('  --scopes <list>           Comma-separated scopes (default: x-search,youtube).');
     console.log('  --daily-credit-cap <n>    Daily credit cap (default: 50).');
+    console.log('  --commerce                Commerce key: scopes commerce:quote,transactions:read. Can quote, never pay.');
+    console.log('  --commerce-max-usd <n>    Largest single quote a commerce key may ask for, 1 to 500 (default: 200).');
+    console.log('  --print-key               Print the minted key once, for an agent on another machine.');
   } else if (commandName === 'switch') {
     console.log('  --global, -g     Switch the account for all terminals.');
   }
@@ -1854,9 +1859,15 @@ function showWelcomeVisualization() {
   // Every new chat sees which tool and model does each job, from the same
   // resolver as atris engine roster. A roster that cannot be read drops the
   // line; it never stops the boot.
+  // A roster worker that ends within seven days gets one line, so the job
+  // does not quietly fall to its backup when the date passes.
   try {
-    const teamLine = require('../lib/team-lineup').bootTeamLine(cwd, { width: 80 - 11 });
+    const engineView = require('../commands/engine');
+    const jobs = engineView.jobRosterView(cwd);
+    const teamLine = require('../lib/team-lineup').bootTeamLine(cwd, { width: 80 - 11, jobs });
     if (teamLine) console.log(row('team', teamLine));
+    const endsLine = engineView.bootExpiringLine(engineView.expiringWorkers(jobs));
+    if (endsLine) console.log(row('roster', endsLine));
   } catch {
     // Silent: the lineup is a hint, not a gate.
   }
@@ -2368,6 +2379,15 @@ if (command === 'guide') {
   Promise.resolve(require('../commands/topup').topupCommand(process.argv.slice(3)))
     .then((code) => process.exit(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'buy') {
+  // Buy: quote, then hand the person the approval step. Never charges.
+  Promise.resolve(require('../commands/buy').buyCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'transactions') {
+  Promise.resolve(require('../commands/transactions').transactionsCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
 } else if (command === '_resolve') {
   // Hidden: resolve a profile name query → print exact profile name
   require('../commands/auth').resolveProfile();
@@ -2970,7 +2990,7 @@ if (command === 'guide') {
   const subcommand = process.argv[3];
   const args = process.argv.slice(4);
   Promise.resolve(require('../commands/member').memberCommand(subcommand, ...args))
-    .then(() => process.exit(subcommand === 'run' ? (process.exitCode || 0) : 0))
+    .then(() => process.exit(process.exitCode || 0))
     .catch((err) => { console.error(`✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'app') {
   const subcommand = process.argv[3];

package/cli/atris_code.py

@@ -12,11 +12,13 @@ from __future__ import annotations
 
 import argparse
 import asyncio
+import getpass
 import json
 import logging
 import os
 import subprocess
 import sys
+import tempfile
 import time
 from dataclasses import dataclass
 from pathlib import Path
@@ -36,7 +38,29 @@ RED = "\033[91m"
 
 PACKAGE_ROOT = Path(__file__).resolve().parent.parent
 TEAM_DIR = PACKAGE_ROOT / "atris" / "team"
-STATE_DIR = Path.home() / ".atris"
+
+
+def _same_dir(a: str, b: str) -> bool:
+    try:
+        return os.path.samefile(a, b)
+    except OSError:
+        return False
+
+
+def _state_home() -> Path:
+    """Mirror lib/state-home.js: a test run never writes the real ~/.atris."""
+    env, home = os.environ, Path.home()
+    under_test = env.get("NODE_TEST_CONTEXT") or env.get("ATRIS_TEST_STATE_DIR")
+    if env.get("ATRIS_TEST_REAL_HOME") == "1" or not under_test:
+        return home
+    real = [os.path.expanduser("~" + getpass.getuser()), env.get("ATRIS_TEST_PROTECTED_HOME", "")]
+    if not any(r and _same_dir(str(home), r) for r in real):
+        return home
+    user = os.getuid() if hasattr(os, "getuid") else getpass.getuser()
+    return Path(env.get("ATRIS_TEST_STATE_DIR") or os.path.join(tempfile.gettempdir(), f"atris-test-home-{user}"))
+
+
+STATE_DIR = _state_home() / ".atris"
 SESSION_STATE_FILE = STATE_DIR / "computer_sessions.json"
 AUDIT_LOG_FILE = STATE_DIR / "computer_audit.jsonl"
 RESUME_MAX_AGE_SECONDS = 6 * 60 * 60

package/commands/auth.js

@@ -8,6 +8,13 @@ const path = require('path');
 const AGENT_TOKEN_PATH = '/auth/agent-token';
 const DEFAULT_AGENT_SCOPES = ['x-search', 'youtube'];
 const DEFAULT_DAILY_CREDIT_CAP = 50;
+// Commerce keys can ask for prices and start the owner's approval. They can
+// never pay: every dollar still needs the owner's own tap or text. They live
+// in their own slot so an x-search or YouTube mint never overwrites them.
+const COMMERCE_QUOTE_SCOPE = 'commerce:quote';
+const COMMERCE_SCOPES = [COMMERCE_QUOTE_SCOPE, 'transactions:read'];
+const COMMERCE_MAX_USD_LIMIT = 500;
+const COMMERCE_NEVER_PAYS = 'this key can ask for prices and start your approval, it can never pay.';
 const NO_STORED_JWT_MESSAGE = 'not signed in. run atris login first.';
 
 function firstNonEmptyString(...values) {
@@ -23,8 +30,12 @@ function wantsAgentToken(args = []) {
   return first === 'agent-token';
 }
 
-function parseScopeList(raw) {
-  if (!raw) return [...DEFAULT_AGENT_SCOPES];
+function isCommerceKey(scopes = []) {
+  return Array.isArray(scopes) && scopes.some((scope) => COMMERCE_SCOPES.includes(String(scope)));
+}
+
+function parseScopeList(raw, fallback = DEFAULT_AGENT_SCOPES) {
+  if (!raw) return [...fallback];
   const scopes = String(raw).split(',').map((part) => part.trim()).filter(Boolean);
   if (scopes.length === 0) {
     throw new Error('scopes must list at least one value');
@@ -43,11 +54,29 @@ function parseDailyCreditCap(args) {
   return value;
 }
 
+function parseCommerceMaxUsd(args, scopes) {
+  const present = args.some((arg) => arg === '--commerce-max-usd' || String(arg).startsWith('--commerce-max-usd='));
+  if (!present) return null;
+  const raw = String(readFlag(args, '--commerce-max-usd', '')).replace(/^\$/, '');
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1 || value > COMMERCE_MAX_USD_LIMIT) {
+    throw new Error(`commerce max must be a whole dollar amount from 1 to ${COMMERCE_MAX_USD_LIMIT}`);
+  }
+  if (!scopes.includes(COMMERCE_QUOTE_SCOPE)) {
+    throw new Error('--commerce-max-usd needs the commerce:quote scope (try --commerce)');
+  }
+  return value;
+}
+
 function parseAgentTokenArgs(args = []) {
+  const commerce = hasFlag(args, '--commerce');
+  const scopes = parseScopeList(readFlag(args, '--scopes', ''), commerce ? COMMERCE_SCOPES : DEFAULT_AGENT_SCOPES);
   return {
     agent: wantsAgentToken(args),
-    scopes: parseScopeList(readFlag(args, '--scopes', '')),
+    scopes,
     dailyCreditCap: parseDailyCreditCap(args),
+    commerceMaxUsd: parseCommerceMaxUsd(args, scopes),
+    printKey: hasFlag(args, '--print-key'),
     json: wantsJson(args),
     help: hasFlag(args, '--help') || hasFlag(args, '-h') || args[0] === 'help',
   };
@@ -82,7 +111,14 @@ function extractAgentTokenMeta(data, requested, token) {
   const dailyCreditCap = Number.isFinite(Number(rawCap)) ? Number(rawCap) : requested.dailyCreditCap;
   const expiresAt = expiryFromValue(payload.expires_at ?? payload.expiry ?? payload.expires ?? payload.exp)
     || expiryFromValue(getTokenExpiryEpochSeconds(token));
-  return { scopes, dailyCreditCap, expiresAt };
+  const rawMax = payload.commerce_max_quote_usd;
+  const commerceMaxUsd = Number.isFinite(Number(rawMax)) && rawMax !== null && rawMax !== undefined
+    ? Number(rawMax)
+    : (requested.commerceMaxUsd || null);
+  const commerceDailyQuotes = Number.isFinite(Number(payload.commerce_daily_quotes)) && payload.commerce_daily_quotes != null
+    ? Number(payload.commerce_daily_quotes)
+    : null;
+  return { scopes, dailyCreditCap, expiresAt, commerceMaxUsd, commerceDailyQuotes };
 }
 
 function isAgentAccessToken(token) {
@@ -116,12 +152,22 @@ function persistMintedAgentToken(credentials, token, extras = {}) {
   if (isAgentAccessToken(credentials.token)) {
     throw new Error('Refusing to save a scoped agent token as the login token; keep it under agent_token');
   }
+  const slot = isCommerceKey(extras.scopes)
+    ? {
+      commerce_agent_token: token,
+      commerce_agent_token_scopes: extras.scopes || [],
+      commerce_agent_token_expires_at: extras.expiresAt || null,
+      commerce_max_quote_usd: extras.commerceMaxUsd || null,
+    }
+    : {
+      agent_token: token,
+      agent_token_scopes: extras.scopes || [],
+      agent_token_expires_at: extras.expiresAt || null,
+    };
   const next = {
     ...credentials,
     refresh_token: extras.refresh_token || credentials.refresh_token || null,
-    agent_token: token,
-    agent_token_scopes: extras.scopes || [],
-    agent_token_expires_at: extras.expiresAt || null,
+    ...slot,
   };
   if (credentials.source_profile) {
     saveProfile(credentials.source_profile, next);
@@ -132,10 +178,14 @@ function persistMintedAgentToken(credentials, token, extras = {}) {
 }
 
 function printAgentTokenMint(meta, output) {
-  output('minted scoped agent token');
+  const commerce = isCommerceKey(meta.scopes);
+  output(commerce ? 'minted commerce agent key' : 'minted scoped agent token');
   output(`scopes: ${meta.scopes.join(', ')}`);
+  if (meta.commerceMaxUsd) output(`largest single quote: $${meta.commerceMaxUsd}`);
+  if (meta.commerceDailyQuotes) output(`quotes per day: ${meta.commerceDailyQuotes}`);
   output(`daily credit cap: ${meta.dailyCreditCap}`);
   if (meta.expiresAt) output(`expires: ${meta.expiresAt}`);
+  if (commerce) output(COMMERCE_NEVER_PAYS);
 }
 
 function redactSecret(text, secret) {
@@ -175,10 +225,16 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     return { ok: false, code: 'not_logged_in', error: NO_STORED_JWT_MESSAGE };
   }
 
+  const commerceMaxUsd = Number.isInteger(requested.commerceMaxUsd) ? requested.commerceMaxUsd : null;
+  if (commerceMaxUsd !== null && !scopes.includes(COMMERCE_QUOTE_SCOPE)) {
+    return { ok: false, code: 'invalid_scopes', error: '--commerce-max-usd needs the commerce:quote scope' };
+  }
+
   const body = {
     scopes,
     daily_credit_cap: dailyCreditCap,
   };
+  if (commerceMaxUsd !== null) body.commerce_max_quote_usd = commerceMaxUsd;
   let authToken = isAgentAccessToken(accessToken) ? refreshToken : (accessToken || refreshToken);
   let result = await postAgentToken(api, authToken, body);
   if (!result.ok && result.status === 401 && refreshToken && authToken !== refreshToken) {
@@ -201,7 +257,7 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     return { ok: false, code: 'missing_token', error: 'backend did not return an agent token' };
   }
 
-  const meta = extractAgentTokenMeta(result.data, { scopes, dailyCreditCap }, minted);
+  const meta = extractAgentTokenMeta(result.data, { scopes, dailyCreditCap, commerceMaxUsd }, minted);
   persist(credentials, minted, {
     ...meta,
     refresh_token: firstNonEmptyString(result.data && result.data.refresh_token) || refreshToken,
@@ -212,7 +268,7 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     ok: true,
     token: minted,
     meta,
-    storedIn: credentials.source_profile ? `profile ${credentials.source_profile}, agent_token` : '~/.atris/credentials.json, agent_token',
+    storedIn: `${credentials.source_profile ? `profile ${credentials.source_profile}` : '~/.atris/credentials.json'}, ${isCommerceKey(meta.scopes) ? 'commerce_agent_token' : 'agent_token'}`,
   };
 }
 
@@ -276,6 +332,7 @@ async function mintAgentToken(args = [], deps = {}) {
   const minted = await mintScopedAgentToken({
     scopes: options.scopes,
     dailyCreditCap: options.dailyCreditCap,
+    commerceMaxUsd: options.commerceMaxUsd,
   }, deps);
 
   if (!minted.ok) {
@@ -302,12 +359,24 @@ async function mintAgentToken(args = [], deps = {}) {
       scopes: minted.meta.scopes,
       daily_credit_cap: minted.meta.dailyCreditCap,
       expires_at: minted.meta.expiresAt,
+      ...(isCommerceKey(minted.meta.scopes) ? {
+        commerce_max_quote_usd: minted.meta.commerceMaxUsd,
+        commerce_daily_quotes: minted.meta.commerceDailyQuotes,
+        can_pay: false,
+        note: COMMERCE_NEVER_PAYS,
+      } : {}),
+      ...(options.printKey ? { key: minted.token } : {}),
     }, null, 2));
     return 0;
   }
 
   printAgentTokenMint(minted.meta, output);
   output(`stored in ${minted.storedIn}`);
+  if (options.printKey) {
+    // Only on request: an outside agent needs the raw key once.
+    output('key (shown once, give it to the agent as ATRIS_TOKEN, do not paste it into chat):');
+    output(minted.token);
+  }
   return 0;
 }
 

package/commands/autoland.js

@@ -135,7 +135,16 @@ function runOwnCli(root, cliArgs, timeoutMs = 300000) {
   // target root or a global `atris` breaks whenever the tick runs a project
   // that isn't the CLI repo on a machine without a global install (CI, cron).
   const bin = path.resolve(__dirname, '..', 'bin', 'atris.js');
-  const result = spawnSync(process.execPath, [bin, ...cliArgs], { cwd: root, encoding: 'utf8', timeout: timeoutMs });
+  return spawnCapture([bin, ...cliArgs], { cwd: root, timeoutMs });
+}
+
+// spawnSync keeps 1 MB of stdout by default and kills the child past it
+// (ENOBUFS). A certify-and-land sweep over 150+ review rows prints more than
+// that, so the accept step read as unreadable on most ticks. Allow 64 MB.
+const OWN_CLI_MAX_BUFFER = 64 * 1024 * 1024;
+
+function spawnCapture(nodeArgs, { cwd, timeoutMs = 300000 } = {}) {
+  const result = spawnSync(process.execPath, nodeArgs, { cwd, encoding: 'utf8', timeout: timeoutMs, maxBuffer: OWN_CLI_MAX_BUFFER });
   return {
     status: result.status,
     stdout: String(result.stdout || ''),
@@ -1139,6 +1148,7 @@ module.exports = {
   digestNextMoves,
   acceptSweepTimeoutMs,
   describeAcceptKillCause,
+  spawnCapture,
   digestStoryRows,
   digestTickStatus,
   engineAnswerValidationLine,

package/commands/browse.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
+const { stateHome } = require('../lib/state-home');
 const { loadCredentials } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 
@@ -34,7 +34,7 @@ async function browseAtris() {
   if (!result.ok) {
     // API failed, try local templates
     console.log('  API unavailable, checking local templates...');
-    const localDir = path.join(os.homedir(), '.atris', 'templates');
+    const localDir = path.join(stateHome(), '.atris', 'templates');
     if (!fs.existsSync(localDir)) {
       console.error('  No templates found locally or from API.');
       process.exit(1);

package/commands/business.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const { stateHome } = require('../lib/state-home');
 const os = require('os');
 const { loadCredentials } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
@@ -18,8 +19,7 @@ function businessWorkspaceBase() {
 }
 
 function getBusinessConfigPath() {
-  const home = require('os').homedir();
-  const dir = path.join(home, '.atris');
+  const dir = path.join(stateHome(), '.atris');
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
   return path.join(dir, 'businesses.json');
 }
@@ -3139,7 +3139,7 @@ async function connectService(connector, ...flags) {
   }
 
   // Create local secrets directory
-  const secretsDir = path.join(require('os').homedir(), '.atris', 'secrets', connector);
+  const secretsDir = path.join(stateHome(), '.atris', 'secrets', connector);
   if (!fs.existsSync(secretsDir)) {
     fs.mkdirSync(secretsDir, { recursive: true });
     console.log(`\n  Created secrets dir: ${secretsDir}/`);