atris 3.63.0 → 3.64.0

package/atris/skills/commerce/SKILL.md

@@ -13,6 +13,30 @@ You can quote and ask. Only the human can pay. Every dollar leaves only after
 the person acts themselves: a tap in their Link app, a payment page they
 fill in, or a text from their own phone.
 
+## Get a key
+
+The person mints a commerce key from their own signed-in CLI. It can ask for
+prices and start their approval. It can never pay.
+
+```bash
+atris login --agent --commerce --commerce-max-usd 150
+# scopes: commerce:quote, transactions:read
+# largest single quote: $150   (1 to 500, default 200)
+# this key can ask for prices and start your approval, it can never pay.
+```
+
+- Same machine: nothing else to do. The key is stored in its own slot
+  (`commerce_agent_token` in `~/.atris/credentials.json`), and `atris buy` and
+  `atris transactions` use it. Minting an x-search or YouTube key later does not
+  replace it.
+- Agent on another machine: add `--print-key` to show the key once. The person
+  hands it to the agent as `ATRIS_TOKEN` (CLI) or `ATRIS_API_KEY` (curl below).
+  Never paste it into a chat.
+- Narrower key: `--scopes commerce:quote` (quote, approve, status) or
+  `--scopes transactions:read` (history only).
+- Quotes over the key's cap are refused, and each key gets 50 quotes a day (UTC). A developer key (`atris api-key`) or the
+  person's own login also works, without those per-key limits.
+
 ## The loop
 
 1. Quote. `atris buy quote --kind <kind> [fields]`.

package/atris/skills/x-search/SKILL.md

@@ -49,7 +49,9 @@ atris x-search person --name "Leah Bonvissuto" --handle leahbon
 atris x-search --help
 ```
 
-Add `--json` for the raw API payload. Curl below is the raw API for debugging only.
+Every cited post is looked up on X for free (the public embed endpoint, 5s cap), whatever layout the answer uses. A cited post whose words appear in the answer is checked: its `https://x.com/<handle>/status/<id> (checked)` link prints under that post, or in a `Checked posts:` list when the answer is a table or prose. A quote of 40+ characters that matches no real post says `(could not find this post on X, treat as unverified)`; if X could not be reached it says so and is never called fake. Citations no post uses print as `Other sources:`. The last line is `posts: N checked, N unverified, N unknown`. `--no-check` skips the lookup. Bench it with `atris x-search bench --free` (0 credits) or `--quick` (5 credits).
+
+Add `--json` for the raw API payload (plus a `checks` list). Curl below is the raw API for debugging only.
 
 ## Bootstrap (ALWAYS Run First)
 

package/ax

@@ -5,6 +5,7 @@ const http = require('http');
 const https = require('https');
 const os = require('os');
 const path = require('path');
+const { stateHome } = require('./lib/state-home');
 const readline = require('readline');
 const crypto = require('crypto');
 const { Readable } = require('stream');
@@ -230,7 +231,7 @@ function createRunLogger({ cwd = process.cwd(), mode = 'pro', kind = 'play', out
 
   const baseDir = fs.existsSync(path.join(cwd, 'atris'))
     ? path.join(cwd, 'atris', 'runs')
-    : path.join(os.homedir(), '.atris', 'runs');
+    : path.join(stateHome(), '.atris', 'runs');
   fs.mkdirSync(baseDir, { recursive: true });
   const logPath = path.join(baseDir, `ax-${kind}-${timestampForFile()}.log`);
   fs.appendFileSync(logPath, [
@@ -995,7 +996,7 @@ function normalizeMode(mode) {
 function autoPickLogPath(options = {}) {
   return options.pickLogPath
     || process.env.ATRIS_ROUTER_PICKS_PATH
-    || path.join(os.homedir(), '.atris', 'ax-auto-picks.jsonl');
+    || path.join(stateHome(), '.atris', 'ax-auto-picks.jsonl');
 }
 
 function autoMessageWords(message) {
@@ -2328,7 +2329,7 @@ function formatTaskPreviewRows(receipt, options = {}) {
 }
 
 function approvalStorePath(options = {}) {
-  return options.storePath || process.env.AX_APPROVAL_STORE || path.join(os.homedir(), '.atris', 'ax-approvals.json');
+  return options.storePath || process.env.AX_APPROVAL_STORE || path.join(stateHome(), '.atris', 'ax-approvals.json');
 }
 
 function approvalMaxAgeMs(options = {}) {

package/bin/atris.js

@@ -1011,6 +1011,9 @@ function showAuthHelp(commandName) {
     console.log('  --agent                   Mint a scoped agent token from the stored login.');
     console.log('  --scopes <list>           Comma-separated scopes (default: x-search,youtube).');
     console.log('  --daily-credit-cap <n>    Daily credit cap (default: 50).');
+    console.log('  --commerce                Commerce key: scopes commerce:quote,transactions:read. Can quote, never pay.');
+    console.log('  --commerce-max-usd <n>    Largest single quote a commerce key may ask for, 1 to 500 (default: 200).');
+    console.log('  --print-key               Print the minted key once, for an agent on another machine.');
   } else if (commandName === 'switch') {
     console.log('  --global, -g     Switch the account for all terminals.');
   }
@@ -1856,9 +1859,15 @@ function showWelcomeVisualization() {
   // Every new chat sees which tool and model does each job, from the same
   // resolver as atris engine roster. A roster that cannot be read drops the
   // line; it never stops the boot.
+  // A roster worker that ends within seven days gets one line, so the job
+  // does not quietly fall to its backup when the date passes.
   try {
-    const teamLine = require('../lib/team-lineup').bootTeamLine(cwd, { width: 80 - 11 });
+    const engineView = require('../commands/engine');
+    const jobs = engineView.jobRosterView(cwd);
+    const teamLine = require('../lib/team-lineup').bootTeamLine(cwd, { width: 80 - 11, jobs });
     if (teamLine) console.log(row('team', teamLine));
+    const endsLine = engineView.bootExpiringLine(engineView.expiringWorkers(jobs));
+    if (endsLine) console.log(row('roster', endsLine));
   } catch {
     // Silent: the lineup is a hint, not a gate.
   }
@@ -2981,7 +2990,7 @@ if (command === 'guide') {
   const subcommand = process.argv[3];
   const args = process.argv.slice(4);
   Promise.resolve(require('../commands/member').memberCommand(subcommand, ...args))
-    .then(() => process.exit(subcommand === 'run' ? (process.exitCode || 0) : 0))
+    .then(() => process.exit(process.exitCode || 0))
     .catch((err) => { console.error(`✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'app') {
   const subcommand = process.argv[3];

package/cli/atris_code.py

@@ -12,11 +12,13 @@ from __future__ import annotations
 
 import argparse
 import asyncio
+import getpass
 import json
 import logging
 import os
 import subprocess
 import sys
+import tempfile
 import time
 from dataclasses import dataclass
 from pathlib import Path
@@ -36,7 +38,29 @@ RED = "\033[91m"
 
 PACKAGE_ROOT = Path(__file__).resolve().parent.parent
 TEAM_DIR = PACKAGE_ROOT / "atris" / "team"
-STATE_DIR = Path.home() / ".atris"
+
+
+def _same_dir(a: str, b: str) -> bool:
+    try:
+        return os.path.samefile(a, b)
+    except OSError:
+        return False
+
+
+def _state_home() -> Path:
+    """Mirror lib/state-home.js: a test run never writes the real ~/.atris."""
+    env, home = os.environ, Path.home()
+    under_test = env.get("NODE_TEST_CONTEXT") or env.get("ATRIS_TEST_STATE_DIR")
+    if env.get("ATRIS_TEST_REAL_HOME") == "1" or not under_test:
+        return home
+    real = [os.path.expanduser("~" + getpass.getuser()), env.get("ATRIS_TEST_PROTECTED_HOME", "")]
+    if not any(r and _same_dir(str(home), r) for r in real):
+        return home
+    user = os.getuid() if hasattr(os, "getuid") else getpass.getuser()
+    return Path(env.get("ATRIS_TEST_STATE_DIR") or os.path.join(tempfile.gettempdir(), f"atris-test-home-{user}"))
+
+
+STATE_DIR = _state_home() / ".atris"
 SESSION_STATE_FILE = STATE_DIR / "computer_sessions.json"
 AUDIT_LOG_FILE = STATE_DIR / "computer_audit.jsonl"
 RESUME_MAX_AGE_SECONDS = 6 * 60 * 60

package/commands/auth.js

@@ -8,6 +8,13 @@ const path = require('path');
 const AGENT_TOKEN_PATH = '/auth/agent-token';
 const DEFAULT_AGENT_SCOPES = ['x-search', 'youtube'];
 const DEFAULT_DAILY_CREDIT_CAP = 50;
+// Commerce keys can ask for prices and start the owner's approval. They can
+// never pay: every dollar still needs the owner's own tap or text. They live
+// in their own slot so an x-search or YouTube mint never overwrites them.
+const COMMERCE_QUOTE_SCOPE = 'commerce:quote';
+const COMMERCE_SCOPES = [COMMERCE_QUOTE_SCOPE, 'transactions:read'];
+const COMMERCE_MAX_USD_LIMIT = 500;
+const COMMERCE_NEVER_PAYS = 'this key can ask for prices and start your approval, it can never pay.';
 const NO_STORED_JWT_MESSAGE = 'not signed in. run atris login first.';
 
 function firstNonEmptyString(...values) {
@@ -23,8 +30,12 @@ function wantsAgentToken(args = []) {
   return first === 'agent-token';
 }
 
-function parseScopeList(raw) {
-  if (!raw) return [...DEFAULT_AGENT_SCOPES];
+function isCommerceKey(scopes = []) {
+  return Array.isArray(scopes) && scopes.some((scope) => COMMERCE_SCOPES.includes(String(scope)));
+}
+
+function parseScopeList(raw, fallback = DEFAULT_AGENT_SCOPES) {
+  if (!raw) return [...fallback];
   const scopes = String(raw).split(',').map((part) => part.trim()).filter(Boolean);
   if (scopes.length === 0) {
     throw new Error('scopes must list at least one value');
@@ -43,11 +54,29 @@ function parseDailyCreditCap(args) {
   return value;
 }
 
+function parseCommerceMaxUsd(args, scopes) {
+  const present = args.some((arg) => arg === '--commerce-max-usd' || String(arg).startsWith('--commerce-max-usd='));
+  if (!present) return null;
+  const raw = String(readFlag(args, '--commerce-max-usd', '')).replace(/^\$/, '');
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1 || value > COMMERCE_MAX_USD_LIMIT) {
+    throw new Error(`commerce max must be a whole dollar amount from 1 to ${COMMERCE_MAX_USD_LIMIT}`);
+  }
+  if (!scopes.includes(COMMERCE_QUOTE_SCOPE)) {
+    throw new Error('--commerce-max-usd needs the commerce:quote scope (try --commerce)');
+  }
+  return value;
+}
+
 function parseAgentTokenArgs(args = []) {
+  const commerce = hasFlag(args, '--commerce');
+  const scopes = parseScopeList(readFlag(args, '--scopes', ''), commerce ? COMMERCE_SCOPES : DEFAULT_AGENT_SCOPES);
   return {
     agent: wantsAgentToken(args),
-    scopes: parseScopeList(readFlag(args, '--scopes', '')),
+    scopes,
     dailyCreditCap: parseDailyCreditCap(args),
+    commerceMaxUsd: parseCommerceMaxUsd(args, scopes),
+    printKey: hasFlag(args, '--print-key'),
     json: wantsJson(args),
     help: hasFlag(args, '--help') || hasFlag(args, '-h') || args[0] === 'help',
   };
@@ -82,7 +111,14 @@ function extractAgentTokenMeta(data, requested, token) {
   const dailyCreditCap = Number.isFinite(Number(rawCap)) ? Number(rawCap) : requested.dailyCreditCap;
   const expiresAt = expiryFromValue(payload.expires_at ?? payload.expiry ?? payload.expires ?? payload.exp)
     || expiryFromValue(getTokenExpiryEpochSeconds(token));
-  return { scopes, dailyCreditCap, expiresAt };
+  const rawMax = payload.commerce_max_quote_usd;
+  const commerceMaxUsd = Number.isFinite(Number(rawMax)) && rawMax !== null && rawMax !== undefined
+    ? Number(rawMax)
+    : (requested.commerceMaxUsd || null);
+  const commerceDailyQuotes = Number.isFinite(Number(payload.commerce_daily_quotes)) && payload.commerce_daily_quotes != null
+    ? Number(payload.commerce_daily_quotes)
+    : null;
+  return { scopes, dailyCreditCap, expiresAt, commerceMaxUsd, commerceDailyQuotes };
 }
 
 function isAgentAccessToken(token) {
@@ -116,12 +152,22 @@ function persistMintedAgentToken(credentials, token, extras = {}) {
   if (isAgentAccessToken(credentials.token)) {
     throw new Error('Refusing to save a scoped agent token as the login token; keep it under agent_token');
   }
+  const slot = isCommerceKey(extras.scopes)
+    ? {
+      commerce_agent_token: token,
+      commerce_agent_token_scopes: extras.scopes || [],
+      commerce_agent_token_expires_at: extras.expiresAt || null,
+      commerce_max_quote_usd: extras.commerceMaxUsd || null,
+    }
+    : {
+      agent_token: token,
+      agent_token_scopes: extras.scopes || [],
+      agent_token_expires_at: extras.expiresAt || null,
+    };
   const next = {
     ...credentials,
     refresh_token: extras.refresh_token || credentials.refresh_token || null,
-    agent_token: token,
-    agent_token_scopes: extras.scopes || [],
-    agent_token_expires_at: extras.expiresAt || null,
+    ...slot,
   };
   if (credentials.source_profile) {
     saveProfile(credentials.source_profile, next);
@@ -132,10 +178,14 @@ function persistMintedAgentToken(credentials, token, extras = {}) {
 }
 
 function printAgentTokenMint(meta, output) {
-  output('minted scoped agent token');
+  const commerce = isCommerceKey(meta.scopes);
+  output(commerce ? 'minted commerce agent key' : 'minted scoped agent token');
   output(`scopes: ${meta.scopes.join(', ')}`);
+  if (meta.commerceMaxUsd) output(`largest single quote: $${meta.commerceMaxUsd}`);
+  if (meta.commerceDailyQuotes) output(`quotes per day: ${meta.commerceDailyQuotes}`);
   output(`daily credit cap: ${meta.dailyCreditCap}`);
   if (meta.expiresAt) output(`expires: ${meta.expiresAt}`);
+  if (commerce) output(COMMERCE_NEVER_PAYS);
 }
 
 function redactSecret(text, secret) {
@@ -175,10 +225,16 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     return { ok: false, code: 'not_logged_in', error: NO_STORED_JWT_MESSAGE };
   }
 
+  const commerceMaxUsd = Number.isInteger(requested.commerceMaxUsd) ? requested.commerceMaxUsd : null;
+  if (commerceMaxUsd !== null && !scopes.includes(COMMERCE_QUOTE_SCOPE)) {
+    return { ok: false, code: 'invalid_scopes', error: '--commerce-max-usd needs the commerce:quote scope' };
+  }
+
   const body = {
     scopes,
     daily_credit_cap: dailyCreditCap,
   };
+  if (commerceMaxUsd !== null) body.commerce_max_quote_usd = commerceMaxUsd;
   let authToken = isAgentAccessToken(accessToken) ? refreshToken : (accessToken || refreshToken);
   let result = await postAgentToken(api, authToken, body);
   if (!result.ok && result.status === 401 && refreshToken && authToken !== refreshToken) {
@@ -201,7 +257,7 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     return { ok: false, code: 'missing_token', error: 'backend did not return an agent token' };
   }
 
-  const meta = extractAgentTokenMeta(result.data, { scopes, dailyCreditCap }, minted);
+  const meta = extractAgentTokenMeta(result.data, { scopes, dailyCreditCap, commerceMaxUsd }, minted);
   persist(credentials, minted, {
     ...meta,
     refresh_token: firstNonEmptyString(result.data && result.data.refresh_token) || refreshToken,
@@ -212,7 +268,7 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     ok: true,
     token: minted,
     meta,
-    storedIn: credentials.source_profile ? `profile ${credentials.source_profile}, agent_token` : '~/.atris/credentials.json, agent_token',
+    storedIn: `${credentials.source_profile ? `profile ${credentials.source_profile}` : '~/.atris/credentials.json'}, ${isCommerceKey(meta.scopes) ? 'commerce_agent_token' : 'agent_token'}`,
   };
 }
 
@@ -276,6 +332,7 @@ async function mintAgentToken(args = [], deps = {}) {
   const minted = await mintScopedAgentToken({
     scopes: options.scopes,
     dailyCreditCap: options.dailyCreditCap,
+    commerceMaxUsd: options.commerceMaxUsd,
   }, deps);
 
   if (!minted.ok) {
@@ -302,12 +359,24 @@ async function mintAgentToken(args = [], deps = {}) {
       scopes: minted.meta.scopes,
       daily_credit_cap: minted.meta.dailyCreditCap,
       expires_at: minted.meta.expiresAt,
+      ...(isCommerceKey(minted.meta.scopes) ? {
+        commerce_max_quote_usd: minted.meta.commerceMaxUsd,
+        commerce_daily_quotes: minted.meta.commerceDailyQuotes,
+        can_pay: false,
+        note: COMMERCE_NEVER_PAYS,
+      } : {}),
+      ...(options.printKey ? { key: minted.token } : {}),
     }, null, 2));
     return 0;
   }
 
   printAgentTokenMint(minted.meta, output);
   output(`stored in ${minted.storedIn}`);
+  if (options.printKey) {
+    // Only on request: an outside agent needs the raw key once.
+    output('key (shown once, give it to the agent as ATRIS_TOKEN, do not paste it into chat):');
+    output(minted.token);
+  }
   return 0;
 }
 

package/commands/autoland.js

@@ -135,7 +135,16 @@ function runOwnCli(root, cliArgs, timeoutMs = 300000) {
   // target root or a global `atris` breaks whenever the tick runs a project
   // that isn't the CLI repo on a machine without a global install (CI, cron).
   const bin = path.resolve(__dirname, '..', 'bin', 'atris.js');
-  const result = spawnSync(process.execPath, [bin, ...cliArgs], { cwd: root, encoding: 'utf8', timeout: timeoutMs });
+  return spawnCapture([bin, ...cliArgs], { cwd: root, timeoutMs });
+}
+
+// spawnSync keeps 1 MB of stdout by default and kills the child past it
+// (ENOBUFS). A certify-and-land sweep over 150+ review rows prints more than
+// that, so the accept step read as unreadable on most ticks. Allow 64 MB.
+const OWN_CLI_MAX_BUFFER = 64 * 1024 * 1024;
+
+function spawnCapture(nodeArgs, { cwd, timeoutMs = 300000 } = {}) {
+  const result = spawnSync(process.execPath, nodeArgs, { cwd, encoding: 'utf8', timeout: timeoutMs, maxBuffer: OWN_CLI_MAX_BUFFER });
   return {
     status: result.status,
     stdout: String(result.stdout || ''),
@@ -1139,6 +1148,7 @@ module.exports = {
   digestNextMoves,
   acceptSweepTimeoutMs,
   describeAcceptKillCause,
+  spawnCapture,
   digestStoryRows,
   digestTickStatus,
   engineAnswerValidationLine,

package/commands/browse.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
+const { stateHome } = require('../lib/state-home');
 const { loadCredentials } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 
@@ -34,7 +34,7 @@ async function browseAtris() {
   if (!result.ok) {
     // API failed, try local templates
     console.log('  API unavailable, checking local templates...');
-    const localDir = path.join(os.homedir(), '.atris', 'templates');
+    const localDir = path.join(stateHome(), '.atris', 'templates');
     if (!fs.existsSync(localDir)) {
       console.error('  No templates found locally or from API.');
       process.exit(1);

package/commands/business.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const { stateHome } = require('../lib/state-home');
 const os = require('os');
 const { loadCredentials } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
@@ -18,8 +19,7 @@ function businessWorkspaceBase() {
 }
 
 function getBusinessConfigPath() {
-  const home = require('os').homedir();
-  const dir = path.join(home, '.atris');
+  const dir = path.join(stateHome(), '.atris');
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
   return path.join(dir, 'businesses.json');
 }
@@ -3139,7 +3139,7 @@ async function connectService(connector, ...flags) {
   }
 
   // Create local secrets directory
-  const secretsDir = path.join(require('os').homedir(), '.atris', 'secrets', connector);
+  const secretsDir = path.join(stateHome(), '.atris', 'secrets', connector);
   if (!fs.existsSync(secretsDir)) {
     fs.mkdirSync(secretsDir, { recursive: true });
     console.log(`\n  Created secrets dir: ${secretsDir}/`);

package/commands/buy.js

@@ -12,8 +12,8 @@
 
 const { apiRequestJson } = require('../utils/api');
 const { loadCredentials } = require('../utils/auth');
-const { NOT_LOGGED_IN, tokenFrom, oneLine, printResult } = require('../lib/developer-api');
-const { parseFlags, formatCents, untilText, errorFrom } = require('../lib/commerce');
+const { NOT_LOGGED_IN, oneLine, printResult } = require('../lib/developer-api');
+const { parseFlags, formatCents, untilText, errorFrom, commerceToken } = require('../lib/commerce');
 
 const KINDS = ['ticket', 'shop', 'trade', 'flight'];
 const NOTHING_CHARGED = 'Nothing is charged until the person approves it themselves.';
@@ -218,7 +218,7 @@ async function buyCommand(args = [], deps = {}) {
 
   const load = deps.loadCredentials || loadCredentials;
   const request = deps.apiRequestJson || apiRequestJson;
-  const token = tokenFrom(load());
+  const token = commerceToken(load(), 'commerce:quote', deps.now ? deps.now() : Date.now());
   if (!token) return fail(NOT_LOGGED_IN);
 
   try {

package/commands/deck.js

@@ -15,8 +15,8 @@
 
 const fs = require('fs');
 const https = require('https');
-const os = require('os');
 const path = require('path');
+const { stateHome } = require('../lib/state-home');
 const { hasFlag } = require('../lib/arg-parser');
 const { buildDeck, THEMES, notesRequests } = require('../lib/slides-deck');
 const {
@@ -34,7 +34,7 @@ const BASE = 'api.atris.ai';
 const PFX = '/api/integrations/google-slides';
 
 function token() {
-  try { return require(path.join(os.homedir(), '.atris/credentials.json')).token; }
+  try { return require(path.join(stateHome(), '.atris/credentials.json')).token; }
   catch { return null; }
 }