atris 3.63.0 → 3.65.0

package/commands/x-search.js

@@ -4,7 +4,9 @@ const fs = require('fs');
 const path = require('path');
 const { apiRequestJson } = require('../utils/api');
 const { ensureBilledCommandAuth } = require('./auth');
+const { spawnSync } = require('child_process');
 const applyGate = require('../lib/apply-gate');
+const { checkXPosts, annotateContent, formatTally } = require('../lib/x-post-check');
 const {
   fileTeachExperiment,
   extractTeachNumbers,
@@ -23,9 +25,10 @@ const KEEP_RULE = 'keep only if measure.py moves 0→1. scores 1 only when the f
 
 function showXSearchHelp(output = console.log, commandName = 'atris x-search') {
   output('');
-  output(`Usage: ${commandName} "<query>" [--limit N] [--days N] [--save] [--json]`);
-  output(`       ${commandName} person --name <name> [--handle <h>] [--company <c>] [--context <text>] [--save] [--json]`);
+  output(`Usage: ${commandName} "<query>" [--limit N] [--days N] [--save] [--json] [--no-check]`);
+  output(`       ${commandName} person --name <name> [--handle <h>] [--company <c>] [--context <text>] [--save] [--json] [--no-check]`);
   output(`       ${commandName} unsave <query-or-source>`);
+  output(`       ${commandName} bench [--quick|--free]`);
   output('');
   output(`Search X/Twitter via Atris (${COST_HINT}).`);
   output('Requires login. Same auth path as atris youtube process.');
@@ -33,13 +36,15 @@ function showXSearchHelp(output = console.log, commandName = 'atris x-search') {
   output('--save files a brief only when the result is rich.');
   output('unsave deletes the filed brief, apply stub, and matching experiment pack (no paid calls).');
   output('Empty or failed search prints credits refunded only when the server marks a refund.');
+  output('Each quoted post is looked up on X for free and marked checked, unverified, or unknown.');
   output('');
   output('Options:');
   output('  --limit <n>         Max results hint (search only)');
   output('  --days <n>          Only tweets from the last N days (search only)');
   output('  --save              File brief, journal, apply; rich results mint a keep/revert experiment');
   output('  --unsave            Delete filed brief, apply stub, and matching experiment pack (no paid calls)');
-  output('  --json              Print the raw JSON response');
+  output('  --json              Print the raw JSON response (plus a checks list)');
+  output('  --no-check          Skip looking up the quoted posts on X');
   output('  -h, --help          This help');
   output('');
   output('Person options:');
@@ -55,6 +60,7 @@ function showXSearchHelp(output = console.log, commandName = 'atris x-search') {
   output(`  ${commandName} person --name "Leah Bonvissuto" --handle leahbon`);
   output(`  ${commandName} unsave "MCP agents"`);
   output(`  ${commandName} --unsave "MCP agents"`);
+  output(`  ${commandName} bench --free`);
   output('');
 }
 
@@ -81,6 +87,7 @@ function parseSearchArgs(argv = []) {
     json: false,
     save: false,
     unsave: false,
+    check: true,
     query: null,
     limit: null,
     daysBack: null,
@@ -100,6 +107,8 @@ function parseSearchArgs(argv = []) {
       options.json = true;
     } else if (arg === '--save') {
       options.save = true;
+    } else if (arg === '--no-check') {
+      options.check = false;
     } else if (arg === '--unsave') {
       options.unsave = true;
     } else if (arg === '--limit') {
@@ -153,6 +162,7 @@ function parsePersonArgs(argv = []) {
     help: false,
     json: false,
     save: false,
+    check: true,
     name: null,
     handle: null,
     company: null,
@@ -173,6 +183,8 @@ function parsePersonArgs(argv = []) {
       options.json = true;
     } else if (arg === '--save') {
       options.save = true;
+    } else if (arg === '--no-check') {
+      options.check = false;
     } else if (arg === '--name') {
       options.name = readValue(args, i, arg);
       i++;
@@ -592,23 +604,26 @@ function ensureXSearchApply({ cwd, source, packRel, now, output } = {}) {
   });
 }
 
-function formatXSearchResult(data) {
+// check is the result of checkXPosts. With it, each post carries its own
+// link or warning, and citations no post uses are listed as other sources.
+function formatXSearchResult(data, check = null) {
   const lines = [];
   const content = xSearchContent(data);
   const citations = xSearchCitations(data);
 
   if (content) {
-    lines.push(content);
+    lines.push(check ? annotateContent(content, check) : content);
   } else if (data?.message) {
     lines.push(String(data.message).trim());
   } else {
     lines.push('X search completed');
   }
 
-  if (citations.length) {
+  const listed = check ? check.otherSources : citations;
+  if (listed.length) {
     lines.push('');
-    lines.push('Citations:');
-    for (const cite of citations) {
+    lines.push(check ? 'Other sources:' : 'Citations:');
+    for (const cite of listed) {
       lines.push(`  ${cite}`);
     }
   }
@@ -619,9 +634,54 @@ function formatXSearchResult(data) {
     lines.push(...creditLines);
   }
 
+  if (check) {
+    lines.push('');
+    lines.push(formatTally(check.tally));
+  }
+
   return lines.join('\n');
 }
 
+// Look the quoted posts up on X. Free, and never fatal: any failure means no
+// check, and the original output prints unchanged.
+async function checkXSearchPosts(data, options, deps = {}) {
+  if (options.check === false) return null;
+  try {
+    return await (deps.checkXPosts || checkXPosts)({
+      content: xSearchContent(data),
+      citations: xSearchCitations(data),
+      fetchPost: deps.fetchPost,
+      fetch: deps.fetch,
+    });
+  } catch {
+    return null;
+  }
+}
+
+function renderXSearchResult(data, check) {
+  if (check) {
+    try {
+      return formatXSearchResult(data, check);
+    } catch {
+      // fall through to the original output
+    }
+  }
+  return formatXSearchResult(data);
+}
+
+function runXSearchBench(argv, deps = {}) {
+  const run = (deps.spawnSync || spawnSync)(
+    process.execPath,
+    [path.join(__dirname, '..', 'scripts', 'det', 'xsearch-bench.js'), ...argv],
+    { stdio: 'inherit' },
+  );
+  if (run.error) {
+    (deps.output || console.error)(`bench did not start: ${run.error.message}`);
+    return 1;
+  }
+  return typeof run.status === 'number' ? run.status : 1;
+}
+
 function formatEmptyXSearchResult(data) {
   const lines = ['no results'];
   const creditLines = formatCreditsLines(xSearchCredits(data));
@@ -634,6 +694,11 @@ function formatEmptyXSearchResult(data) {
 
 async function xSearchCommand(argv = process.argv.slice(3), deps = {}) {
   const output = deps.output || ((line = '') => console.log(line));
+  if (argv[0] === 'bench') {
+    const code = runXSearchBench(argv.slice(1), deps);
+    if (!deps.output && !deps.spawnSync) process.exit(code);
+    return code;
+  }
   let options;
   try {
     options = parseXSearchArgs(argv);
@@ -655,10 +720,14 @@ async function xSearchCommand(argv = process.argv.slice(3), deps = {}) {
   try {
     const data = await runXSearch(options, deps);
     const hasResults = xSearchHasResults(data);
+    const check = hasResults ? await checkXSearchPosts(data, options, deps) : null;
     if (options.json) {
-      output(JSON.stringify(data, null, 2));
+      const withChecks = check && data && typeof data === 'object' && !Array.isArray(data)
+        ? { ...data, checks: check.checks }
+        : data;
+      output(JSON.stringify(withChecks, null, 2));
     } else {
-      output(hasResults ? formatXSearchResult(data) : formatEmptyXSearchResult(data));
+      output(hasResults ? renderXSearchResult(data, check) : formatEmptyXSearchResult(data));
     }
     if (!hasResults) {
       if (
@@ -734,5 +803,7 @@ module.exports = {
   xSearchExperimentSlug,
   xSearchExperimentRel,
   unsaveXSearch,
+  formatXSearchResult,
+  runXSearchBench,
   xSearchCommand,
 };

package/commands/youtube.js

@@ -5,6 +5,7 @@ const { spawnSync } = require('child_process');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { stateHome } = require('../lib/state-home');
 const https = require('https');
 
 const YTNOTES_USAGE = 'usage: ytnotes <youtube-url> [youtube-url-or-playlist...] [auto|gemini|haiku|atris-fast|grok|codex|cursor]';
@@ -2256,7 +2257,7 @@ function searchCacheTtlMs(deps = {}) {
 
 function resolveSearchCachePath(deps = {}) {
   if (deps.searchCachePath) return deps.searchCachePath;
-  const homeDir = deps.homeDir || os.homedir();
+  const homeDir = deps.homeDir || stateHome();
   return path.join(homeDir, '.atris', LOCAL_SEARCH_CACHE_FILE);
 }
 

package/lib/auto-accept-certified.js

@@ -457,8 +457,61 @@ function parseVerifyCommand(verify) {
   };
 }
 
+// Members record checks as one command or several joined with `&&`
+// ("npm run test:a && node scripts/test-b.mjs"). Each step must pass the
+// same allowlist on its own; `&&` only runs them in order and stops at the
+// first failure, still with shell:false, so a chain can do nothing its steps
+// could not do one at a time. One leading `cd` applies to every step.
+const MAX_VERIFY_CHAIN_STEPS = 8;
+
+function splitTopLevelAnd(command) {
+  const parts = [];
+  let current = '';
+  let quote = null;
+  for (let i = 0; i < command.length; i += 1) {
+    const char = command[i];
+    if (quote) {
+      if (char === quote) quote = null;
+      current += char;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (char === '&' && command[i + 1] === '&') {
+      parts.push(current.trim());
+      current = '';
+      i += 1;
+      continue;
+    }
+    current += char;
+  }
+  parts.push(current.trim());
+  return parts;
+}
+
+function parseVerifyChain(verify) {
+  const cmd = String(verify || '').trim();
+  if (!cmd) return { ok: false, reason: 'no_verify_command' };
+  const prefixed = parseCdPrefix(cmd);
+  if (!prefixed.ok) return prefixed;
+  const parts = splitTopLevelAnd(prefixed.command);
+  if (parts.length > MAX_VERIFY_CHAIN_STEPS || parts.some((part) => !part || /^cd(\s|$)/.test(part))) {
+    return { ok: false, reason: 'verify_command_not_allowed' };
+  }
+  const steps = [];
+  for (const part of parts) {
+    const parsed = parseVerifyCommand(part);
+    if (!parsed.ok) return parsed;
+    steps.push({ ...parsed, ...(prefixed.cwd ? { cwd: prefixed.cwd } : {}) });
+  }
+  return { ok: true, steps, ...(prefixed.cwd ? { cwd: prefixed.cwd } : {}) };
+}
+
 function isAutoCertifyVerifyCommandAllowed(verify) {
-  return parseVerifyCommand(verify).ok;
+  return parseVerifyChain(verify).ok;
 }
 
 // Re-entrancy guard: every verify child carries ATRIS_VERIFY_IN_PROGRESS=1
@@ -468,12 +521,20 @@ function isAutoCertifyVerifyCommandAllowed(verify) {
 // `atris task status` and the read path re-ran the verify. Refuse loudly.
 const VERIFY_IN_PROGRESS_ENV = 'ATRIS_VERIFY_IN_PROGRESS';
 
-// Spawn cap: a single CLI process has no legitimate reason to run dozens of
-// verifies. Beyond the cap something is looping; refuse and report instead
-// of silently bounding.
-const VERIFY_SPAWN_CAP = 25;
+// Spawn cap: bounds a runaway loop inside one process. The recursion that
+// fork-bombed the fleet is stopped by VERIFY_IN_PROGRESS_ENV above; this cap
+// is the backstop. It was 25, which starved the review queue: every hourly
+// tick re-checked the same first 25 rows and the other 141 waiting rows were
+// refused as verify_spawn_cap forever (measured 2026-10-01). Override with
+// ATRIS_VERIFY_SPAWN_CAP.
+const DEFAULT_VERIFY_SPAWN_CAP = 150;
 let verifySpawnCount = 0;
 
+function verifySpawnCap() {
+  const raw = Number(process.env.ATRIS_VERIFY_SPAWN_CAP);
+  return Number.isInteger(raw) && raw > 0 ? Math.min(raw, 1000) : DEFAULT_VERIFY_SPAWN_CAP;
+}
+
 function verifyRefusal(unrunnableCause, extra) {
   return {
     ok: false,
@@ -490,14 +551,26 @@ function runVerifyCommand(verify, workspaceRoot) {
       detail: `${VERIFY_IN_PROGRESS_ENV} is set: a verify is already running up the call chain; refusing to nest another one`,
     });
   }
-  if (verifySpawnCount >= VERIFY_SPAWN_CAP) {
+  const chain = parseVerifyChain(verify);
+  if (!chain.ok) return chain;
+  let result = null;
+  for (const step of chain.steps) {
+    result = runVerifyStep(step, workspaceRoot);
+    if (!result.ok) {
+      return chain.steps.length > 1 ? { ...result, failed_step: step.argv.join(' ') } : result;
+    }
+  }
+  return result;
+}
+
+function runVerifyStep(parsed, workspaceRoot) {
+  const cap = verifySpawnCap();
+  if (verifySpawnCount >= cap) {
     return verifyRefusal('verify_spawn_cap', {
-      detail: `this process already ran ${verifySpawnCount} verifies (cap ${VERIFY_SPAWN_CAP}); refusing more`,
+      detail: `this process already ran ${verifySpawnCount} verifies (cap ${cap}); refusing more`,
     });
   }
   verifySpawnCount += 1;
-  const parsed = parseVerifyCommand(verify);
-  if (!parsed.ok) return parsed;
   const cwdCheck = validateCommandCwd(parsed, workspaceRoot);
   if (!cwdCheck.ok) return cwdCheck;
   const gitPathCheck = validateGitWorktreePath(parsed.argv, workspaceRoot, cwdCheck.cwd);
@@ -1250,6 +1323,7 @@ module.exports = {
   sniffedProtectedLane,
   evaluateAutoAccept,
   isAutoCertifyVerifyCommandAllowed,
+  parseVerifyChain,
   isAgentCertified,
   parseVerifyCommand,
   repoHygieneGate,

package/lib/autoland.js

@@ -7,6 +7,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { stateHome } = require('./state-home');
 const os = require('os');
 const { spawnSync } = require('child_process');
 const { computeTrustTier } = require('./trust-tiers');
@@ -189,7 +190,7 @@ function buildCronLine(root) {
   const node = process.execPath;
   const bin = path.join(root, 'bin', 'atris.js');
   const cliBin = fs.existsSync(bin) ? bin : 'atris';
-  const logDir = path.join(os.homedir(), '.atris', 'overnight');
+  const logDir = path.join(stateHome(), '.atris', 'overnight');
   const logFile = path.join(logDir, `autoland-${path.basename(root)}.log`);
   const invoke = cliBin.endsWith('.js') ? `${node} ${cliBin}` : cliBin;
   return `14 * * * * cd ${root} && ${invoke} autoland tick >> ${logFile} 2>&1 # ${cronMarker(root)}`;
@@ -210,7 +211,7 @@ function cronInstalled(root) {
 }
 
 function installCron(root) {
-  fs.mkdirSync(path.join(os.homedir(), '.atris', 'overnight'), { recursive: true });
+  fs.mkdirSync(path.join(stateHome(), '.atris', 'overnight'), { recursive: true });
   const marker = cronMarker(root);
   const kept = readCrontab().split(/\r?\n/).filter((line) => line.trim() && !line.includes(marker));
   const next = `${kept.join('\n')}${kept.length ? '\n' : ''}${buildCronLine(root)}\n`;

package/lib/ax-auto-lane.js

@@ -1,8 +1,8 @@
 'use strict';
 
 const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
+const { stateHome } = require('./state-home');
 
 const SHORT_LOOKUP_MAX_CHARS = 140;
 const LONG_INPUT_MIN_CHARS = 1200;
@@ -75,7 +75,7 @@ function overrideMatches(text, override) {
 function loadOverrides(filePath) {
   const resolved = filePath
     || process.env.ATRIS_ROUTER_OVERRIDES_PATH
-    || path.join(os.homedir(), '.atris', 'router-overrides.json');
+    || path.join(stateHome(), '.atris', 'router-overrides.json');
   try {
     const parsed = JSON.parse(fs.readFileSync(resolved, 'utf8'));
     return Array.isArray(parsed) ? parsed : [];

package/lib/brief-rules.js

@@ -0,0 +1,11 @@
+'use strict';
+
+// Rule lines every builder brief carries (lib/codex-flight.js buildPrompt and
+// lib/fleet.js buildFleetPrompt). The text lives here once so the two briefs
+// cannot drift apart.
+const SHARED_BRIEF_RULES = [
+  '- Keep one concern per PR; split anything larger into separate PRs because git history guides future agents and small PRs are cheap to revert and bisect.',
+  '- A guard, limit, or cache must hold on every path to the thing it protects; grep for the other callers, templates, and writers, and test at least one path you were not pointed at.',
+];
+
+module.exports = { SHARED_BRIEF_RULES };

package/lib/business-target.js

@@ -0,0 +1,131 @@
+'use strict';
+
+// Shared plumbing for business-scoped HTTP commands (`atris hire`, `atris hires`,
+// `atris mail`): parse flags, find which business to act on, get a login token.
+// These commands are HTTP clients of /api/business/{id}/...; no backend code here.
+
+const { apiRequestJson } = require('../utils/api');
+const { ensureValidCredentials } = require('../utils/auth');
+const { findBusiness } = require('../commands/feed');
+const { oneLine } = require('./developer-api');
+
+const NO_BUSINESS = 'no business here. run this inside a business folder, or add --business <slug>';
+
+// --help, --json and --business are allowed on every command.
+const COMMON_SWITCHES = ['help', 'json'];
+const COMMON_VALUES = ['business'];
+
+// --key value, --key=value, and yes/no switches that never take a value.
+// `spec` is { switches: [...], values: [...] }: the only flags the command
+// takes, beyond the common ones. Anything else comes back as `error`, and
+// the command must stop before making any request:
+//   an unknown flag (--dry-run on a command without it),
+//   a value on a switch (--yes=false is refused, never read as yes),
+//   a value flag with nothing after it (--business ""),
+//   the same value flag twice.
+// A plain array is the old lenient form (switch names only), kept for callers
+// that want it; it never reports errors.
+function parseArgs(argv = [], spec = []) {
+  const strict = !Array.isArray(spec);
+  const switchNames = strict ? (spec.switches || []) : spec;
+  const valueNames = strict ? (spec.values || []) : [];
+  const switches = new Set([...switchNames, ...COMMON_SWITCHES, 'yes']);
+  const allowed = new Set([...switchNames, ...valueNames, ...COMMON_SWITCHES, ...COMMON_VALUES]);
+  const flags = {};
+  const pos = [];
+  let error = '';
+  const fail = (message) => { if (!error) error = message; };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = String(argv[i]);
+    if (arg === '-h') { flags.help = true; continue; }
+    if (arg === '-y') {
+      if (strict && !allowed.has('yes')) fail('unknown option -y');
+      else flags.yes = true;
+      continue;
+    }
+    if (arg.startsWith('--')) {
+      const eq = arg.indexOf('=');
+      const raw = eq > 0 ? arg.slice(0, eq) : arg;
+      const key = raw.slice(2).replace(/-/g, '_');
+      if (strict && !allowed.has(key)) { fail(`unknown option ${raw}`); continue; }
+      if (switches.has(key)) {
+        if (eq < 0) flags[key] = true;
+        else if (strict) fail(`${raw} is a switch and takes no value: use ${raw} on its own, or leave it off`);
+        else flags[key] = arg.slice(eq + 1);
+        continue;
+      }
+      let value = true;
+      if (eq > 0) value = arg.slice(eq + 1);
+      else if (argv[i + 1] != null && !String(argv[i + 1]).startsWith('--')) { value = String(argv[i + 1]); i += 1; }
+      if (strict && (typeof value !== 'string' || !value.trim())) { fail(`${raw} needs a value`); continue; }
+      if (strict && Object.prototype.hasOwnProperty.call(flags, key)) { fail(`${raw} was given twice`); continue; }
+      flags[key] = value;
+      continue;
+    }
+    if (strict && arg.length > 1 && arg.startsWith('-')) { fail(`unknown option ${arg}`); continue; }
+    pos.push(arg);
+  }
+  return strict ? { flags, pos, error } : { flags, pos };
+}
+
+// A --business that was given must name a business. An empty or missing
+// value is an error and never falls back to the current folder's business.
+// Without --business: the nearest .atris/business.json above the current
+// folder. Returns { id, name }, { error }, or null when none is found.
+function resolveBusiness(flags = {}, deps = {}) {
+  if (Object.prototype.hasOwnProperty.call(flags, 'business')) {
+    const given = typeof flags.business === 'string' ? flags.business.trim() : '';
+    if (!given) return { error: '--business needs a business slug or id' };
+    return { id: given, name: given };
+  }
+  const found = (deps.findBusiness || findBusiness)(deps.cwd || process.cwd());
+  return found && found.businessId ? { id: found.businessId, name: found.name || 'this business' } : null;
+}
+
+// The business to act on, or says why not (through `err`) and returns null.
+function businessOrSay(flags, deps, err) {
+  const business = resolveBusiness(flags, deps);
+  if (!business) { err(NO_BUSINESS); return null; }
+  if (business.error) { err(business.error); return null; }
+  return business;
+}
+
+async function loginToken(deps = {}) {
+  if (deps.token) return deps.token;
+  const ensure = deps.ensureCredentials || (() => ensureValidCredentials(apiRequestJson));
+  const auth = await ensure();
+  return auth && !auth.error && auth.credentials && auth.credentials.token ? auth.credentials.token : '';
+}
+
+// FastAPI errors arrive as {"detail": "..."}; keep them to one plain line.
+function errorText(result) {
+  if (!result) return 'request failed';
+  if (Number(result.status) === 404 && !(result.data && result.data.detail)) {
+    return 'backend rolling out, try again shortly';
+  }
+  return oneLine((result.data && (result.data.detail || result.data.error)) || result.error || `request failed (${result.status})`);
+}
+
+// "2026-10-02T09:00:00+00:00" -> "in 9 h" / "6 h ago"
+function relativeTime(iso, now = Date.now()) {
+  const at = Date.parse(iso || '');
+  if (!Number.isFinite(at)) return '';
+  const mins = Math.round((at - now) / 60000);
+  const abs = Math.abs(mins);
+  const span = abs < 1 ? 'now' : abs < 90 ? `${abs} min` : abs < 48 * 60 ? `${Math.round(abs / 60)} h` : `${Math.round(abs / 1440)} days`;
+  if (span === 'now') return 'just now';
+  return mins >= 0 ? `in ${span}` : `${span} ago`;
+}
+
+function dollars(value) {
+  if (value == null || !Number.isFinite(Number(value))) return '-';
+  const n = Number(value);
+  return Number.isInteger(n) ? `$${n}` : `$${n.toFixed(2)}`;
+}
+
+function clip(text, width) {
+  const s = String(text == null ? '' : text).replace(/\s+/g, ' ').trim();
+  return s.length > width ? `${s.slice(0, width - 1)}…` : s;
+}
+
+module.exports = { NO_BUSINESS, parseArgs, resolveBusiness, businessOrSay, loginToken, errorText, relativeTime, dollars, clip };

package/lib/chat-log-scan.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { stateHome } = require('./state-home');
 
 const SCHEMA = 'atris.chat_scan.v1';
 const PROMPT_LINE = /^(?:max|pro|fast|code-fast)\s*›\s*(.+)$/i;
@@ -73,7 +74,7 @@ function axLogDirs(cwd = process.cwd(), options = {}) {
   const local = path.join(cwd, 'atris', 'runs');
   if (fs.existsSync(local)) dirs.push(local);
   if (options.global) {
-    const home = path.join(os.homedir(), '.atris', 'runs');
+    const home = path.join(stateHome(), '.atris', 'runs');
     if (fs.existsSync(home) && home !== local) dirs.push(home);
   }
   return dirs;

package/lib/ci-runner.js

@@ -2,6 +2,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { stateHome } = require('./state-home');
 const os = require('node:os');
 const https = require('node:https');
 const { spawn, spawnSync } = require('node:child_process');
@@ -9,7 +10,7 @@ const { spawn, spawnSync } = require('node:child_process');
 const RUNNER_VERSION = '2.336.0';
 const GITHUB_API_VERSION = '2026-03-10';
 
-function usageFilePath(home = os.homedir()) {
+function usageFilePath(home = stateHome()) {
   return path.join(home, '.atris', 'ci', 'usage.jsonl');
 }
 
@@ -309,7 +310,7 @@ async function ensureRunner(options = {}) {
   const version = options.version || RUNNER_VERSION;
   const platform = options.platform || process.platform;
   const arch = options.arch || process.arch;
-  const home = options.home || os.homedir();
+  const home = options.home || stateHome();
   const log = options.log || console.log;
   const asset = runnerAssetName(platform, arch, version);
   const runnerPlatform = platform === 'darwin' ? 'osx' : platform;

package/lib/codex-flight.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawn, spawnSync } = require('child_process');
+const { SHARED_BRIEF_RULES } = require('./brief-rules');
 
 // Worktree flights need full file access to edit and ship the requested repo.
 const FLIGHT_SANDBOX = 'danger-full-access';
@@ -59,7 +60,7 @@ function buildPrompt({ worktreePath, branch, brief, verifyCmd }) {
     '',
     'Instructions:',
     `- First run: atris worktree guard`,
-    '- Keep one concern per PR; split anything larger into separate PRs because git history guides future agents and small PRs are cheap to revert and bisect.',
+    ...SHARED_BRIEF_RULES,
     `- Verify with this bare command and use its real exit code: ${verify}`,
     '- Stage and commit only files you changed.',
     `- Commit with a plain-English message and include this trailer: ${COAUTHOR}`,

package/lib/commerce.js

@@ -3,7 +3,8 @@
 // Shared helpers for `atris buy` and `atris transactions`.
 // Backend: /api/commerce/* and /api/transactions (commerce_router.py).
 
-const { ROLLOUT_MESSAGE, oneLine } = require('./developer-api');
+const { ROLLOUT_MESSAGE, oneLine, tokenFrom } = require('./developer-api');
+const { decodeJwtClaims } = require('../utils/auth');
 
 // Flags whose values the backend reads as numbers.
 const NUMERIC_KEYS = new Set(['quantity', 'dollars', 'limit_price', 'min_each_usd', 'max_each_usd', 'limit']);
@@ -72,4 +73,18 @@ function errorFrom(result) {
   return oneLine(result && result.error);
 }
 
-module.exports = { parseFlags, formatCents, untilText, errorFrom };
+// The commerce key (minted with `atris login --agent --commerce`) when it is
+// present, unexpired, and carries the scope this call needs; else the login.
+function commerceToken(creds, scope, now = Date.now()) {
+  const key = creds && typeof creds.commerce_agent_token === 'string' ? creds.commerce_agent_token.trim() : '';
+  if (key) {
+    const claims = decodeJwtClaims(key) || {};
+    const scopes = Array.isArray(claims.scopes) ? claims.scopes
+      : (Array.isArray(creds.commerce_agent_token_scopes) ? creds.commerce_agent_token_scopes : []);
+    const expiry = Number.isFinite(claims.exp) ? claims.exp * 1000 : Date.parse(creds.commerce_agent_token_expires_at || '');
+    if (scopes.includes(scope) && Number.isFinite(expiry) && expiry > now) return key;
+  }
+  return tokenFrom(creds);
+}
+
+module.exports = { parseFlags, formatCents, untilText, errorFrom, commerceToken };

package/lib/deck-history.js

@@ -4,11 +4,11 @@
 // you track iterations of a spec over time.
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
+const { stateHome } = require('./state-home');
 const crypto = require('crypto');
 
-const DEFAULT_HISTORY_PATH = path.join(os.homedir(), '.atris', 'deck-history.jsonl');
+const DEFAULT_HISTORY_PATH = path.join(stateHome(), '.atris', 'deck-history.jsonl');
 
 // Short, stable content hash of a spec, same spec -> same hash, so you can
 // tell a no-op rebuild from a real change.

package/lib/deck-review.js

@@ -6,13 +6,13 @@
 
 const fs = require('fs');
 const https = require('https');
-const os = require('os');
 const path = require('path');
+const { stateHome } = require('./state-home');
 
 const SCHEMA = 'atris.deck_review.v1';
 const RECEIPT_SCHEMA = 'atris.deck_receipt.v1';
-const DEFAULT_OUT_ROOT = path.join(os.homedir(), '.atris', 'deck-review');
-const DEFAULT_RECEIPTS_PATH = path.join(os.homedir(), '.atris', 'deck-receipts.jsonl');
+const DEFAULT_OUT_ROOT = path.join(stateHome(), '.atris', 'deck-review');
+const DEFAULT_RECEIPTS_PATH = path.join(stateHome(), '.atris', 'deck-receipts.jsonl');
 
 const AGENT_CHECKLIST = [
   'Heading and sub do not overlap',