atris 3.65.0 → 3.67.0

package/commands/auth.js

@@ -1,7 +1,8 @@
-const { AGENT_TOKEN_EXPIRED_DETAIL, decodeJwtClaims, loadCredentials, saveCredentials, deleteCredentials, getCredentialsPath, openBrowser, promptUser, displayAccountSummary, ensureValidCredentials, loadProfile, listProfiles, profileNameFromEmail, deleteProfile, saveProfile, getTokenExpiryEpochSeconds, getTerminalSessionId, setSessionProfile, getSessionProfile, clearSessionProfile, cleanStaleSessions, getSessionsDir } = require('../utils/auth');
+const { AGENT_TOKEN_EXPIRED_DETAIL, decodeJwtClaims, loadCredentials, saveCredentials, saveAgentClientCredentials, preserveAgentClientLogin, deleteCredentials, getCredentialsPath, openBrowser, promptUser, displayAccountSummary, ensureValidCredentials, loadProfile, listProfiles, profileNameFromEmail, deleteProfile, saveProfile, getTokenExpiryEpochSeconds, getTerminalSessionId, setSessionProfile, getSessionProfile, clearSessionProfile, cleanStaleSessions, getSessionsDir } = require('../utils/auth');
 const { getAppBaseUrl, apiRequestJson } = require('../utils/api');
 const { isNonInteractive, wantsJson } = require('../lib/noninteractive');
 const { hasFlag, readFlag } = require('../lib/arg-parser');
+const agentClient = require('../utils/agent-client');
 const fs = require('fs');
 const path = require('path');
 
@@ -128,7 +129,8 @@ function isAgentAccessToken(token) {
 function scopedTokenCandidate(credentials = {}) {
   if (credentials.agent_token) return credentials.agent_token;
   if (
-    credentials.source === 'env'
+    credentials.source === agentClient.AUTH_TYPE
+    || credentials.source === 'env'
     || credentials.source === 'agent_token_file'
     || isAgentAccessToken(credentials.token)
   ) {
@@ -290,11 +292,16 @@ async function ensureBilledCommandAuth(scope, deps = {}) {
   const scopes = claims?.scopes || credentials.agent_token_scopes || credentials.scopes || [];
   const expiry = claims?.exp
     ? claims.exp * 1000
-    : Date.parse(credentials.agent_token_expires_at || credentials.expires_at);
+    : Date.parse(credentials.agent_token_expires_at || credentials.expires_at || credentials.token_expires_at);
   if (!deps.forceMint && candidate && Array.isArray(scopes) && scopes.includes(wanted) && Number.isFinite(expiry) && expiry > Date.now()) {
     return { ok: true, token: candidate, minted: false, credentials };
   }
 
+  if (credentials.source === agentClient.AUTH_TYPE) {
+    // An agent client cannot mint itself more scope; the owner grants it.
+    return { ok: false, error: `this agent client does not have the ${wanted} scope. ask its owner to create one that does.` };
+  }
+
   if (!canMintFromLogin(credentials)) {
     return { ok: false, error: NO_STORED_JWT_MESSAGE };
   }
@@ -382,6 +389,26 @@ async function mintAgentToken(args = [], deps = {}) {
 
 async function printWhoamiPayload(asJson) {
   const ensured = await ensureValidCredentials(apiRequestJson);
+  if (!ensured.error && ensured.source === 'agent_client') {
+    const creds = ensured.credentials || {};
+    const payload = {
+      ok: true,
+      logged_in: true,
+      auth_type: agentClient.AUTH_TYPE,
+      client_id: creds.client_id,
+      scopes: creds.scopes || [],
+      token_expires_at: creds.token_expires_at || null,
+    };
+    if (asJson) {
+      console.log(JSON.stringify(payload, null, 2));
+    } else {
+      console.log('Status: Logged in ✓ (agent client)');
+      console.log(`Client ID: ${payload.client_id}`);
+      console.log(`Scopes: ${payload.scopes.length ? payload.scopes.join(', ') : 'unknown'}`);
+      if (payload.token_expires_at) console.log(`Token renews before: ${payload.token_expires_at}`);
+    }
+    process.exit(0);
+  }
   if (ensured.error) {
     if (!asJson && ensured.detail === AGENT_TOKEN_EXPIRED_DETAIL) {
       console.error('the agent key expired.');
@@ -430,6 +457,144 @@ async function printWhoamiPayload(asJson) {
   process.exit(0);
 }
 
+function flagPresent(args, name) {
+  return args.some((arg) => arg === name || String(arg).startsWith(`${name}=`));
+}
+
+function envValue(env, name) {
+  return typeof env[name] === 'string' ? env[name].trim() : '';
+}
+
+// Decide whether this `atris login` is an agent client sign-in. Returns null
+// for every other login path so those stay exactly as they were.
+function agentClientLoginRequest(args = [], env = process.env) {
+  if (flagPresent(args, '--client-secret')) {
+    return { error: 'do not put the secret on the command line. use --client-secret-file <path> or ATRIS_CLIENT_SECRET.' };
+  }
+  const usesFlags = flagPresent(args, '--client-id') || flagPresent(args, '--client-secret-file');
+  const envId = envValue(env, 'ATRIS_CLIENT_ID');
+  if (!usesFlags && (!envId || flagPresent(args, '--token') || wantsAgentToken(args))) return null;
+  const clientId = readFlag(args, '--client-id', '') || envId;
+  if (!clientId) return { error: '--client-id needs a client id (atc_...)' };
+  if (!clientId.startsWith(agentClient.CLIENT_ID_PREFIX)) {
+    return { error: `client ids start with ${agentClient.CLIENT_ID_PREFIX}` };
+  }
+  const flagFile = readFlag(args, '--client-secret-file', '');
+  if (flagPresent(args, '--client-secret-file') && !flagFile) {
+    return { error: '--client-secret-file needs a path' };
+  }
+  const secretFile = flagFile || envValue(env, 'ATRIS_CLIENT_SECRET_FILE');
+  if (!secretFile && !envValue(env, 'ATRIS_CLIENT_SECRET')) {
+    return { error: 'no client secret. pass --client-secret-file <path>, or set ATRIS_CLIENT_SECRET_FILE or ATRIS_CLIENT_SECRET.' };
+  }
+  return {
+    clientId,
+    secretFile: secretFile ? path.resolve(secretFile) : null,
+    scope: agentClient.scopeList(readFlag(args, '--scope', '') || readFlag(args, '--scopes', '')).join(' ') || null,
+  };
+}
+
+// Keep the person's own login reachable with `atris switch` after the agent
+// client takes over credentials.json.
+function keepHumanLoginAsProfile(nextClientId) {
+  try {
+    const stored = JSON.parse(fs.readFileSync(getCredentialsPath(), 'utf8'));
+    if (agentClient.isAgentClientCredential(stored)) {
+      // A different agent client was signed in: keep it switchable too.
+      return stored.client_id === nextClientId ? null : preserveAgentClientLogin();
+    }
+    if (!stored || !stored.token) return null;
+    const name = profileNameFromEmail(stored.email);
+    if (!name) return null;
+    if (!loadProfile(name)) saveProfile(name, stored);
+    return name;
+  } catch {
+    return null;
+  }
+}
+
+async function loginAgentClient(request, deps = {}) {
+  const env = deps.env || process.env;
+  const json = Boolean(deps.json);
+  const output = deps.output || console.log;
+  const outputError = deps.outputError || console.error;
+  const fail = (message, code) => {
+    if (json) output(JSON.stringify({ ok: false, logged_in: false, error: code || 'agent_client_login_failed', detail: message }, null, 2));
+    else outputError(message);
+    return 1;
+  };
+
+  const warnings = [];
+  if (request.secretFile) {
+    let stat;
+    try {
+      stat = fs.statSync(request.secretFile);
+    } catch (error) {
+      return fail(`could not read the client secret file ${request.secretFile}${error.code ? ` (${error.code})` : ''}`, 'secret_missing');
+    }
+    if (!stat.isFile()) return fail(`${request.secretFile} is not a file`, 'secret_missing');
+    if (process.platform !== 'win32' && (stat.mode & 0o077)) {
+      warnings.push(`other users on this machine can read ${request.secretFile}. run: chmod 600 ${request.secretFile}`);
+    }
+  }
+
+  const pending = {
+    auth_type: agentClient.AUTH_TYPE,
+    client_id: request.clientId,
+    client_secret_file: request.secretFile,
+    client_secret_env: request.secretFile ? null : 'ATRIS_CLIENT_SECRET',
+    scope: request.scope,
+  };
+
+  let secret;
+  let entry;
+  try {
+    secret = agentClient.readClientSecret(pending, env);
+    entry = await agentClient.requestClientToken({ clientId: request.clientId, secret, scope: request.scope }, deps);
+  } catch (error) {
+    return fail(agentClient.scrub(error && error.message, [secret]), error && error.code);
+  }
+
+  let secretFile = request.secretFile;
+  let copiedSecretTo = null;
+  if (!secretFile) {
+    // The secret came from ATRIS_CLIENT_SECRET. Keep a private copy so later
+    // commands can renew without the variable.
+    secretFile = agentClient.managedSecretPath(request.clientId);
+    agentClient.writeFileAtomic(secretFile, `${secret}\n`);
+    copiedSecretTo = secretFile;
+  }
+
+  const keptProfile = keepHumanLoginAsProfile(request.clientId);
+  saveAgentClientCredentials({ client_id: request.clientId, client_secret_file: secretFile, scope: request.scope });
+  agentClient.writeTokenCache(request.clientId, entry);
+
+  const scopes = agentClient.scopeList(entry.scope);
+  if (envValue(env, 'ATRIS_TOKEN')) {
+    warnings.push('ATRIS_TOKEN is set in this shell and takes priority. unset it to use the agent client.');
+  }
+  if (json) {
+    output(JSON.stringify({
+      ok: true,
+      logged_in: true,
+      auth_type: agentClient.AUTH_TYPE,
+      client_id: request.clientId,
+      scopes,
+      token_expires_at: entry.expires_at,
+      ...(copiedSecretTo ? { secret_copied_to: copiedSecretTo } : {}),
+      warnings,
+    }, null, 2));
+    return 0;
+  }
+  output(`signed in as agent client ${request.clientId}`);
+  output(`scopes: ${scopes.length ? scopes.join(', ') : 'all granted to this client'}`);
+  output('the token renews on its own before it runs out.');
+  if (copiedSecretTo) output(`copied the secret from ATRIS_CLIENT_SECRET to ${copiedSecretTo} (only you can read it).`);
+  if (keptProfile) output(`the previous login is saved. switch back: atris switch ${keptProfile} --global`);
+  warnings.forEach((line) => outputError(line));
+  return 0;
+}
+
 async function loginAtris(options = {}) {
   // Support: atris login --token <token> --force
   const args = process.argv.slice(3);
@@ -440,6 +605,16 @@ async function loginAtris(options = {}) {
   const nonInteractive = isNonInteractive(args);
 
   try {
+    const clientLogin = agentClientLoginRequest(args, process.env);
+    if (clientLogin) {
+      if (clientLogin.error) {
+        if (asJson) console.log(JSON.stringify({ ok: false, logged_in: false, error: clientLogin.error }, null, 2));
+        else console.error(clientLogin.error);
+        process.exit(1);
+      }
+      process.exit(await loginAgentClient(clientLogin, { json: asJson }));
+    }
+
     const existing = loadCredentials();
 
     if (wantsAgentToken(args)) {
@@ -487,12 +662,13 @@ async function loginAtris(options = {}) {
           email,
           user_id: userId,
           provider,
+          ...(existing.client_id ? { auth_type: agentClient.AUTH_TYPE, client_id: existing.client_id } : {}),
           credentials_saved: existing.saved_at || null,
           next: 'atris whoami --json',
         }, null, 2));
         process.exit(0);
       }
-      console.log(`Currently signed in as: ${email || userId || 'unknown'}`);
+      console.log(`Currently signed in as: ${email || userId || (existing.client_id ? `agent client ${existing.client_id}` : 'unknown')}`);
       if (provider) console.log(`Provider: ${provider}`);
       console.log('Next: atris whoami');
       process.exit(0);
@@ -608,11 +784,17 @@ function logoutAtris() {
     process.exit(0);
   }
 
+  if (credentials.from_env) {
+    console.log(`This agent client (${credentials.client_id}) comes from ATRIS_CLIENT_ID in your environment.`);
+    console.log('Unset ATRIS_CLIENT_ID to sign it out.');
+    process.exit(0);
+  }
+
   const profiles = listProfiles();
   const currentName = profileNameFromEmail(credentials?.email);
 
   deleteCredentials();
-  console.log(`✓ Signed out from ${credentials.email || 'current account'}`);
+  console.log(`✓ Signed out from ${credentials.email || (credentials.client_id ? `agent client ${credentials.client_id}` : 'current account')}`);
 
   // Remind about other profiles
   const remaining = profiles.filter(p => p !== currentName);
@@ -658,14 +840,14 @@ async function switchAccount() {
   }
 
   const current = loadCredentials();
-  const currentName = profileNameFromEmail(current?.email);
+  const currentName = activeProfileName(current);
 
   if (!targetName) {
     // Interactive: show list and let user pick
     console.log('Switch account:\n');
     profiles.forEach((name, i) => {
       const profile = loadProfile(name);
-      const email = profile?.email || 'unknown';
+      const email = profile ? profileLabel(profile, 'unknown') : 'unknown';
       const marker = name === currentName ? '  ← active' : '';
       console.log(`  ${i + 1}. ${name}, ${email}${marker}`);
     });
@@ -709,6 +891,32 @@ async function switchAccount() {
   return activateProfile(match, currentName, { global: globalFlag });
 }
 
+// A profile can be switched to if it has a login token or is a saved agent client.
+function usableProfile(profile) {
+  return Boolean(profile && (profile.token || agentClient.isAgentClientCredential(profile)));
+}
+
+function profileLabel(profile, name) {
+  if (profile?.email) return profile.email;
+  if (agentClient.isAgentClientCredential(profile)) return `agent client ${profile.client_id}`;
+  return name;
+}
+
+function activeProfileName(credentials) {
+  if (agentClient.isAgentClientCredential(credentials)) return agentClient.profileNameForClient(credentials.client_id);
+  return profileNameFromEmail(credentials?.email);
+}
+
+// Overwrite credentials.json with a profile. An agent client login there is
+// saved as a profile first, so its token cache and secret file stay reachable.
+function writeGlobalCredentials(profile) {
+  const kept = preserveAgentClientLogin();
+  const credentialsPath = getCredentialsPath();
+  fs.writeFileSync(credentialsPath, JSON.stringify(profile, null, 2));
+  try { fs.chmodSync(credentialsPath, 0o600); } catch {}
+  return kept;
+}
+
 function activateProfile(name, currentName, { global = false } = {}) {
   if (name === currentName) {
     console.log(`Already on "${name}".`);
@@ -716,21 +924,20 @@ function activateProfile(name, currentName, { global = false } = {}) {
   }
 
   const profile = loadProfile(name);
-  if (!profile || !profile.token) {
+  if (!usableProfile(profile)) {
     console.error(`Profile "${name}" is corrupted. Run "atris login" to fix.`);
     process.exit(1);
   }
 
   if (global || !getTerminalSessionId()) {
     // Global switch, write to credentials.json (affects all terminals)
-    const credentialsPath = getCredentialsPath();
-    fs.writeFileSync(credentialsPath, JSON.stringify(profile, null, 2));
-    try { fs.chmodSync(credentialsPath, 0o600); } catch {}
-    console.log(`Switched to ${profile.email || name} (global, all terminals)`);
+    const kept = writeGlobalCredentials(profile);
+    console.log(`Switched to ${profileLabel(profile, name)} (global, all terminals)`);
+    if (kept && kept !== name) console.log(`The agent client login is saved. Switch back: atris switch ${kept} --global`);
   } else {
     // Per-terminal switch, write session file (only this terminal)
     setSessionProfile(name);
-    console.log(`Switched to ${profile.email || name}`);
+    console.log(`Switched to ${profileLabel(profile, name)}`);
   }
 }
 
@@ -958,10 +1165,8 @@ function activateGlobal() {
   const name = process.argv[3];
   if (!name) { process.exit(1); }
   const profile = loadProfile(name);
-  if (!profile || !profile.token) { process.exit(1); }
-  const credentialsPath = getCredentialsPath();
-  fs.writeFileSync(credentialsPath, JSON.stringify(profile, null, 2));
-  try { fs.chmodSync(credentialsPath, 0o600); } catch {}
+  if (!usableProfile(profile)) { process.exit(1); }
+  writeGlobalCredentials(profile);
   process.exit(0);
 }
 
@@ -974,7 +1179,7 @@ function switchSession() {
   if (!name) { process.exit(1); }
 
   const profile = loadProfile(name);
-  if (!profile || !profile.token) { process.exit(1); }
+  if (!usableProfile(profile)) { process.exit(1); }
 
   // Accept explicit session ID from the shell wrapper (more reliable than
   // detecting it from inside a child process where TTY env vars may be missing).
@@ -996,9 +1201,7 @@ function switchSession() {
       setSessionProfile(name);
     } else {
       // No terminal ID, global fallback
-      const credentialsPath = getCredentialsPath();
-      fs.writeFileSync(credentialsPath, JSON.stringify(profile, null, 2));
-      try { fs.chmodSync(credentialsPath, 0o600); } catch {}
+      writeGlobalCredentials(profile);
     }
   }
   process.exit(0);
@@ -1087,4 +1290,5 @@ module.exports = {
   persistMintedAgentToken,
   ensureBilledCommandAuth,
   wantsAgentToken,
+  agentClientLoginRequest,
 };

package/commands/autoland.js

@@ -555,6 +555,21 @@ function showStatus(root, args) {
     console.log('');
     console.log(`  waiting on a human right now: ${waiting.length}, oldest ${waiting[0].hours}h`);
   }
+  // What the next tick's idle sweep will do, read-only (no check runs here).
+  if (enabled && policy.janitor !== false && policy.idle_sweep !== false) {
+    try {
+      const idle = require('../lib/idle-review-sweep').sweepIdleReviews(root, { tasks, policy, dryRun: true });
+      const days = Number(policy.idle_close_days) > 0 ? Number(policy.idle_close_days) : 7;
+      if (idle.closed.length) {
+        console.log(`  closing on the next tick: ${idle.closed.length} idle over ${days} days that can never land on their own, each with a plain reason.`);
+      }
+      if (idle.human_waiting.length) {
+        console.log(`  staying with you: ${idle.human_waiting.length} in money, deploys, security, or customer work; idle time never closes these.`);
+      }
+    } catch {
+      // Preview only.
+    }
+  }
   console.log('');
   if (!enabled) console.log("  flip it on: atris autoland on   (one decision; everything after is receipts)");
   console.log('');
@@ -798,9 +813,11 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     .filter((task) => String(task.review?.approval_status || task.metadata?.approval_status || 'pending') === 'pending')
     .length;
   const accept = runOwnCli(root, cliArgs, acceptSweepTimeoutMs(pendingReviewRows));
+  let acceptResults = [];
   try {
     const parsed = JSON.parse(accept.stdout);
     const results = Array.isArray(parsed.results) ? parsed.results : [];
+    acceptResults = results;
     // A refused sweep (ok:false, a guard tripped, policy race) carries no
     // summary fields. Name the reason instead of leaving nulls that read as
     // "no work": a blind heartbeat must say WHY it is blind.
@@ -963,6 +980,51 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     recordLandingSweepState(state, null, { error: receipt.reap_error });
   }
 
+  // 3c2. idle work resolves itself, every tick. Finished work that sat still
+  // past the grace period (policy.idle_close_days, default 7) and can never
+  // land on its own is closed with a plain reason; done and long-idle rows
+  // leave the list. This used to run only when someone opened a session, so
+  // nights and trips piled up work nobody would ever land. Protected lanes
+  // (money, deploys, security, customer, outward) are never closed by idle
+  // time. Off switch: policy.idle_sweep === false or policy.janitor === false.
+  if (policy.janitor !== false && policy.idle_sweep !== false) {
+    try {
+      const liveReasons = new Map(acceptResults
+        .filter((r) => r && r.ref && r.reason && r.action !== 'accepted')
+        .map((r) => [r.ref, r.reason]));
+      const kept = require('../lib/task-list-keeper').keepWorkspaceTaskList(root, { actor: 'autoland', includeDone: false });
+      const idle = require('../lib/idle-review-sweep').sweepIdleReviews(root, {
+        tasks: readProjection(root),
+        policy,
+        liveReasons,
+      });
+      const putAway = (kept.put_away || []).length + (kept.reaped || []).length;
+      if (putAway + idle.closed.length > 0) require('./task').refreshKeptTaskList(root);
+      receipt.idle_sweep = {
+        closed: idle.closed.map((c) => ({ ref: c.ref, reason: c.reason })),
+        put_away: putAway,
+        human_waiting: idle.human_waiting.length,
+      };
+    } catch (err) {
+      receipt.idle_sweep_error = String((err && err.message) || err).slice(0, 200);
+    }
+  }
+  try {
+    const { appendOvernightNote, tickSummaryLine } = require('../lib/cleanup-summary');
+    const line = tickSummaryLine({
+      landed: (receipt.landed || []).length,
+      closed: receipt.idle_sweep ? receipt.idle_sweep.closed.length : 0,
+      putAway: receipt.idle_sweep ? receipt.idle_sweep.put_away : 0,
+      needYou: receipt.idle_sweep ? receipt.idle_sweep.human_waiting : protectedWaiting.length,
+    });
+    if (line) {
+      appendOvernightNote(root, line);
+      receipt.summary_line = line;
+    }
+  } catch {
+    // The journal line is a courtesy; it never fails the tick.
+  }
+
   // 3d. wish sweep: queued wishes are allowed to wake a mission without a
   // foreground `atris wish` session, but they must never endanger landing.
   try {

package/commands/brain.js

@@ -1140,6 +1140,10 @@ function taskEpisodeScorecard(root, episode, workspace, ts = new Date().toISOStr
     task_title: episode.state && episode.state.title || null,
     task_tag: episode.state && episode.state.tag || null,
     actor: episode.action && episode.action.actor || null,
+    // Who built the work. `actor` is the reviewer; trust is earned by the builder.
+    builder: episode.state && episode.state.metadata && episode.state.metadata.built_by
+      || episode.state && episode.state.claimed_by
+      || null,
     reward: Number.isFinite(reward) ? reward : 0,
     reward_source: episode.reward && episode.reward.source || 'task_review',
     lesson: episode.lesson || '',

package/commands/engine.js

@@ -57,6 +57,8 @@ const {
   rosterJobNameError,
   rosterJobRole,
   readRosterState,
+  retiredModelsNamed,
+  RETIRED_CLAUDE_MODELS,
   customRosterJobKeys,
   setRosterPick,
   confirmRoster,
@@ -1161,6 +1163,7 @@ function rosterReport(root = process.cwd(), now = new Date()) {
     jobs,
     expiring,
     renew_command: expiring.length ? RENEW_COMMAND : null,
+    upgraded: upgradedModels(state),
     team: team.rows,
     warnings: [...state.session.warnings, ...state.project.warnings, ...state.machine.warnings, ...team.warnings],
     files: {
@@ -1172,6 +1175,25 @@ function rosterReport(root = process.cwd(), now = new Date()) {
   };
 }
 
+// Retired models a roster file still names. Every read runs them as their
+// replacement, so this is only a heads-up; nobody has to edit the file.
+function upgradedModels(state) {
+  const found = [];
+  for (const layer of [state.session, state.project, state.machine]) {
+    if (!layer || layer.format === 'none' || !layer.path) continue;
+    let text = '';
+    try { text = fs.readFileSync(layer.path, 'utf8'); } catch { continue; }
+    for (const from of retiredModelsNamed(text)) {
+      if (!found.some((item) => item.from === from)) found.push({ from, to: RETIRED_CLAUDE_MODELS[from] });
+    }
+  }
+  return found;
+}
+
+function renderUpgradedLine(upgraded) {
+  return (upgraded || []).map((item) => `note: ${modelLabel(item.from)} is retired, so your roster runs ${modelLabel(item.to)} in its place. no edit needed.`).join('\n');
+}
+
 // Every worker, in any job, whose end date is today or within the next
 // seven days. Workers already past their date show on their own lines. A
 // job set for this shell only is skipped: roster confirm does not renew it.
@@ -1367,7 +1389,7 @@ function renderRosterWarnings(warnings) {
 
 function renderRosterReport(report, { width } = {}) {
   const stale = (report.stale || []).map((item) => item.text);
-  const jobs = [renderJobRoster(report.jobs, { width }), renderExpiringLine(report.expiring), ...stale].filter(Boolean).join('\n');
+  const jobs = [renderJobRoster(report.jobs, { width }), renderExpiringLine(report.expiring), ...stale, renderUpgradedLine(report.upgraded)].filter(Boolean).join('\n');
   return [jobs, renderTeamRoster(report.team, { width }), renderRosterWarnings(report.warnings)]
     .filter(Boolean)
     .join('\n\n');