atris 3.65.0 → 3.67.0

package/lib/verify-worktree-rewrite.js

@@ -0,0 +1,115 @@
+'use strict';
+
+// Member agents build in temporary copies of the repo
+// (<arena>/.agent-worktrees/<project>/<name>, older ones under
+// <arena>/agent-work-trees/...) and record their proof check pointed at that
+// copy: "cd <arena>/.agent-worktrees/<project>/x && node scripts/t.mjs".
+// The landing gate only runs checks relative to the main checkout, so it
+// refused 201 of 218 finished items in project-obelisk every hour. Rewrite
+// such a check relative to the main checkout so the landing pass reruns it
+// there, and say in plain words when it cannot (the file it runs only exists
+// on the agent's branch).
+
+const fs = require('fs');
+const path = require('path');
+
+function escapeRegex(text) {
+  return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function arenaDirFor(root) {
+  let cursor = root;
+  while (cursor && cursor !== path.dirname(cursor)) {
+    if (path.basename(cursor) === 'arena') return cursor;
+    cursor = path.dirname(cursor);
+  }
+  return path.dirname(root);
+}
+
+function copyRootPattern(root) {
+  const arena = escapeRegex(arenaDirFor(root));
+  const project = escapeRegex(path.basename(root));
+  const name = '[A-Za-z0-9._-]+';
+  return `(?:${[
+    `${arena}/\\.agent-worktrees/${project}/${name}`,
+    `${arena}/agent-work-trees/${project}/${name}`,
+    `\\.\\./\\.agent-worktrees/${project}/${name}`,
+    escapeRegex(root),
+  ].join('|')})(?![A-Za-z0-9._-])`;
+}
+
+function stripQuotes(token) {
+  return token.replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
+}
+
+// Returns { command, rewritten, from }. `rewritten` is true only when the
+// command named an agent copy (or the main checkout by absolute path) and
+// now runs relative to the main checkout. A command that still names an
+// agent copy after the rewrite is returned untouched with rewritten:false.
+function rewriteWorktreeVerify(command, workspaceRoot) {
+  const original = String(command || '').trim();
+  const unchanged = { command: original, rewritten: false, from: null };
+  if (!original || !workspaceRoot) return unchanged;
+  const root = path.resolve(workspaceRoot);
+  const anyRoot = copyRootPattern(root);
+  if (!new RegExp(anyRoot).test(original)) return unchanged;
+
+  let cmd = original;
+  // ( cd X && cmd )  ->  cd X && cmd
+  const paren = /^\((.*)\)$/s.exec(cmd);
+  if (paren) cmd = paren[1].trim();
+  // cd '<copy>[/sub]' && rest  ->  [cd sub && ]rest
+  const cd = new RegExp(`^cd\\s+(['"]?)${anyRoot}(/[^'"\\s]*)?\\1\\s+&&\\s+(.+)$`, 's').exec(cmd);
+  if (cd) {
+    const sub = (cd[2] || '').replace(/^\/+|\/+$/g, '');
+    cmd = sub ? `cd ${sub} && ${cd[3]}` : cd[3];
+  }
+  // npm --prefix <copy> run x  ->  npm run x
+  cmd = cmd.replace(new RegExp(`\\bnpm\\s+--prefix\\s+(['"]?)${anyRoot}/?\\1\\s+`, 'g'), 'npm ');
+  // '<copy>/a/b' -> a/b ; bare '<copy>' -> .
+  cmd = cmd.replace(new RegExp(`(['"]?)${anyRoot}/([^'"\\s]+)\\1`, 'g'), (_m, _q, rest) => rest);
+  cmd = cmd.replace(new RegExp(`(['"]?)${anyRoot}/?\\1(?=\\s|$)`, 'g'), '.');
+  // Only plain path quoting is stripped; quoted text with spaces stays put.
+  cmd = cmd.split(/(\s+)/).map((part) => (/^\s+$/.test(part) ? part : stripQuotes(part))).join('').trim();
+  if (new RegExp(anyRoot).test(cmd) || /\.agent-worktrees|agent-work-trees/.test(cmd)) return unchanged;
+  return { command: cmd, rewritten: true, from: original };
+}
+
+// Files a parsed check step reads by relative path: its folder, the script
+// it runs, the file it tests. Used to tell "this check cannot run on main
+// because its file only exists on the agent's branch" from a real failure.
+function stepReferencedPaths(step) {
+  const argv = Array.isArray(step?.argv) ? step.argv : [];
+  const paths = [];
+  if (step?.cwd) paths.push({ path: step.cwd, kind: 'dir' });
+  const [bin, first, second] = argv;
+  const looksLikePath = (token) => Boolean(token) && !String(token).startsWith('-') && /[/.]/.test(String(token));
+  if (bin === 'node' && first === '--check' && looksLikePath(second)) paths.push({ path: second, kind: 'file' });
+  else if (bin === 'node' && first === '--test') {
+    for (const token of argv.slice(2)) {
+      if (looksLikePath(token) && !String(token).includes('*') && /\.[cm]?[jt]s$/.test(token)) paths.push({ path: token, kind: 'file' });
+    }
+  } else if (bin === 'node' && looksLikePath(first)) paths.push({ path: first, kind: 'file' });
+  if ((bin === 'python' || bin === 'python3' || /venv\/bin\/python3?$/.test(String(bin || ''))) && looksLikePath(first) && first !== '-m') {
+    paths.push({ path: first, kind: 'file' });
+  }
+  if (bin === 'test' && (first === '-f' || first === '-s') && looksLikePath(second)) paths.push({ path: second, kind: 'file' });
+  return paths;
+}
+
+// First referenced path missing from the main checkout, or null.
+function missingOnMain(steps, workspaceRoot) {
+  const root = path.resolve(workspaceRoot || process.cwd());
+  for (const step of steps || []) {
+    const base = step?.cwd ? path.resolve(root, step.cwd) : root;
+    for (const ref of stepReferencedPaths(step)) {
+      const target = ref.kind === 'dir' ? path.resolve(root, ref.path) : path.resolve(base, ref.path);
+      if (!fs.existsSync(target)) {
+        return path.relative(root, target) || ref.path;
+      }
+    }
+  }
+  return null;
+}
+
+module.exports = { rewriteWorktreeVerify, missingOnMain, stepReferencedPaths };

package/lib/voice-gate.js

@@ -255,6 +255,8 @@ const LANDING_REASON_SENTENCES = {
   verifier_is_builder: 'the re-check actor built this row, another actor must re-check',
   verify_command_not_allowed: 'its recorded check is not on the list this machine may run alone, run it yourself to unblock',
   verify_failed: 'its check command failed on re-run, fix the failure and re-certify',
+  verify_failed_on_main: 'its check was recorded in an agent copy and fails when rerun from main, so its work is likely still on the agent branch',
+  verify_only_on_agent_branch: 'its check runs a file that only exists on the agent branch, not on main yet, so that branch has to land first',
   verify_passed: 'its check command passed on re-run',
   verify_unrunnable: 'its check command could not even start, fix the command and re-certify',
   verify_workdir_missing: 'the folder its check was recorded in is gone, re-run the check from a real folder',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.65.0",
+  "version": "3.67.0",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {

package/scripts/det/ytnotes

@@ -373,7 +373,7 @@ run_grok() {
 }
 
 run_haiku() {
-  run_with_timeout 240 claude -p "$PROMPT" --model "${1:-claude-haiku-4-5}"
+  run_with_timeout 240 claude -p "$PROMPT" --model "${1:-claude-haiku-5-5}"
 }
 
 # Gemini Flash through the Antigravity CLI (agy). On an 85-minute transcript it

package/utils/agent-client.js

@@ -0,0 +1,363 @@
+'use strict';
+
+// Agent clients: an agent signs itself in with a client id and secret
+// (OAuth client_credentials) instead of borrowing a person's login.
+//
+// The owner creates the client once with `atris agent-client create`. The
+// agent runs `atris login --client-id atc_... --client-secret-file <path>`
+// (or sets ATRIS_CLIENT_ID + ATRIS_CLIENT_SECRET / ATRIS_CLIENT_SECRET_FILE).
+// There is no refresh token: when the short token runs out, the CLI asks
+// again with the secret. The secret and tokens never reach stdout, stderr,
+// or error text.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { stateHome } = require('../lib/state-home');
+const { getApiBaseUrl, httpRequest, DEFAULT_CLIENT_ID, DEFAULT_USER_AGENT } = require('./api');
+
+const AUTH_TYPE = 'agent_client';
+const CLIENT_ID_PREFIX = 'atc_';
+const RENEW_BEFORE_EXPIRY_MS = 60 * 1000;
+
+function privateDir(dir) {
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch {}
+  return dir;
+}
+
+function clientsDir() {
+  return privateDir(path.join(privateDir(path.join(stateHome(), '.atris')), 'agent-clients'));
+}
+
+function safeClientId(clientId) {
+  return String(clientId).replace(/[^a-zA-Z0-9_-]/g, '-').slice(0, 96);
+}
+
+// Saved agent client logins live as a profile named after the client id.
+function profileNameForClient(clientId) {
+  return safeClientId(clientId);
+}
+
+function tokenCachePath(clientId) {
+  return path.join(clientsDir(), `${safeClientId(clientId)}.token.json`);
+}
+
+function managedSecretPath(clientId) {
+  return path.join(clientsDir(), `${safeClientId(clientId)}.secret`);
+}
+
+// Write through a private temp file and rename over the target, so a second
+// CLI process never reads half a file and the content is never world readable.
+function writeFileAtomic(filePath, content) {
+  const dir = path.dirname(filePath);
+  const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, content, { mode: 0o600, flag: 'wx' });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, filePath);
+  } catch (error) {
+    try { fs.unlinkSync(tmp); } catch {}
+    throw error;
+  }
+  try { fs.chmodSync(filePath, 0o600); } catch {}
+}
+
+function isAgentClientCredential(credentials) {
+  return Boolean(credentials
+    && credentials.auth_type === AUTH_TYPE
+    && typeof credentials.client_id === 'string'
+    && credentials.client_id.trim());
+}
+
+function scopeList(scope) {
+  if (Array.isArray(scope)) return scope.map(String).filter(Boolean);
+  if (typeof scope !== 'string') return [];
+  return scope.split(/[\s,]+/).map((part) => part.trim()).filter(Boolean);
+}
+
+function readTokenCache(clientId) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(tokenCachePath(clientId), 'utf8'));
+    if (!parsed || parsed.client_id !== clientId) return null;
+    if (typeof parsed.access_token !== 'string' || !parsed.access_token) return null;
+    const expiresMs = Date.parse(parsed.expires_at);
+    if (!Number.isFinite(expiresMs)) return null;
+    return { ...parsed, expires_ms: expiresMs };
+  } catch {
+    return null;
+  }
+}
+
+function writeTokenCache(clientId, entry) {
+  writeFileAtomic(tokenCachePath(clientId), JSON.stringify({ client_id: clientId, ...entry }, null, 2));
+}
+
+function deleteAgentClientFiles(clientId) {
+  if (!clientId) return;
+  for (const filePath of [tokenCachePath(clientId), managedSecretPath(clientId)]) {
+    try { fs.unlinkSync(filePath); } catch {}
+  }
+}
+
+// The agent client named by env, if any. ATRIS_TOKEN still wins over this
+// (readCredentials checks it first), so existing headless boxes are unchanged.
+function envAgentClient(env = process.env) {
+  const clientId = typeof env.ATRIS_CLIENT_ID === 'string' ? env.ATRIS_CLIENT_ID.trim() : '';
+  if (!clientId) return null;
+  const secretFile = typeof env.ATRIS_CLIENT_SECRET_FILE === 'string' ? env.ATRIS_CLIENT_SECRET_FILE.trim() : '';
+  return {
+    auth_type: AUTH_TYPE,
+    client_id: clientId,
+    client_secret_file: secretFile ? path.resolve(secretFile) : null,
+    client_secret_env: secretFile ? null : 'ATRIS_CLIENT_SECRET',
+    scope: null,
+    provider: AUTH_TYPE,
+    email: null,
+    user_id: null,
+    from_env: true,
+  };
+}
+
+// Attach the cached token (if any) so sync readers still see `token`.
+function withCachedToken(stored) {
+  const cache = readTokenCache(stored.client_id);
+  return {
+    ...stored,
+    provider: stored.provider || AUTH_TYPE,
+    source: AUTH_TYPE,
+    token: cache ? cache.access_token : null,
+    token_expires_at: cache ? cache.expires_at : null,
+    scopes: cache ? scopeList(cache.scope) : scopeList(stored.scope),
+  };
+}
+
+function needsRenewal(credentials, now = Date.now()) {
+  if (!credentials || !credentials.token) return true;
+  const expiresMs = Date.parse(credentials.token_expires_at);
+  if (!Number.isFinite(expiresMs)) return true;
+  return expiresMs - now <= RENEW_BEFORE_EXPIRY_MS;
+}
+
+class AgentClientError extends Error {
+  constructor(message, code, status) {
+    super(message);
+    this.code = code;
+    this.status = status || 0;
+  }
+}
+
+function readClientSecret(client, env = process.env) {
+  if (client.client_secret_file) {
+    let raw;
+    try {
+      raw = fs.readFileSync(client.client_secret_file, 'utf8');
+    } catch (error) {
+      throw new AgentClientError(`could not read the client secret file ${client.client_secret_file}${error.code ? ` (${error.code})` : ''}`, 'secret_missing');
+    }
+    const secret = raw.trim();
+    if (!secret) throw new AgentClientError(`the client secret file ${client.client_secret_file} is empty`, 'secret_missing');
+    return secret;
+  }
+  const envName = client.client_secret_env || 'ATRIS_CLIENT_SECRET';
+  const secret = typeof env[envName] === 'string' ? env[envName].trim() : '';
+  if (!secret) {
+    throw new AgentClientError('no client secret found. set ATRIS_CLIENT_SECRET or ATRIS_CLIENT_SECRET_FILE, or run atris login --client-id <id> --client-secret-file <path>', 'secret_missing');
+  }
+  return secret;
+}
+
+function getOAuthTokenUrl() {
+  // The token endpoint lives at the server root, not under /api.
+  return `${getApiBaseUrl().replace(/\/api$/, '')}/oauth/token`;
+}
+
+function scrub(text, secrets) {
+  let out = String(text == null ? '' : text);
+  for (const secret of secrets) {
+    if (secret) out = out.split(secret).join('[redacted]');
+  }
+  // Belt and braces: anything shaped like a client secret or a JWT goes too.
+  return out
+    .replace(/atcs_[A-Za-z0-9_\-.~+/=]+/g, '[redacted]')
+    .replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g, '[redacted]')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 300);
+}
+
+// POST /oauth/token with grant_type=client_credentials (client_secret_post).
+async function requestClientToken({ clientId, secret, scope }, deps = {}) {
+  const request = deps.httpRequest || httpRequest;
+  const params = new URLSearchParams({
+    grant_type: 'client_credentials',
+    client_id: clientId,
+    client_secret: secret,
+  });
+  const wantedScope = scopeList(scope).join(' ');
+  if (wantedScope) params.set('scope', wantedScope);
+  const body = params.toString();
+
+  let result;
+  try {
+    result = await request(getOAuthTokenUrl(), {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        Accept: 'application/json',
+        'User-Agent': DEFAULT_USER_AGENT,
+        'X-Atris-Client': DEFAULT_CLIENT_ID,
+      },
+      body,
+      timeoutMs: 30000,
+    });
+  } catch (error) {
+    throw new AgentClientError(`could not reach the token endpoint: ${scrub(error && error.message, [secret])}`, 'network');
+  }
+
+  const text = Buffer.isBuffer(result.body) ? result.body.toString('utf8') : String(result.body || '');
+  let data = null;
+  try { data = text ? JSON.parse(text) : null; } catch { data = null; }
+  const status = result.status || 0;
+
+  if (status < 200 || status >= 300 || !data || typeof data.access_token !== 'string' || !data.access_token) {
+    const code = (data && typeof data.error === 'string' && data.error) || (status >= 200 && status < 300 ? 'missing_token' : 'token_request_failed');
+    const leaked = data && typeof data.access_token === 'string' ? data.access_token : null;
+    const detail = data && (data.error_description || data.detail || data.message);
+    const parts = [`agent client sign-in failed (${status || 'no response'}${code ? `, ${code}` : ''})`];
+    if (detail) parts.push(scrub(typeof detail === 'string' ? detail : JSON.stringify(detail), [secret, leaked]));
+    throw new AgentClientError(parts.join(': '), code, status);
+  }
+
+  const expiresIn = Number(data.expires_in);
+  const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1000 : 0;
+  const now = deps.now ? deps.now() : Date.now();
+  return {
+    access_token: data.access_token,
+    token_type: data.token_type || 'Bearer',
+    scope: typeof data.scope === 'string' ? data.scope : wantedScope,
+    expires_at: new Date(now + ttlMs).toISOString(),
+    obtained_at: new Date(now).toISOString(),
+  };
+}
+
+// Fetch a new token for this client, cache it, and return the credential with
+// the new token attached.
+async function renewAgentClientToken(credentials, deps = {}) {
+  const secret = readClientSecret(credentials, deps.env || process.env);
+  const entry = await requestClientToken({
+    clientId: credentials.client_id,
+    secret,
+    scope: credentials.scope,
+  }, deps);
+  writeTokenCache(credentials.client_id, entry);
+  return {
+    ...credentials,
+    source: AUTH_TYPE,
+    token: entry.access_token,
+    token_expires_at: entry.expires_at,
+    scopes: scopeList(entry.scope),
+  };
+}
+
+// Before a call: renew when the token is missing or within 60s of expiry.
+// Another process may have renewed already, so look at the cache first.
+async function ensureAgentClientToken(credentials, deps = {}) {
+  if (!needsRenewal(credentials)) return credentials;
+  const cached = withCachedToken(credentials);
+  if (!needsRenewal(cached)) return cached;
+  return renewAgentClientToken(credentials, deps);
+}
+
+// Which cached client (if any) issued this exact token. Cheap: one small
+// directory, usually holding zero or one file.
+function cachedClientIdForToken(token) {
+  if (!token) return null;
+  let dir;
+  try {
+    dir = path.join(stateHome(), '.atris', 'agent-clients');
+    if (!fs.existsSync(dir)) return null;
+  } catch {
+    return null;
+  }
+  let names;
+  try { names = fs.readdirSync(dir); } catch { return null; }
+  for (const name of names) {
+    if (!name.endsWith('.token.json')) continue;
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));
+      if (parsed && parsed.access_token === token && typeof parsed.client_id === 'string') return parsed.client_id;
+    } catch {}
+  }
+  return null;
+}
+
+// The active agent client credential for this token, or null when the token
+// belongs to anything else (a person's login, an API key, ATRIS_TOKEN).
+function activeClientForToken(token, readActive) {
+  const clientId = cachedClientIdForToken(token);
+  if (!clientId) return null;
+  const active = readActive();
+  if (!isAgentClientCredential(active) || active.client_id !== clientId) return null;
+  return active;
+}
+
+function defaultReadActive() {
+  return require('./auth').readActiveCredentials();
+}
+
+// Used by the shared API helper right before it sets the Authorization header.
+// Never throws: on any problem the original token goes out unchanged.
+async function freshTokenFor(token, deps = {}) {
+  try {
+    const active = activeClientForToken(token, deps.readActive || defaultReadActive);
+    if (!active || active.token !== token || !needsRenewal(active)) return token;
+    const renewed = await renewAgentClientToken(active, deps);
+    return renewed.token || token;
+  } catch {
+    return token;
+  }
+}
+
+// Used by the shared API helper after a 401. Returns a different token to
+// retry with once, or null. Never throws.
+async function tokenAfterUnauthorized(token, deps = {}) {
+  try {
+    const active = activeClientForToken(token, deps.readActive || defaultReadActive);
+    if (!active) return null;
+    if (active.token && active.token !== token && !needsRenewal(active)) {
+      // Another process already renewed; use its token.
+      return active.token;
+    }
+    const renewed = await renewAgentClientToken(active, deps);
+    return renewed.token && renewed.token !== token ? renewed.token : null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = {
+  AUTH_TYPE,
+  CLIENT_ID_PREFIX,
+  AgentClientError,
+  isAgentClientCredential,
+  envAgentClient,
+  withCachedToken,
+  needsRenewal,
+  readClientSecret,
+  requestClientToken,
+  renewAgentClientToken,
+  ensureAgentClientToken,
+  freshTokenFor,
+  tokenAfterUnauthorized,
+  writeFileAtomic,
+  writeTokenCache,
+  readTokenCache,
+  managedSecretPath,
+  profileNameForClient,
+  tokenCachePath,
+  deleteAgentClientFiles,
+  scopeList,
+  scrub,
+  getOAuthTokenUrl,
+};

package/utils/api.js

@@ -118,11 +118,21 @@ function httpRequest(urlString, options) {
   });
 }
 
+// Agent client tokens are short and renewed by asking again with the secret.
+// Loaded lazily: ./agent-client requires this file.
+function agentClientRenewal() {
+  return require('./agent-client');
+}
+
 async function apiRequestJson(pathname, options = {}) {
   const url = buildApiUrl(pathname);
   const headers = { ...(options.headers || {}) };
-  if (options.token) {
-    headers.Authorization = `Bearer ${options.token}`;
+  let authToken = options.token;
+  if (authToken) {
+    // Renew first if this is the active agent client's token and it is
+    // missing or within 60 seconds of expiry. Any other token is untouched.
+    authToken = await agentClientRenewal().freshTokenFor(authToken);
+    headers.Authorization = `Bearer ${authToken}`;
   }
   if (!headers['User-Agent'] && !headers['user-agent']) {
     headers['User-Agent'] = DEFAULT_USER_AGENT;
@@ -167,6 +177,14 @@ async function apiRequestJson(pathname, options = {}) {
 
       const ok = result.status >= 200 && result.status < 300;
 
+      // A 401 on an agent client token: fetch a new token once, retry once.
+      if (result.status === 401 && authToken && !options.agentClientRetried) {
+        const renewed = await agentClientRenewal().tokenAfterUnauthorized(authToken);
+        if (renewed) {
+          return apiRequestJson(pathname, { ...options, token: renewed, agentClientRetried: true });
+        }
+      }
+
       // Retry on transient server errors
       if (!ok && retryableStatus.has(result.status) && attempt < maxRetries) {
         await new Promise(r => setTimeout(r, 1000 * (attempt + 1)));