atris 3.72.0 → 3.72.1

package/commands/auth.js

@@ -1,5 +1,5 @@
 const { AGENT_TOKEN_EXPIRED_DETAIL, decodeJwtClaims, loadCredentials, saveCredentials, saveAgentClientCredentials, preserveAgentClientLogin, deleteCredentials, getCredentialsPath, openBrowser, promptUser, displayAccountSummary, ensureValidCredentials, loadProfile, listProfiles, profileNameFromEmail, deleteProfile, saveProfile, getTokenExpiryEpochSeconds, getTerminalSessionId, setSessionProfile, getSessionProfile, clearSessionProfile, cleanStaleSessions, getSessionsDir } = require('../utils/auth');
-const { getAppBaseUrl, apiRequestJson } = require('../utils/api');
+const { getAppBaseUrl, getApiBaseUrl, apiRequestJson } = require('../utils/api');
 const { isNonInteractive, wantsJson } = require('../lib/noninteractive');
 const { hasFlag, readFlag } = require('../lib/arg-parser');
 const agentClient = require('../utils/agent-client');
@@ -17,6 +17,7 @@ const COMMERCE_SCOPES = [COMMERCE_QUOTE_SCOPE, 'transactions:read'];
 const COMMERCE_MAX_USD_LIMIT = 500;
 const COMMERCE_NEVER_PAYS = 'this key can ask for prices and start your approval, it can never pay.';
 const NO_STORED_JWT_MESSAGE = 'not signed in. run atris login first.';
+let envBilledAuthCache = null;
 
 function firstNonEmptyString(...values) {
   for (const value of values) {
@@ -171,6 +172,7 @@ function persistMintedAgentToken(credentials, token, extras = {}) {
     refresh_token: extras.refresh_token || credentials.refresh_token || null,
     ...slot,
   };
+  if (credentials.source === 'env') return next;
   if (credentials.source_profile) {
     saveProfile(credentials.source_profile, next);
     return next;
@@ -270,7 +272,9 @@ async function mintScopedAgentToken(requested = {}, deps = {}) {
     ok: true,
     token: minted,
     meta,
-    storedIn: `${credentials.source_profile ? `profile ${credentials.source_profile}` : '~/.atris/credentials.json'}, ${isCommerceKey(meta.scopes) ? 'commerce_agent_token' : 'agent_token'}`,
+    storedIn: credentials.source === 'env'
+      ? 'process memory'
+      : `${credentials.source_profile ? `profile ${credentials.source_profile}` : '~/.atris/credentials.json'}, ${isCommerceKey(meta.scopes) ? 'commerce_agent_token' : 'agent_token'}`,
   };
 }
 
@@ -306,10 +310,33 @@ async function ensureBilledCommandAuth(scope, deps = {}) {
     return { ok: false, error: NO_STORED_JWT_MESSAGE };
   }
 
+  let cache;
+  if (credentials.source === 'env') {
+    const baseUrl = getApiBaseUrl();
+    if (!envBilledAuthCache || envBilledAuthCache.login !== credentials.token || envBilledAuthCache.api !== api || envBilledAuthCache.baseUrl !== baseUrl) {
+      envBilledAuthCache = { login: credentials.token, api, baseUrl, tokens: new Map() };
+    }
+    cache = envBilledAuthCache.tokens;
+    const cached = cache.get(wanted);
+    if (!deps.forceMint && cached && cached.expiry > Date.now()) {
+      return { ok: true, token: cached.token, minted: false, credentials, meta: cached.meta };
+    }
+    // A rejected or expired token must stay evicted even if its replacement fails.
+    cache.delete(wanted);
+  }
+
   const minted = await mint({ scopes: [wanted] }, deps);
   if (!minted.ok) {
     return { ok: false, error: minted.error || NO_STORED_JWT_MESSAGE };
   }
+  if (cache) {
+    const claims = decodeJwtClaims(minted.token);
+    const expiry = claims?.exp ? claims.exp * 1000 : Date.parse(minted.meta?.expiresAt);
+    const scopes = claims?.scopes || minted.meta?.scopes || [];
+    if (Array.isArray(scopes) && scopes.includes(wanted) && Number.isFinite(expiry) && expiry > Date.now()) {
+      cache.set(wanted, { token: minted.token, meta: minted.meta, expiry });
+    }
+  }
   return {
     ok: true,
     token: minted.token,

package/lib/site-publish.js

@@ -322,15 +322,29 @@ async function run(argv, deps = {}) {
   let response;
   let parsed;
   try {
-    response = await fetchFn(url, {
+    const requestOptions = {
       method: 'POST',
+      redirect: 'manual',
       headers: {
         Authorization: `Bearer ${token}`,
         Accept: 'application/json',
         'Content-Type': 'application/json',
       },
       body: JSON.stringify(body),
-    });
+    };
+    let requestUrl = url;
+    for (let redirects = 0; ; redirects++) {
+      response = await fetchFn(requestUrl, requestOptions);
+      const location = response.headers && response.headers.get('location');
+      if (![301, 302, 303, 307, 308].includes(response.status) || !location) break;
+      if (response.body) await response.body.cancel();
+      const target = new URL(location, requestUrl);
+      if (target.origin !== new URL(url).origin) {
+        throw new Error(`refusing cross-origin redirect to ${target.host || target.protocol}`);
+      }
+      if (redirects >= 20) throw new Error('too many redirects');
+      requestUrl = target.toString();
+    }
     parsed = await readResponse(response);
   } catch (error) {
     errorLog(`publish failed: ${error.message}`);

package/lib/site.js

@@ -97,18 +97,28 @@ const MIME = { '.html': 'text/html; charset=utf-8', '.css': 'text/css', '.js': '
 // minimal static preview server for a built site dir (no deps)
 function serveSite(dir, port = 4321) {
   const root = path.resolve(dir);
+  let realRoot = root;
+  try { realRoot = fs.realpathSync(root); } catch { /* missing folder: every request 404s */ }
   const server = http.createServer((req, res) => {
-    let rel = decodeURIComponent((req.url || '/').split('?')[0]);
+    let rel;
+    try { rel = decodeURIComponent((req.url || '/').split('?')[0]); }
+    catch { res.writeHead(400); res.end('bad request'); return; }
     if (rel.endsWith('/')) rel += 'index.html';
     const file = path.normalize(path.join(root, rel));
-    if (!file.startsWith(root)) { res.writeHead(403); res.end('forbidden'); return; }
-    fs.readFile(file, (err, data) => {
-      if (err) { res.writeHead(404, { 'Content-Type': 'text/plain' }); res.end('not found'); return; }
-      res.writeHead(200, { 'Content-Type': MIME[path.extname(file)] || 'application/octet-stream' });
-      res.end(data);
+    // compare against root + separator so a sibling like "site-evil" can't pass for "site"
+    if (file !== root && !file.startsWith(root + path.sep)) { res.writeHead(403); res.end('forbidden'); return; }
+    // Resolve symlinks too: a link inside the site folder must not reach files outside it.
+    fs.realpath(file, (linkErr, real) => {
+      if (linkErr) { res.writeHead(404, { 'Content-Type': 'text/plain' }); res.end('not found'); return; }
+      if (real !== realRoot && !real.startsWith(realRoot + path.sep)) { res.writeHead(403); res.end('forbidden'); return; }
+      fs.readFile(real, (err, data) => {
+        if (err) { res.writeHead(404, { 'Content-Type': 'text/plain' }); res.end('not found'); return; }
+        res.writeHead(200, { 'Content-Type': MIME[path.extname(real)] || 'application/octet-stream' });
+        res.end(data);
+      });
     });
   });
-  return new Promise((resolve) => server.listen(port, () => resolve({ server, url: `http://localhost:${port}` })));
+  return new Promise((resolve) => server.listen(port, '127.0.0.1', () => resolve({ server, url: `http://localhost:${port}` })));
 }
 
 module.exports = { buildSite, serveSite, collectMd, slugFor, firstHeading, firstParagraph };

package/lib/zen-apply.js

@@ -284,26 +284,94 @@ function sameBytes(a, b) {
   }
 }
 
+// A live journal only grows, so two versions of one day's log hold no real
+// conflict: keep the incoming log and add each line of yours it lacks, in
+// your order. Archived journals are finished and keep the usual handling.
+function isJournal(p) {
+  return /(^|\/)logs\/.+\.md$/.test(p) && !/(^|\/)archive\//.test(p);
+}
+
+function joinJournal(file, mine) {
+  let incoming;
+  let yours;
+  try {
+    incoming = fs.readFileSync(file, 'utf8');
+    yours = fs.readFileSync(mine, 'utf8');
+  } catch {
+    return false;
+  }
+  const have = new Set(incoming.split('\n').map((line) => line.trim()).filter(Boolean));
+  const extra = yours.split('\n').filter((line) => line.trim() && !have.has(line.trim()));
+  if (extra.length) fs.writeFileSync(file, `${incoming.replace(/\n*$/, '\n')}\n${extra.join('\n')}\n`);
+  return true;
+}
+
+// Notes moved to a new path between two commits, old path to new.
+function movedNotes(root, from, to) {
+  const out = runGit(['diff', '--name-status', '-z', '-M', from, to], root).stdout || '';
+  const parts = out.split('\0');
+  const moves = new Map();
+  for (let i = 0; i < parts.length; i += 1) {
+    if (/^[RC]\d*$/.test(parts[i])) {
+      if (parts[i][0] === 'R') moves.set(parts[i + 1], parts[i + 2]);
+      i += 2;
+    } else if (parts[i]) {
+      i += 1;
+    }
+  }
+  return moves;
+}
+
+// Carry your edits to a note onto the path it moved to, with a 3-way merge
+// against the version you started from. Only a clean merge is written.
+function followMove(root, fromCommit, from, to, mine) {
+  const dest = path.join(root, to);
+  const base = runGit(['show', `${fromCommit}:${from}`], root);
+  if (base.status !== 0 || !fs.existsSync(mine) || !fs.existsSync(dest)) return false;
+  const work = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-zen-move-'));
+  try {
+    fs.writeFileSync(path.join(work, 'base'), base.stdout);
+    const merged = spawnSync('git', ['merge-file', '-p', dest, path.join(work, 'base'), mine], { encoding: 'utf8' });
+    if (merged.status !== 0) return false;
+    fs.writeFileSync(dest, merged.stdout);
+    return true;
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
+  }
+}
+
 // Run a fast-forward or reset. If uncommitted team notes are in the way, save
-// them, move, then lay them back on top.
-function moveKeepingNotes(root, args, target, tag) {
+// them, move, then lay them back on top. `from` is where the saved changes
+// start: dropping unpushed commits or leaving a side branch passes the base,
+// so a note committed there and edited again since comes back whole, not
+// just the later edit.
+function moveKeepingNotes(root, args, target, tag, from = 'HEAD') {
   const first = runGit(args, root);
-  if (first.status === 0) return { ok: true, notes: [] };
+  if (first.status === 0) return { ok: true, notes: [], tracked: [], landed: [] };
 
-  const changed = new Set((gitOut(['diff', '--name-only', 'HEAD', target], root) || '').split('\n').filter(Boolean));
+  // Without rename detection a note moved upstream shows up under its old
+  // path too, so an edit to it is saved instead of blocking the move.
+  const changed = new Set((gitOut(['diff', '--name-only', '--no-renames', 'HEAD', target], root) || '').split('\n').filter(Boolean));
+  const moves = movedNotes(root, 'HEAD', target);
+  const fromCommit = gitOut(['rev-parse', '--verify', '--quiet', `${from}^{commit}`], root);
   const dirty = dirtyEntries(root);
-  const tracked = dirty.filter((e) => e.xy !== '??' && changed.has(e.path)).map((e) => e.path);
+  // A new note that was only staged has nothing in HEAD to go back to, so it
+  // is unstaged and handled like any untracked note.
+  const added = dirty.filter((e) => e.xy[0] === 'A' && changed.has(e.path)).map((e) => e.path);
+  if (added.length) runGit(['reset', '-q', '--', ...added], root);
+  const tracked = dirty.filter((e) => e.xy !== '??' && e.xy[0] !== 'A' && changed.has(e.path)).map((e) => e.path);
   const untracked = dirty
     .filter((e) => e.xy === '??')
     .flatMap((e) => (e.path.endsWith('/') ? untrackedFiles(root, e.path) : [e.path]))
-    .filter((p) => changed.has(p));
+    .filter((p) => changed.has(p))
+    .concat(added);
   if (!tracked.length && !untracked.length) return { ok: false, error: firstLine(first.stderr) };
 
   const dir = path.join(commonDir(root), 'atris-zen', tag);
   fs.mkdirSync(dir, { recursive: true });
   const patchFile = path.join(dir, 'team-notes.patch');
   if (tracked.length) {
-    const diff = runGit(['diff', '--binary', 'HEAD', '--', ...tracked], root);
+    const diff = runGit(['diff', '--binary', from, '--', ...tracked], root);
     fs.writeFileSync(patchFile, diff.stdout);
     for (const p of tracked) {
       if (!fs.existsSync(path.join(root, p))) continue;
@@ -322,12 +390,25 @@ function moveKeepingNotes(root, args, target, tag) {
 
   const second = runGit(args, root);
   const notes = [];
+  let landed = [];
   if (tracked.length) {
     const { clashed, missed } = applyNotes(root, patchFile, tracked);
-    for (const p of clashed) notes.push(`kept the new ${p}; your copy is in ${path.join(dir, 'mine', p)}`);
+    landed = tracked.filter((p) => !clashed.includes(p) && !missed.includes(p));
+    for (const p of clashed) {
+      const mine = path.join(dir, 'mine', p);
+      if (isJournal(p) && joinJournal(path.join(root, p), mine)) notes.push(`joined your ${p} onto the new one`);
+      else notes.push(`kept the new ${p}; your copy is in ${mine}`);
+    }
     for (const p of missed) {
       const mine = path.join(dir, 'mine', p);
-      notes.push(`${p} no longer fits the new changes; your copy is in ${fs.existsSync(mine) ? mine : patchFile}`);
+      const to = moves.get(p);
+      if (to && fromCommit && followMove(root, fromCommit, p, to, mine)) {
+        notes.push(`${p} moved to ${to}, and your edits went with it`);
+      } else if (to) {
+        notes.push(`${p} moved to ${to} and your edits clash there; your copy is in ${fs.existsSync(mine) ? mine : patchFile}`);
+      } else {
+        notes.push(`${p} no longer fits the new changes; your copy is in ${fs.existsSync(mine) ? mine : patchFile}`);
+      }
     }
   }
   for (const p of untracked) {
@@ -335,32 +416,56 @@ function moveKeepingNotes(root, args, target, tag) {
     if (fs.existsSync(path.join(root, p))) {
       // A copy that matches the incoming file loses nothing, so say nothing.
       if (sameBytes(saved, path.join(root, p))) fs.rmSync(saved, { force: true });
+      else if (isJournal(p) && joinJournal(path.join(root, p), saved)) notes.push(`joined your ${p} onto the new one`);
       else notes.push(`kept the new ${p}; your copy is in ${saved}`);
     } else {
       fs.mkdirSync(path.dirname(path.join(root, p)), { recursive: true });
       fs.copyFileSync(saved, path.join(root, p));
     }
   }
-  if (second.status !== 0) return { ok: false, error: firstLine(second.stderr), notes };
-  return { ok: true, notes };
+  if (second.status !== 0) return { ok: false, error: firstLine(second.stderr), notes, tracked, landed };
+  return { ok: true, notes, tracked, landed };
 }
 
 // Unpushed commits can carry team-note edits. Their commits move to a backup
 // branch, but the notes stay in the tree, uncommitted, like any team note.
-function carryTeamNotes(root, base, commit, teamState, tag) {
-  const files = (gitOut(['diff', '--name-only', base, commit], root) || '')
+// A note that was also edited since came back with the move already, commit
+// and all, so it is counted and not laid down twice.
+function carryTeamNotes(root, base, commit, teamState, tag, moved = { tracked: [], landed: [] }) {
+  const touched = (gitOut(['diff', '--name-only', base, commit], root) || '')
     .split('\n').filter((p) => p && isTeamState(p, teamState));
-  if (!files.length) return { carried: 0, notes: [] };
+  const already = touched.filter((p) => moved.landed.includes(p)).length;
+  const files = touched.filter((p) => !moved.tracked.includes(p));
+  if (!files.length) return { carried: already, notes: [] };
   const diff = runGit(['diff', '--binary', base, commit, '--', ...files], root);
-  if (diff.status !== 0 || !diff.stdout) return { carried: 0, notes: [] };
+  if (diff.status !== 0 || !diff.stdout) return { carried: already, notes: [] };
   const dir = path.join(commonDir(root), 'atris-zen', tag);
   fs.mkdirSync(dir, { recursive: true });
   const patchFile = path.join(dir, 'unpushed-team-notes.patch');
   fs.writeFileSync(patchFile, diff.stdout);
   const { clashed, missed } = applyNotes(root, patchFile, files);
   const notes = clashed.map((p) => `kept the new ${p}; yours is on ${commit}`);
-  for (const p of missed) notes.push(`${p} no longer fits the new changes; yours is on ${commit}`);
-  return { carried: files.length - clashed.length - missed.length, notes };
+  // A note moved upstream takes the commit's edits to its new path.
+  const moves = missed.length ? movedNotes(root, base, 'HEAD') : new Map();
+  let followed = 0;
+  for (const p of missed) {
+    const to = moves.get(p);
+    const theirs = to ? runGit(['show', `${commit}:${p}`], root) : null;
+    const mine = path.join(dir, 'unpushed', p);
+    if (theirs?.status === 0) {
+      fs.mkdirSync(path.dirname(mine), { recursive: true });
+      fs.writeFileSync(mine, theirs.stdout);
+    }
+    if (theirs?.status === 0 && followMove(root, base, p, to, mine)) {
+      notes.push(`${p} moved to ${to}, and the edits from ${commit} went with it`);
+      followed += 1;
+    } else if (to) {
+      notes.push(`${p} moved to ${to} and the edits clash there; yours is on ${commit}`);
+    } else {
+      notes.push(`${p} no longer fits the new changes; yours is on ${commit}`);
+    }
+  }
+  return { carried: already + followed + files.length - clashed.length - missed.length, notes };
 }
 
 function applyZen({ cwd = process.cwd(), fetch = true, freshMinutes, abandonedDays, now = new Date() } = {}) {
@@ -426,7 +531,10 @@ function applyZen({ cwd = process.cwd(), fetch = true, freshMinutes, abandonedDa
         runGit(['update-ref', `refs/heads/${keep}`, 'HEAD'], root);
         saved.push(`refs/heads/${keep}`);
       }
-      const moved = moveKeepingNotes(root, ['checkout', '-q', main], main, tag);
+      // Saved from where the branch left main, so a note committed on the
+      // branch and edited again since comes back whole.
+      const base = gitOut(['merge-base', 'HEAD', main], root);
+      const moved = moveKeepingNotes(root, ['checkout', '-q', main], main, tag, base || 'HEAD');
       notes.push(...(moved.notes || []));
       if (moved.ok) {
         done.push(`moved back to ${main}${branch ? ` (${branch} is kept)` : ''}`);
@@ -445,12 +553,12 @@ function applyZen({ cwd = process.cwd(), fetch = true, freshMinutes, abandonedDa
     } else if (ahead) {
       const keep = `zen-backup/${tag}-unpushed`;
       runGit(['update-ref', `refs/heads/${keep}`, 'HEAD'], root);
-      const moved = moveKeepingNotes(root, ['reset', '-q', '--keep', before.upstream], before.upstream, tag);
+      const base = gitOut(['merge-base', keep, before.upstream], root);
+      const moved = moveKeepingNotes(root, ['reset', '-q', '--keep', before.upstream], before.upstream, tag, base || 'HEAD');
       notes.push(...(moved.notes || []));
       if (moved.ok) {
         done.push(`moved ${plural(ahead, 'unpushed commit', 'unpushed commits')} to ${keep}`);
-        const base = gitOut(['merge-base', keep, before.upstream], root);
-        const carried = base ? carryTeamNotes(root, base, keep, teamState, tag) : { carried: 0, notes: [] };
+        const carried = base ? carryTeamNotes(root, base, keep, teamState, tag, moved) : { carried: 0, notes: [] };
         notes.push(...carried.notes);
         if (carried.carried) {
           done.push(`kept ${plural(carried.carried, 'team note', 'team notes')} from ${ahead === 1 ? 'it' : 'them'} in the tree`);

package/lib/zen.js

@@ -233,9 +233,23 @@ function headMovedSince(checkout, cutoff) {
   return Math.max(mtime(path.join(dir, 'logs', 'HEAD')), mtime(path.join(dir, 'HEAD'))) > cutoff;
 }
 
+// A checkout whose core.bare got set to true still has its .git folder and
+// every file, but git stops looking at the files, so "not a git repository"
+// would send the reader the wrong way. Name it, with the one-line undo.
+const BARE_FLIPPED = 'git here is set to bare (core.bare is true), so it ignores the files in this folder; git config core.bare false undoes it';
+
+function flippedToBare(cwd) {
+  if (gitOut(['rev-parse', '--is-bare-repository'], cwd) !== 'true') return false;
+  const gitDir = gitOut(['rev-parse', '--absolute-git-dir'], cwd);
+  if (!gitDir || path.basename(gitDir) !== '.git') return false;
+  const folder = path.dirname(gitDir);
+  const here = fs.realpathSync(cwd);
+  return here === folder || here.startsWith(folder + path.sep);
+}
+
 function checkZen({ cwd = process.cwd(), fetch = true, freshMinutes = freshMinutesFromEnv(), now = Date.now() } = {}) {
   const root = gitOut(['rev-parse', '--show-toplevel'], cwd);
-  if (!root) return { ok: false, error: 'not a git repository' };
+  if (!root) return { ok: false, error: flippedToBare(cwd) ? BARE_FLIPPED : 'not a git repository' };
 
   const remote = gitOut(['remote'], root)?.split('\n').includes('origin') ? 'origin' : null;
   let fetched = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.72.0",
+  "version": "3.72.1",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {

package/utils/api.js

@@ -77,8 +77,21 @@ function httpRequest(urlString, options) {
     const req = transport.request(requestOptions, (res) => {
       // Follow redirects (301, 302, 307, 308)
       if ([301, 302, 307, 308].includes(res.statusCode) && res.headers.location) {
-        const redirectUrl = new URL(res.headers.location, urlString).toString();
-        resolve(httpRequest(redirectUrl, options));
+        res.resume();
+        let redirectUrl;
+        try {
+          redirectUrl = new URL(res.headers.location, parsed);
+        } catch {
+          reject(new Error('invalid redirect target'));
+          return;
+        }
+        // Headers and bodies can both contain credentials. Never replay them
+        // to another origin, including a different port or an HTTPS downgrade.
+        if (redirectUrl.origin !== parsed.origin) {
+          reject(new Error(`refusing cross-origin redirect to ${redirectUrl.host || redirectUrl.protocol}`));
+          return;
+        }
+        resolve(httpRequest(redirectUrl.toString(), options));
         return;
       }
 

package/utils/auth.js

@@ -2,7 +2,7 @@ const os = require('os');
 const path = require('path');
 const { stateHome } = require('../lib/state-home');
 const fs = require('fs');
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const readline = require('readline');
 const agentClient = require('./agent-client');
 
@@ -12,19 +12,20 @@ const agentClient = require('./agent-client');
  */
 function openBrowser(url) {
   const platform = os.platform();
-  // Sanitize URL to prevent shell injection — only allow valid URL characters
-  const sanitizedUrl = url.replace(/[^a-zA-Z0-9\-._~:/?#\[\]@!$&'()*+,;=%]/g, '');
   let command;
+  let args = [url];
 
   if (platform === 'darwin') {
-    command = `open "${sanitizedUrl}"`;
+    command = 'open';
   } else if (platform === 'win32') {
-    command = `start "" "${sanitizedUrl}"`;
+    command = 'rundll32.exe';
+    args = ['url.dll,FileProtocolHandler', url];
   } else {
-    command = `xdg-open "${sanitizedUrl}"`;
+    command = 'xdg-open';
   }
 
-  exec(command, (error) => {
+  // Pass the URL as data, including on Windows, without a command shell.
+  execFile(command, args, (error) => {
     if (error) {
       console.log(`\nCouldn't open browser automatically. Please visit:\n${url}`);
     }