atris 3.72.4 → 3.73.0

package/commands/task.js

@@ -5,6 +5,7 @@
 
 const fs = require('fs');
 const http = require('http');
+const crypto = require('crypto');
 const { execSync } = require('node:child_process');
 const path = require('path');
 const os = require('os');
@@ -12482,7 +12483,7 @@ function taskBoardTemplate(model) {
     async function api(path, options = {}) {
       const res = await fetch(path, {
         ...options,
-        headers: { 'content-type': 'application/json', ...(options.headers || {}) }
+        headers: { 'content-type': 'application/json', 'x-atris-token': new URLSearchParams(location.search).get('t') || '', ...(options.headers || {}) }
       });
       const data = await res.json();
       if (!res.ok || data.ok === false) throw new Error(data.detail || data.reason || 'request failed');
@@ -12798,18 +12799,30 @@ function taskBoardHtml() {
 }
 
 function readJsonBody(req) {
+  if (String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase() !== 'application/json') {
+    return Promise.reject(Object.assign(new Error('json required'), { statusCode: 415 }));
+  }
   return new Promise((resolve, reject) => {
-    let body = '';
+    let size = 0;
+    const chunks = [];
     req.on('data', chunk => {
-      body += chunk;
-      if (body.length > 1_000_000) {
-        reject(new Error('body too large'));
-        req.destroy();
+      if (size > 1_000_000) return;
+      size += chunk.length;
+      if (size > 1_000_000) {
+        reject(Object.assign(new Error('body too large'), { statusCode: 413 }));
+        return;
       }
+      chunks.push(chunk);
     });
     req.on('end', () => {
+      if (size > 1_000_000) return;
+      const body = Buffer.concat(chunks).toString('utf8');
       if (!body.trim()) return resolve({});
-      try { resolve(JSON.parse(body)); } catch (e) { reject(e); }
+      try {
+        const value = JSON.parse(body);
+        if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('object required');
+        resolve(value);
+      } catch (e) { reject(Object.assign(e, { statusCode: 400 })); }
     });
     req.on('error', reject);
   });
@@ -12818,14 +12831,16 @@ function readJsonBody(req) {
 function sendJson(res, status, value, headers = {}) {
   res.writeHead(status, {
     'content-type': 'application/json; charset=utf-8',
-    'access-control-allow-origin': 'http://localhost',
+    'cache-control': 'no-store',
+    'referrer-policy': 'no-referrer',
+    'x-content-type-options': 'nosniff',
     ...headers,
   });
   res.end(JSON.stringify(value, null, 2));
 }
 
 function sendHtml(res, value) {
-  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer', 'x-content-type-options': 'nosniff' });
   res.end(value);
 }
 
@@ -13469,8 +13484,24 @@ function matchTaskApiRoute(req, url) {
   return null;
 }
 
-async function handleTaskApi(req, res, taskDb, db) {
-  const url = new URL(req.url, 'http://127.0.0.1');
+async function handleTaskApi(req, res, taskDb, db, token) {
+  let url;
+  try {
+    const target = req.url || '/';
+    url = new URL(target, 'http://127.0.0.1');
+    if (!target.startsWith('/') || target.startsWith('//') || /[\\#\0]/.test(target) || decodeURIComponent(url.pathname).includes('\0')) throw new Error('url');
+    decodeURIComponent(target);
+  } catch {
+    return sendJson(res, 400, { ok: false, reason: 'bad_url' });
+  }
+  const host = String(req.headers.host || '').toLowerCase();
+  const port = req.socket.localPort;
+  if (![`127.0.0.1:${port}`, `localhost:${port}`].includes(host)) return sendJson(res, 403, { ok: false, reason: 'host' });
+  const provided = Buffer.from(String(req.headers['x-atris-token'] || (req.method === 'GET' && url.searchParams.get('t')) || ''));
+  const expected = Buffer.from(token);
+  if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) return sendJson(res, 403, { ok: false, reason: 'token' });
+  if (req.method === 'GET' && (req.headers['transfer-encoding'] || Number(req.headers['content-length'] || 0) > 0)) return sendJson(res, 400, { ok: false, reason: 'body' });
+  if (req.method !== 'GET' && req.headers.origin !== undefined && req.headers.origin !== `http://${host}`) return sendJson(res, 403, { ok: false, reason: 'origin' });
   const matchedRoute = matchTaskApiRoute(req, url);
   if (!matchedRoute) return sendJson(res, 404, { ok: false, reason: 'not_found' });
   return matchedRoute.route.serve({
@@ -13486,26 +13517,32 @@ async function handleTaskApi(req, res, taskDb, db) {
 function createTaskApiServer(taskApi = {}) {
   const taskDb = taskApi.taskDb || getTaskDb();
   const db = taskApi.db || taskDb.open();
-  return http.createServer((req, res) => {
-    handleTaskApi(req, res, taskDb, db).catch((error) => {
-      sendJson(res, 500, { ok: false, reason: 'server_error', detail: String(error && error.message || error) });
-    });
+  const token = crypto.randomBytes(32).toString('base64url');
+  const server = http.createServer((req, res) => {
+    handleTaskApi(req, res, taskDb, db, token).catch((error) => {
+      if (res.headersSent || res.destroyed) return res.destroy();
+      const status = error.statusCode || 500;
+      sendJson(res, status, { ok: false, reason: status < 500 ? 'bad_request' : 'server_error' });
+    }).catch(() => res.destroy());
   });
+  server.taskToken = token;
+  return server;
 }
 
 function cmdServe(args) {
   const host = String(flag(args, '--host') || '127.0.0.1');
+  if (!['127.0.0.1', 'localhost'].includes(host)) throw new Error('task board only listens on 127.0.0.1');
   const port = Number(flag(args, '--port') || process.env.PORT || 8787);
   const taskDb = getTaskDb();
   const db = taskDb.open();
   const server = createTaskApiServer({ taskDb, db });
   return new Promise((resolve, reject) => {
     server.on('error', reject);
-    server.listen(port, host, () => {
+    server.listen(port, '127.0.0.1', () => {
       const addr = server.address();
       const actualPort = addr && addr.port || port;
-      console.log(`Task board: http://${host}:${actualPort}`);
-      console.log(`Workspace: ${taskDb.workspaceRoot()}`);
+      console.log(`task board: http://${host}:${actualPort}/?t=${server.taskToken}`);
+      console.log(`workspace: ${taskDb.workspaceRoot()}`);
     });
 
     const shutdown = () => {

package/commands/trust.js

@@ -0,0 +1,117 @@
+/**
+ * Trust commands for Atris CLI, see who trusts an account and vouch for people.
+ *
+ * Usage:
+ *   atris trust                  Your own trust
+ *   atris trust <handle>         Someone else's trust, and what you share
+ *   atris trust vouch <handle>   Vouch for someone (the same as following them)
+ *   atris trust unvouch <handle> Take a vouch back
+ *
+ * <handle> can be @handle, handle, a user id, or an email. A leading @ is
+ * stripped before it is sent.
+ *
+ * Backend: GET /api/trust/me, GET /api/trust/{handle_or_id},
+ * POST and DELETE /api/trust/vouch/{handle_or_id}.
+ */
+
+const { isHelpToken, argsWantHelp } = require('../lib/noninteractive');
+const { cleanTarget, targetLabel, createIo, call, reportError } = require('./pay');
+
+function splitFlags(args) {
+  const list = Array.isArray(args) ? args : [];
+  return {
+    json: list.includes('--json'),
+    rest: list.filter((a) => a !== '--json'),
+  };
+}
+
+function yesNo(value) {
+  if (value === true) return 'yes';
+  if (value === false) return 'no';
+  return null;
+}
+
+function trustLines(view, isMe) {
+  const v = view || {};
+  const name = v.handle ? `@${String(v.handle).replace(/^@+/, '')}` : (v.user_id || 'this account');
+  const friends = Number(v.friends) || 0;
+  const lines = [isMe ? `${name} (you)` : name];
+  lines.push(`  Trust score ${v.trust_score ?? 0}, from ${friends} ${friends === 1 ? 'friend' : 'friends'}`);
+  const trusted = yesNo(v.trusted_with_me);
+  if (trusted) lines.push(`  Trusted with you: ${trusted}`);
+  if (v.shared_friends !== null && v.shared_friends !== undefined) {
+    lines.push(`  Friends you share: ${v.shared_friends}`);
+  }
+  return lines;
+}
+
+async function view(io, who, json) {
+  const isMe = !who;
+  const path = isMe ? '/trust/me' : `/trust/${encodeURIComponent(cleanTarget(who))}`;
+  const res = await call(io, path);
+  if (!res.ok) return reportError(io, res, `Could not load trust (${res.status})`);
+  if (json) {
+    io.log(JSON.stringify(res.data || {}, null, 2));
+    return 0;
+  }
+  for (const line of trustLines(res.data, isMe)) io.log(line);
+  if (isMe && !(Number(res.data && res.data.friends) > 0)) {
+    io.log('\nTrust grows when people vouch for you. Find people: atris people <name>');
+  }
+  return 0;
+}
+
+async function vouch(io, who, remove, json) {
+  const verb = remove ? 'unvouch' : 'vouch';
+  const target = cleanTarget(who);
+  if (!target || isHelpToken(target)) {
+    io.error(`Usage: atris trust ${verb} <handle>`);
+    return 2;
+  }
+  const res = await call(io, `/trust/vouch/${encodeURIComponent(target)}`, {
+    method: remove ? 'DELETE' : 'POST',
+  });
+  if (!res.ok) return reportError(io, res, `Could not ${verb} (${res.status})`);
+  if (json) {
+    io.log(JSON.stringify(res.data || {}, null, 2));
+    return 0;
+  }
+  const label = targetLabel(who);
+  if (remove) {
+    io.log(`You took back your vouch for ${label}.`);
+  } else if (res.data && res.data.is_mutual) {
+    io.log(`You vouched for ${label}. You vouch for each other now.`);
+  } else {
+    io.log(`You vouched for ${label}.`);
+  }
+  return 0;
+}
+
+function printHelp(log = console.log) {
+  log(`atris trust, who trusts an account and who you vouch for
+
+  atris trust                    Your trust
+  atris trust <handle>           Their trust, and the friends you share
+  atris trust vouch <handle>     Vouch for someone (same as following them)
+  atris trust unvouch <handle>   Take your vouch back
+
+  <handle> is @handle, a user id, or an email.
+  Trust score is how many friends an account has (people who follow each other).
+  Add --json for the raw answer.
+  Pay someone: atris pay <handle> <amount>`);
+}
+
+async function trustCommand(argv, ioOverrides) {
+  const io = createIo(ioOverrides);
+  const { json, rest } = splitFlags(argv || process.argv.slice(3));
+  const sub = rest[0];
+  if (isHelpToken(sub) || argsWantHelp(rest)) {
+    printHelp(io.log);
+    return 0;
+  }
+  if (sub === 'vouch') return vouch(io, rest[1], false, json);
+  if (sub === 'unvouch') return vouch(io, rest[1], true, json);
+  return view(io, sub, json);
+}
+
+module.exports = { trustCommand, trustLines };

package/commands/zen.js

@@ -3,9 +3,11 @@
 const { abandonedDaysFromEnv, checkZen, sideCopyLines } = require('../lib/zen');
 const { applyZen } = require('../lib/zen-apply');
 const { workspaceZen } = require('../lib/zen-workspace');
+const { fleetFile, fleetRepos, fleetZen, printFleet } = require('../lib/zen-fleet');
 
 function showZenHelp() {
   console.log('usage: atris zen [--check] [--no-fetch] [--json]');
+  console.log('       atris zen --all [repo ...]');
   console.log('');
   console.log('Brings this repo to zen: code matches origin, nothing left lying around.');
   console.log('Old stashes are archived, idle side copies put away, finished branches');
@@ -21,6 +23,9 @@ function showZenHelp() {
   console.log('  --check      Only look. Report what is out of place and change nothing.');
   console.log('  --no-fetch   Use the last fetched origin instead of fetching.');
   console.log('  --json       Print machine-readable results.');
+  console.log('  --all        Zen every repo you list, one line each. Repos come from the');
+  console.log('               command line or ~/.atris/zen.json: {"repos": ["~/code/app"]}.');
+  console.log('               A repo with unsaved live data or secrets is skipped for you.');
   console.log('');
   console.log('Add more team-state paths in .atris/zen.json: {"team_state": ["logs/"]}');
 }
@@ -151,6 +156,18 @@ function zenCommand(args = [], cwd = process.cwd()) {
   const fetch = !args.includes('--no-fetch');
   const json = args.includes('--json');
 
+  if (args.includes('--all')) {
+    const repos = fleetRepos(args.filter((a) => !a.startsWith('--')));
+    if (!repos.length) {
+      console.log(`zen: no repos listed. Name them (atris zen --all ~/code/app ~/code/site) or list them in ${fleetFile()}.`);
+      return 2;
+    }
+    const results = fleetZen({ repos, fetch });
+    if (json) console.log(JSON.stringify(results, null, 2));
+    else printFleet(results);
+    return results.every((r) => r.state === 'zen' || r.state === 'skipped') ? 0 : 1;
+  }
+
   if (args.includes('--check')) {
     const result = checkZen({ cwd, fetch });
     if (json) {