atris 3.73.1 → 3.74.1

package/commands/mission.js

@@ -38,6 +38,7 @@ const {
   resolveEngineForRoleWithPreference,
   engineFailureHealthStatus,
   engineStallReason,
+  engineRegistryView,
   recordEngineRunHealth,
   setEngineHealth,
 } = require('../lib/engine-registry');
@@ -1905,15 +1906,58 @@ function recordMemberHandoff(fromMember, toMember, sliceSummary, root = process.
     next_command: `atris member go ${to}`,
     created_at: now,
   };
+  const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
+  try {
+    withHandoffsLock(handoffsFile, () => fs.appendFileSync(handoffsFile, `${JSON.stringify(handoff)}\n`, 'utf8'));
+  } catch {
+    return null;
+  }
   try {
-    const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
-    fs.mkdirSync(path.dirname(handoffsFile), { recursive: true });
-    fs.appendFileSync(handoffsFile, `${JSON.stringify(handoff)}\n`, 'utf8');
     autoQueueMemberNextPush(to, `${from} handoff: ${cleanSummary}`, `Baton pass from ${from}`, parentRoot);
   } catch {}
   return handoff;
 }
 
+// Every write to member-handoffs.jsonl (append or whole-file rewrite) holds
+// one lock file beside it, so concurrent handoffs never lose a row.
+// (Codex review round 3 on #1483.)
+function withHandoffsLock(handoffsFile, fn) {
+  fs.mkdirSync(path.dirname(handoffsFile), { recursive: true });
+  const lockFile = path.join(path.dirname(handoffsFile), 'member-handoffs.lock');
+  return require('../lib/handoff-wake').withFileLock(lockFile, fn, { staleMs: 60 * 1000, waitMs: 30 * 1000 });
+}
+
+function rewriteHandoffs(handoffsFile, lines) {
+  const tmp = `${handoffsFile}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${lines.join('\n')}\n`, 'utf8');
+  fs.renameSync(tmp, handoffsFile);
+}
+
+// Merge `patch` into the newest handoff row with this id. Returns the
+// updated row, or null when it is not on file.
+function updateMemberHandoff(handoffId, patch, root = process.cwd()) {
+  const id = String(handoffId || '');
+  if (!id || !patch) return null;
+  const handoffsFile = path.join(resolveMemberWorkspaceRoot(root), '.atris', 'state', 'member-handoffs.jsonl');
+  try {
+    return withHandoffsLock(handoffsFile, () => {
+      const lines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
+      for (let i = lines.length - 1; i >= 0; i -= 1) {
+        let row = null;
+        try { row = JSON.parse(lines[i]); } catch {}
+        if (!row || row.id !== id) continue;
+        const updated = { ...row, ...patch };
+        lines[i] = JSON.stringify(updated);
+        rewriteHandoffs(handoffsFile, lines);
+        return updated;
+      }
+      return null;
+    });
+  } catch {
+    return null;
+  }
+}
+
 function closeMemberHandoffsForReceiver(receiverMember, root = process.cwd()) {
   const receiver = String(receiverMember || '').trim().toLowerCase();
   if (!receiver) return 0;
@@ -1921,28 +1965,30 @@ function closeMemberHandoffsForReceiver(receiverMember, root = process.cwd()) {
   const handoffsFile = path.join(parentRoot, '.atris', 'state', 'member-handoffs.jsonl');
   if (!fs.existsSync(handoffsFile)) return 0;
   try {
-    const rawLines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
-    let closedCount = 0;
-    const now = stampIso();
-    const updatedLines = rawLines.map((line) => {
-      try {
-        const row = JSON.parse(line);
-        if (row && String(row.to || '').toLowerCase() === receiver && (row.status || 'open') === 'open') {
-          closedCount++;
-          return JSON.stringify({ ...row, status: 'closed', closed_at: now });
-        }
-      } catch {}
-      return line;
-    });
-    if (closedCount > 0) {
-      fs.writeFileSync(handoffsFile, `${updatedLines.join('\n')}\n`, 'utf8');
-    }
-    return closedCount;
+    return withHandoffsLock(handoffsFile, () => closeHandoffRows(handoffsFile, receiver));
   } catch {
     return 0;
   }
 }
 
+function closeHandoffRows(handoffsFile, receiver) {
+  const rawLines = fs.readFileSync(handoffsFile, 'utf8').split(/\r?\n/).filter((l) => l.trim());
+  let closedCount = 0;
+  const now = stampIso();
+  const updatedLines = rawLines.map((line) => {
+    try {
+      const row = JSON.parse(line);
+      if (row && String(row.to || '').toLowerCase() === receiver && (row.status || 'open') === 'open') {
+        closedCount++;
+        return JSON.stringify({ ...row, status: 'closed', closed_at: now });
+      }
+    } catch {}
+    return line;
+  });
+  if (closedCount > 0) rewriteHandoffs(handoffsFile, updatedLines);
+  return closedCount;
+}
+
 function memberMissionFile(owner, root = process.cwd()) {
   const dir = memberDir(owner, root);
   if (!dir) return null;
@@ -3217,6 +3263,7 @@ function missionFromArgs(args) {
     '--task',
     '--ask',
     '--yes-lock',
+    '--yes-lock-parent',
     '--campaign',
     '--reserve',
     '--mission-id',
@@ -3260,7 +3307,18 @@ function missionFromArgs(args) {
   const taskIds = readRepeatedFlag(args, '--task');
   // MEMBER.md approval-required becomes an open human ask the owner must clear.
   const humanAsks = [...readRepeatedFlag(args, '--ask'), ...memberApprovalAsks(owner, process.cwd(), objective)];
-  const yesLocks = readYesLockSeal(readFlag(args, '--yes-lock', ''), wantsJson(args));
+  // The seal is never read from text a caller passes through: two
+  // --yes-lock words (one could be the objective) refuse the start, and a
+  // run woken by a handoff carries its seal in the environment, which every
+  // job it starts inherits. (Codex review round 6 on #1483.)
+  if (args.filter(isYesLockWord).length > 1) {
+    exitMissionError('mission start got more than one --yes-lock, so it is not clear which seal applies; nothing started', 2, wantsJson(args));
+  }
+  const handoffSeal = String(process.env.ATRIS_HANDOFF_YES_LOCK || '').trim();
+  const yesLocks = readYesLockSeal(handoffSeal || readFlag(args, '--yes-lock', ''), wantsJson(args));
+  const yesLockParent = yesLocks.length
+    ? String((handoffSeal ? process.env.ATRIS_HANDOFF_YES_LOCK_PARENT : readFlag(args, '--yes-lock-parent', '')) || '').trim()
+    : '';
   const drive = missionDrive(readFlag(args, '--destination', ''));
   const alwaysOn = hasFlag(args, '--always-on');
   const xpTaskEnabled = hasFlag(args, '--xp-task') || hasFlag(args, '--agent-xp');
@@ -3299,6 +3357,9 @@ function missionFromArgs(args) {
     human_asks: humanAsks,
     // the sealed owner steps: the guard holds what each locks until the owner says yes
     ...(yesLocks.length ? { yes_locks: { steps: yesLocks, sealed_at: stampIso() } } : {}),
+    // a run woken by a handoff: the job it came from, only to show its yes
+    // cards there (lib/yes-lock.js handoffYesCards)
+    ...(yesLockParent ? { yes_lock_parent: yesLockParent } : {}),
     ...(campaignId ? { campaign_id: campaignId } : {}),
     ...(drive ? { drive } : {}),
     next_action: verifier ? 'run verifier with `atris mission tick <id> --verify`' : 'define verifier or run next task',
@@ -3319,7 +3380,12 @@ function missionFromArgs(args) {
 
 // --yes-lock '[{"step":3,"text":"...","categories":["publish"]}]': the owner
 // steps a job may not do before the owner says yes. Bad input stops the start.
-const YES_LOCK_CATEGORIES = new Set(['publish', 'tag', 'post', 'send', 'merge', 'deploy']);
+const YES_LOCK_CATEGORIES = new Set(['publish', 'tag', 'post', 'send', 'merge', 'deploy', 'spend']);
+function isYesLockWord(arg) {
+  const text = String(arg || '').trim();
+  return text === '--yes-lock' || text.startsWith('--yes-lock=');
+}
+
 function readYesLockSeal(raw, asJson) {
   if (!raw) return [];
   let list;
@@ -3329,7 +3395,7 @@ function readYesLockSeal(raw, asJson) {
     exitMissionError('--yes-lock takes a JSON list of {step, text, categories}', 2, asJson);
   }
   const ok = Array.isArray(list) && list.every(l => l && Number.isInteger(l.step) && l.step > 0 && Array.isArray(l.categories) && l.categories.length && l.categories.every(c => YES_LOCK_CATEGORIES.has(c)));
-  if (!ok) exitMissionError('--yes-lock takes a JSON list of {step, text, categories}, with categories from publish, tag, post, send, merge, deploy', 2, asJson);
+  if (!ok) exitMissionError('--yes-lock takes a JSON list of {step, text, categories}, with categories from publish, tag, post, send, merge, deploy, spend', 2, asJson);
   return list.map(l => ({ step: l.step, text: String(l.text || '').slice(0, 200), categories: [...new Set(l.categories)] }));
 }
 
@@ -3797,10 +3863,6 @@ function chooseNextMissionAnalysis(mission, root = process.cwd()) {
   return { target: null, near_misses: [] };
 }
 
-function chooseNextMissionTarget(mission, root = process.cwd()) {
-  return chooseNextMissionAnalysis(mission, root).target;
-}
-
 function normalizeMissionOwner(value) {
   return String(value || '').trim().toLowerCase();
 }
@@ -4512,6 +4574,15 @@ function normalizedObjective(text) {
   return String(text || '').toLowerCase().replace(/\s+/g, ' ').trim();
 }
 
+// True when `existing` runs under the lock `wanted` carries: the start
+// carries none, or the same seal.
+function lockCovered(existing, wanted) {
+  const want = (wanted && wanted.yes_locks && wanted.yes_locks.steps) || [];
+  if (!want.length) return true;
+  const have = (existing && existing.yes_locks && existing.yes_locks.steps) || [];
+  return JSON.stringify(have) === JSON.stringify(want);
+}
+
 function findActiveTwinMission(objective, owner, root = process.cwd()) {
   const wantObjective = normalizedObjective(objective);
   const wantOwner = String(owner || '').trim().toLowerCase();
@@ -4547,6 +4618,11 @@ function startMission(args, options = {}) {
   const idLikeObjective = String(mission.objective || '').trim();
   if (/^mission-\d{4}-\d{2}-\d{2}-/.test(idLikeObjective)) {
     const existing = resolveMission(idLikeObjective);
+    if (existing && !lockCovered(existing, mission)) {
+      // A start carrying a yes-lock never resumes a job under a weaker lock:
+      // it would run without it. (Codex review round 4 on #1483.)
+      exitMissionError(`${existing.id} is not under the yes-lock this start carries, so resuming it would run without the yes-lock; start a new job instead`, 2, asJson);
+    }
     if (existing) {
       printJsonOrText(
         { ok: true, action: 'mission_recovered', recovered: true, mission: existing, note: 'objective looked like a mission id; recovered the existing mission instead of creating a new one' },
@@ -4560,55 +4636,57 @@ function startMission(args, options = {}) {
     }
     exitMissingMission(idLikeObjective, 1, asJson);
   }
-  if (!hasFlag(args, '--duplicate')) {
-    const twin = findActiveTwinMission(mission.objective, mission.owner);
-    if (twin) {
-      const requestedDestination = mission.drive?.destination || '';
-      if (requestedDestination && twin.drive?.destination && requestedDestination !== twin.drive.destination) {
-        const proposed = proposeMissionDestinationChange(twin, requestedDestination);
-        const proposal = proposed.drive.pending_destination_proposal;
-        const missionRoot = twin.worktree_root || process.cwd();
-        const { mission: saved } = saveMission(
-          proposed,
-          missionRoot,
-          'mission_destination_change_proposed',
-          {
-            current_destination: twin.drive.destination,
-            proposed_destination: proposal.destination,
-            reason: proposal.reason,
-          },
-        );
-        printJsonOrText(
-          {
-            ok: true,
-            action: 'mission_destination_change_proposed',
-            reused: true,
-            operator_gate_required: true,
-            mission: saved,
-            proposal,
-          },
-          [
-            `Destination change proposed for ${saved.id}.`,
-            `Current destination: ${saved.drive.destination}`,
-            `Proposed destination: ${proposal.destination}`,
-            `Operator gate: ${proposal.reason}.`,
-          ],
-          asJson,
-        );
-        return;
-      }
+  // A start that carries a yes-lock never reuses a twin under a different
+  // lock (or none): the reused job would run without it. It gets a fresh
+  // job under the lock instead. (Codex review rounds 3 and 4 on #1483.)
+  const twinCandidate = hasFlag(args, '--duplicate') ? null : findActiveTwinMission(mission.objective, mission.owner);
+  if (twinCandidate && lockCovered(twinCandidate, mission)) {
+    const twin = twinCandidate;
+    const requestedDestination = mission.drive?.destination || '';
+    if (requestedDestination && twin.drive?.destination && requestedDestination !== twin.drive.destination) {
+      const proposed = proposeMissionDestinationChange(twin, requestedDestination);
+      const proposal = proposed.drive.pending_destination_proposal;
+      const missionRoot = twin.worktree_root || process.cwd();
+      const { mission: saved } = saveMission(
+        proposed,
+        missionRoot,
+        'mission_destination_change_proposed',
+        {
+          current_destination: twin.drive.destination,
+          proposed_destination: proposal.destination,
+          reason: proposal.reason,
+        },
+      );
       printJsonOrText(
-        { ok: true, action: 'mission_reused', reused: true, mission: twin, note: 'an active mission with this objective and owner already exists; resumed instead of cloning (pass --duplicate to force a second one)' },
+        {
+          ok: true,
+          action: 'mission_destination_change_proposed',
+          reused: true,
+          operator_gate_required: true,
+          mission: saved,
+          proposal,
+        },
         [
-          `Already active: ${twin.id} (${twin.status})`,
-          `Same objective, same owner, reusing it instead of starting a clone.`,
-          `Resume: atris mission run ${twin.id}`,
-          `Really want a second one: re-run with --duplicate`,
+          `Destination change proposed for ${saved.id}.`,
+          `Current destination: ${saved.drive.destination}`,
+          `Proposed destination: ${proposal.destination}`,
+          `Operator gate: ${proposal.reason}.`,
         ],
         asJson,
       );
       return;
     }
+    printJsonOrText(
+      { ok: true, action: 'mission_reused', reused: true, mission: twin, note: 'an active mission with this objective and owner already exists; resumed instead of cloning (pass --duplicate to force a second one)' },
+      [
+        `Already active: ${twin.id} (${twin.status})`,
+        `Same objective, same owner, reusing it instead of starting a clone.`,
+        `Resume: atris mission run ${twin.id}`,
+        `Really want a second one: re-run with --duplicate`,
+      ],
+      asJson,
+    );
+    return;
   }
   // Intake gate: a mission without a verifier is a planning wish, and planning
   // wishes silt up the queue (11 swept on 2026-07-06 with zero ticks). Refuse
@@ -4736,6 +4814,13 @@ function startMission(args, options = {}) {
     lane: saved.lane,
     verifier: saved.verifier,
   });
+  if (saved.yes_lock_parent && saved.yes_locks && saved.yes_locks.steps) {
+    // the lock record names the job it came from, before any command is held
+    try {
+      require('../lib/yes-lock').writeYesLocks(path.join(require('../lib/state-home').atrisHome(), 'state'), saved.id,
+        { seal: saved.yes_locks.steps, parentMissionId: saved.yes_lock_parent });
+    } catch {}
+  }
   const worktreeBaseline = captureMissionWorktreeBaseline(saved, process.cwd(), codeBaseline);
   const nextTickCommand = `atris mission tick ${saved.id}${saved.verifier ? ' --verify' : ''}`;
   const payload = {
@@ -12807,6 +12892,9 @@ module.exports = {
   usefulClaudeReceiptSummary,
   autoQueueMemberNextPush,
   recordMemberHandoff,
+  updateMemberHandoff,
+  resolveMemberWorkspaceRoot,
+  isYesLockWord,
   closeMemberHandoffsForReceiver,
   cappedClaudeReceiptText,
   extractLayerFromReceiptText,

package/commands/now.js

@@ -273,13 +273,6 @@ function taskReceiptTitle(row) {
   return compactLine(row?.state?.title || row?.title || row?.task_id || 'untitled work');
 }
 
-// The receipts behind "Completed receipts today", as lines a human can read:
-// one per receipt, landed result + human proof state. Shares the collector
-// with the count so the number and the visible list always match.
-function todayTaskReceiptLines(root = process.cwd(), date = new Date(), limit = 6) {
-  return formatTaskReceiptLines(collectTaskReceiptsToday(root, date), limit);
-}
-
 // Format an already-collected receipt list, so a caller that needs both the
 // count and the lines (renderDefaultNow) parses the receipt files only once.
 function formatTaskReceiptLines(receipts, limit = 6) {

package/commands/plugin.js

@@ -2,7 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { execSync } = require('child_process');
-const { findAllSkills, parseFrontmatter } = require('./skill');
+const { findAllSkills } = require('./skill');
 
 // --- Recursive Copy Helper ---
 

package/commands/pull.js

@@ -7,7 +7,7 @@ const { loadConfig } = require('../utils/config');
 const { getLogPath } = require('../lib/file-ops');
 const { parseJournalSections, mergeSections, reconstructJournal } = require('../lib/journal');
 const { loadBusinesses, businessMatchesSlug } = require('./business');
-const { loadManifest, saveManifest, computeFileHash, buildManifest, computeLocalHashes, threeWayCompare, isIgnoredSyncPath } = require('../lib/manifest');
+const { loadManifest, saveManifest, buildManifest, computeLocalHashes, threeWayCompare, isIgnoredSyncPath } = require('../lib/manifest');
 const { normalizeWikiOnlyPrefix } = require('../lib/wiki');
 const { emitSyncEvent, startTimer } = require('../lib/sync-telemetry');
 const { resolveSafeOutputDir } = require('../lib/workspace-safety');

package/commands/push.js

@@ -1,6 +1,5 @@
 const fs = require('fs');
 const path = require('path');
-const crypto = require('crypto');
 const readline = require('readline');
 const { loadCredentials, abortOnAuthFailure } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');

package/commands/radar.js

@@ -685,10 +685,6 @@ function taskBinding(source, scope = null) {
   return { task_source: source, task_scope: scope };
 }
 
-function taskBindingForProjection(task) {
-  return task ? taskBinding('repo_task_projection', 'repo') : taskBinding(null, null);
-}
-
 function taskSourceLabel(sources = []) {
   if (sources.includes('member_loop_lock')) return 'member loop lock';
   if (sources.includes('mission_lock')) return 'mission lock';

package/commands/recap.js

@@ -13,6 +13,7 @@ const {
   taskCommand,
 } = require('../lib/first-minute');
 const { isRealTestRunnerProof, quoteVerifierCommand } = require('../lib/verifier-quality');
+const { buildAgentToday, renderAgentToday, hasActivity, ranAgent } = require('../lib/agent-today');
 
 const DAY_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_DAYS = 7;
@@ -38,7 +39,8 @@ function readProjection(root) {
 
 function loadTasks(root) {
   const taskDb = loadTaskDb();
-  if (taskDb) {
+  // Reading never creates the db: a first run before any setup writes nothing.
+  if (taskDb && fs.existsSync(taskDb.getDbPath())) {
     try {
       const db = taskDb.open();
       const ws = taskDb.workspaceRoot(root);
@@ -335,11 +337,14 @@ function printRecapHelp() {
 atris recap - what got done, in spoken lines
 
   atris recap              a few spoken lines: waiting for your ok, still being checked
+  atris recap today        what your ai coding agent did in this folder today
   atris recap --verbose    the old report
   atris recap --days 30    widen the window
   atris recap --share      paste-ready summary for Slack, email, or a customer
   atris recap --json       structured output for agents and dashboards
 
+in a folder with no atris setup, recap shows today by default.
+today reads claude code and codex logs on this computer plus git. it sends nothing.
 certified work names atris task accept. uncertified stays still being checked.
 use --verbose or --share for the old report.
 `);
@@ -351,6 +356,11 @@ function recapAtris(args = []) {
     return;
   }
   const cwd = process.cwd();
+  if (args[0] === 'today') {
+    const today = buildAgentToday({ cwd });
+    console.log(args.includes('--json') ? JSON.stringify(today, null, 2) : renderAgentToday(today));
+    return;
+  }
   const taskDb = loadTaskDb();
   let root = cwd;
   try {
@@ -370,6 +380,20 @@ function recapAtris(args = []) {
   const daysIdx = args.indexOf('--days');
   const days = daysIdx !== -1 ? Number(args[daysIdx + 1]) : DEFAULT_DAYS;
   const data = buildRecapData(root, { days });
+  // Before any setup, or when the board has nothing to say, the useful
+  // first minute is what your ai agent already did in this folder today.
+  const boardQuiet = data.empty
+    || ['shipped', 'waiting', 'checking', 'inProgress'].every((k) => !(data[k] || []).length);
+  if (boardQuiet && !args.includes('--verbose') && !args.includes('--full') && !args.includes('--share')) {
+    const today = buildAgentToday({ cwd });
+    // A brand new folder already names its last commit in the first
+    // minute, so commits alone keep that; an ai session here wins.
+    const fresh = data.empty && isFreshWorkspace(root) && !inProjectSubdir;
+    if (hasActivity(today) && (ranAgent(today) || !fresh)) {
+      console.log(args.includes('--json') ? JSON.stringify(today, null, 2) : renderAgentToday(today));
+      return;
+    }
+  }
   if (
     data.empty
     && isFreshWorkspace(root)

package/commands/report.js

@@ -110,10 +110,6 @@ function buildDoneTasks(root, cutoff) {
     });
 }
 
-function buildLandings(root, cutoff) {
-  return buildDoneTasks(root, cutoff).filter(task => task.landed);
-}
-
 function landingStatusText(task) {
   const status = String(task?.landing_status || 'unchecked').replace(/_/g, ' ');
   const reason = String(task?.landing_reason || '').replace(/_/g, ' ');

package/commands/review.js

@@ -9,7 +9,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
 
 function findReviewEngine() {
   // Look for review_engine.py in common locations

package/commands/setup.js

@@ -1,5 +1,3 @@
-const fs = require('fs');
-const path = require('path');
 const { loadCredentials, promptUser } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 
@@ -73,6 +71,12 @@ async function setupAtris() {
       token: creds.token,
     });
 
+    if (!result.ok && result.status === 401) {
+      console.error('\n  Your saved login has expired, so Atris could not list your businesses.');
+      console.error('  Run "atris login", then "atris setup" again.');
+      process.exit(1);
+    }
+
     if (!result.ok) {
       console.error(`\n  Could not fetch businesses: ${result.error || 'Unknown error'}`);
       console.error('  You can add one later with: atris business add <slug>');

package/commands/slop.js

@@ -418,9 +418,15 @@ function findDeadCode(root = process.cwd(), opts = {}) {
   const candidates = scanDirs.flatMap((d) => listJsFiles(d));
   if (!candidates.length) return { root, candidates: 0, dead: [], testOnly: [] };
 
-  // 1) reachability BFS from entrypoints over static edges
+  // 1) reachability BFS from entrypoints over static edges. A file that runs
+  //    itself when started directly (`node lib/x.js`, guarded by
+  //    `require.main === module`) is an entrypoint too, even if only a test
+  //    imports it.
   const reached = new Set();
-  const queue = [...deadEntrypoints(root)];
+  const runsItself = (f) => {
+    try { return /\brequire\.main\s*===\s*module\b/.test(fs.readFileSync(f, 'utf8')); } catch { return false; }
+  };
+  const queue = [...deadEntrypoints(root), ...candidates.filter(runsItself)];
   while (queue.length) {
     const f = queue.pop();
     if (reached.has(f)) continue;