atris 3.74.2 → 3.74.4

package/atris/atris.md

@@ -60,6 +60,15 @@ Labels used below:
 - `guarded`: checked by code or a pre-commit hook; bypassing is a bug
 - `expected`: convention; honor it or stop
 
+## values
+
+Four values decide close calls. When a rule above does not settle it, these do.
+
+- **Acceleration.** Progress compounds. Land small working changes early and often so the next agent builds on them today, not next week.
+- **Accuracy.** A win counts only when it is checked. Prove it with a test that failed before and passes after, or a second builder's review when the stakes call for it. Faster tests make faster work.
+- **Ambition.** Take one more level. When the small fix is done, look for the bigger version of the same win.
+- **Agency.** Own the missing piece. A bug, a broken tool, or a gap in your way is yours to fix or file, not a reason to stop.
+
 ## taste
 
 What you ship should not read as generated. The test: if someone said "an AI made this," would they believe it instantly? If yes, that is the bug. The model has no words for restraint and it falls into gravity wells. Beat both.

package/atris.md

@@ -82,6 +82,15 @@ Labels used below:
 - `guarded`: checked by code or a pre-commit hook; bypassing is a bug
 - `expected`: convention; honor it or stop
 
+## values
+
+Four values decide close calls. When a rule above does not settle it, these do.
+
+- **Acceleration.** Progress compounds. Land small working changes early and often so the next agent builds on them today, not next week.
+- **Accuracy.** A win counts only when it is checked. Prove it with a test that failed before and passes after, or a second builder's review when the stakes call for it. Faster tests make faster work.
+- **Ambition.** Take one more level. When the small fix is done, look for the bigger version of the same win.
+- **Agency.** Own the missing piece. A bug, a broken tool, or a gap in your way is yours to fix or file, not a reason to stop.
+
 ## taste
 
 What you ship should not read as generated. The test: if someone said "an AI made this," would they believe it instantly? If yes, that is the bug. The model has no words for restraint and it falls into gravity wells. Beat both.

package/commands/business.js

@@ -1214,8 +1214,14 @@ async function startBusinessWorkspace(...args) {
   return state;
 }
 
+// Local calendar day; toISOString is UTC and dates evening work tomorrow
+// anywhere west of Greenwich.
+function localDay(now = new Date()) {
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
+}
+
 function defaultSharePath(cwd, role) {
-  const stamp = new Date().toISOString().slice(0, 10);
+  const stamp = localDay();
   const roleSlug = slugifyName(role || 'collaborator');
   return path.join(cwd, 'atris', 'reports', `${stamp}-share-${roleSlug}.md`);
 }
@@ -1494,7 +1500,7 @@ async function onboardBusiness(...flags) {
   const intakeRel = path.relative(cwd, intakePath).replace(/\\/g, '/');
   const linksRel = path.relative(cwd, linksPath).replace(/\\/g, '/');
   const sourcesRel = path.relative(cwd, sourcesPath).replace(/\\/g, '/');
-  const today = new Date().toISOString().slice(0, 10);
+  const today = localDay();
 
   const briefSlug = `${bizMeta.slug}-starter-brief`;
   const briefPath = path.join(cwd, 'atris', 'wiki', 'briefs', `${briefSlug}.md`);
@@ -2803,7 +2809,7 @@ async function createBusinessInternal(name, flags = [], mode = 'auto') {
         description ? `\n> ${description}\n` : '',
         '\n## The Business\n\n[What problem does this solve?]\n',
         '## Revenue Model\n\n[How does this make money?]\n',
-        `---\n*Created: ${new Date().toISOString().split('T')[0]}*\n`,
+        `---\n*Created: ${localDay()}*\n`,
       ].join(''));
       console.log(`  Local scaffold: ${bizDir}/`);
     }

package/commands/gm.js

@@ -287,6 +287,12 @@ function pickSeedPlayer(workspaceRoot, tasks, args = []) {
   return null;
 }
 
+// Local calendar day; toISOString is UTC and stamps an evening mission
+// with tomorrow anywhere west of Greenwich.
+function localDay(now = new Date()) {
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
+}
+
 function ensureStarterMission(taskDb, db, workspaceRoot, tasks, args = []) {
   if (hasFlagOrValue(args, '--no-seed')) return { tasks, seeded: null };
   if (!fs.existsSync(path.join(workspaceRoot, 'atris'))) return { tasks, seeded: null };
@@ -303,7 +309,7 @@ function ensureStarterMission(taskDb, db, workspaceRoot, tasks, args = []) {
       assigned_to: player,
       delegate_via: 'agentxp_gm',
       auto_seeded_by: 'atris gm',
-      created_for_day: new Date().toISOString().slice(0, 10),
+      created_for_day: localDay(),
     },
   });
   taskDb.noteTask(db, {
@@ -1951,6 +1957,7 @@ async function gmCommand(...args) {
 
 module.exports = {
   displayCommand,
+  ensureStarterMission,
   gmCommand,
   pickClub,
   playAction,

package/commands/member.js

@@ -3385,7 +3385,10 @@ function logDateForScan(relativePath, filePath) {
   const named = dateFromLogPath(relativePath);
   if (named) return named;
   try {
-    return fs.statSync(filePath).mtime.toISOString().slice(0, 10);
+    // Local calendar day, like the dated journal names beside it;
+    // toISOString is UTC and calls an evening write tomorrow's.
+    const mtime = fs.statSync(filePath).mtime;
+    return `${mtime.getFullYear()}-${String(mtime.getMonth() + 1).padStart(2, '0')}-${String(mtime.getDate()).padStart(2, '0')}`;
   } catch {
     return null;
   }
@@ -12015,6 +12018,7 @@ async function memberCommand(subcommand, ...args) {
 }
 
 module.exports = {
+  logDateForScan,
   memberRunDefaultWallSeconds,
   memberRunWantsReferee,
   proposalPromptForGoal,

package/commands/task.js

@@ -5857,7 +5857,7 @@ function delegateTask(args, options = {}) {
     assigned_to: owner,
     delegate_via: via,
     swarlo_channel: via === 'swarlo' ? String(tag || 'tasks') : null,
-    created_for_day: new Date().toISOString().slice(0, 10),
+    created_for_day: localDay(),
     owner_resolution: ownerResolution.reason,
   };
   if (ownerResolution.requested_owner) metadata.requested_owner = ownerResolution.requested_owner;
@@ -6023,6 +6023,12 @@ function cmdKeep(args) {
   console.log(`put away ${count} ${noun} that were finished or sitting still.`);
 }
 
+// Local calendar day; toISOString is UTC and calls the evening tomorrow
+// anywhere west of Greenwich.
+function localDay(now = new Date()) {
+  return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
+}
+
 function cmdDay(args) {
   const kept = require('../lib/task-list-keeper').keepWorkspaceTaskList(process.cwd());
   if (keptCount(kept)) autoRenderTodoFromDb(process.cwd());
@@ -6042,7 +6048,7 @@ function cmdDay(args) {
     failed: (projection.tasks || []).filter(task => task.status === 'failed').length,
     stale_failed: staleFailed.length,
   };
-  const date = new Date().toISOString().slice(0, 10);
+  const date = localDay();
   if (wantsJson(args)) {
     printJson({
       ok: true,

package/commands/taste.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { addTaste, listTaste } = require('../lib/taste-lessons');
+const { localDay } = require('../lib/local-day');
 
 const VALID_FLAGS = new Set(['--why', '--scope', '--example']);
 
@@ -86,7 +87,7 @@ function tasteCommand(args = [], options = {}) {
       why,
       scope,
       example,
-      added: new Date().toISOString().slice(0, 10),
+      added: localDay(),
       root,
     });
     stdout.write(`saved the operator's ${entry.verdict} verdict for "${entry.subject}".\n`);

package/commands/zen.js

@@ -143,7 +143,7 @@ function printApply(result, out) {
   }
   line(dim(`  ${teamLine(result.team_files)}`));
   if (result.saved.length) {
-    line(dim('  everything is kept: git for-each-ref refs/archive refs/heads/zen-backup'));
+    line(dim('  nothing was thrown away. see what zen saved:   git for-each-ref refs/archive refs/heads/zen-backup'));
   }
   line('');
 }

package/lib/auto-lessons.js

@@ -134,7 +134,9 @@ function writeJsonAtomic(filePath, value) {
 function isoDate(now) {
   const date = now instanceof Date ? now : new Date(now || Date.now());
   if (Number.isNaN(date.getTime())) throw new AutoLessonsError('cannot file automatic lessons with an invalid date');
-  return date.toISOString().slice(0, 10);
+  // Local calendar day; toISOString is UTC and dates an evening lesson
+  // tomorrow anywhere west of Greenwich.
+  return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, '0')}-${String(date.getDate()).padStart(2, '0')}`;
 }
 
 function typedLesson(signal, options = {}) {

package/lib/improve-vitals-html.js

@@ -35,13 +35,22 @@ function commitsSinceMidnight(root) {
   }
 }
 
+// Local calendar day (YYYY-MM-DD) of a time, or null. Close events are stored
+// as UTC ISO times, and the UTC day is already tomorrow in the evening west
+// of Greenwich, so "today" is compared as local days on both sides.
+function localDay(value) {
+  const d = value instanceof Date ? value : new Date(value || NaN);
+  if (Number.isNaN(d.getTime())) return null;
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+
 function closedToday(cwd, now) {
   try {
     const close = require('../commands/close');
-    const today = now.toISOString().slice(0, 10);
+    const today = localDay(now);
     return close.foldEvents(close.readEvents(cwd), { now })
-      .filter((f) => (f.status === 'closed' && String(f.closed_at || '').startsWith(today))
-        || (f.status === 'dissolved' && String(f.dissolved_at || '').startsWith(today)))
+      .filter((f) => (f.status === 'closed' && localDay(f.closed_at) === today)
+        || (f.status === 'dissolved' && localDay(f.dissolved_at) === today))
       .map((f) => ({ what: f.what, status: f.status }));
   } catch {
     return [];

package/lib/orb-scorecard.js

@@ -115,6 +115,13 @@ function pairOrbRuns(records) {
   return { runs, orphans };
 }
 
+// Local calendar day (YYYY-MM-DD). Orb picks are dated by the day they were
+// made; toISOString() is the UTC day, already tomorrow in the evening west of
+// Greenwich.
+function localDay(date) {
+  return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, '0')}-${String(date.getDate()).padStart(2, '0')}`;
+}
+
 function readOrbScorecard(root, { days = DEFAULT_DAYS, now = Date.now() } = {}) {
   const windowDays = Number(days);
   if (!Number.isInteger(windowDays) || windowDays < 1) {
@@ -125,8 +132,8 @@ function readOrbScorecard(root, { days = DEFAULT_DAYS, now = Date.now() } = {})
 
   const scorecard = emptyOrbScorecard(windowDays);
   const cutoffMs = nowMs - (windowDays * DAY_MS);
-  const cutoffDay = new Date(cutoffMs).toISOString().slice(0, 10);
-  const today = new Date(nowMs).toISOString().slice(0, 10);
+  const cutoffDay = localDay(new Date(cutoffMs));
+  const today = localDay(new Date(nowMs));
   scorecard.picks = readOrbPicks(root, cutoffDay, today);
 
   const indexPath = path.join(root, '.atris', 'state', 'orb-runs', 'index.jsonl');

package/lib/yes-lock.js

@@ -674,21 +674,42 @@ const PUSH_HINT = 'a branch push runs without a yes as: git push origin <branch>
 
 // git reads, plus local work that cannot move a ref other than the branch it is on
 const GIT_SEALED_READS = new Set(['status', 'diff', 'log', 'show', 'blame', 'rev-parse', 'ls-files', 'grep', 'describe', 'rev-list', 'merge-base', 'cat-file', 'ls-tree', 'show-ref', 'for-each-ref', 'shortlog', 'check-ignore', 'help', 'version']);
-const GIT_SEALED_LOCAL = new Set(['add', 'rm', 'mv', 'restore']);
+const GIT_SEALED_LOCAL = new Set(['add', 'rm', 'mv', 'restore', 'update-index', 'write-tree']);
 const GIT_SEALED_GLOBALS = new Set(['--no-pager', '-P', '--no-optional-locks', '--literal-pathspecs', '--version', '--help', '-h']);
 // the shape of a branch name git accepts, without the corners that read as something else
 const BRANCH_NAME = /^(?!-)(?!\.)(?!.*\.\.)(?!.*\/\/)(?!.*\/\.)(?!.*@\{)(?!.*\.lock(?:\/|$))[A-Za-z0-9._/-]+(?<![./])$/;
 
-// Only -C and a few output switches go before the command. -c,
-// --config-env, and --exec-path are held: config can name a program git runs
-// (core.fsmonitor, core.pager), and git puts its own folder first on PATH for
-// that program, so a git inside it would skip the wrapper.
+// -c a woken run may pass: a value that only turns something off, or a key
+// that only changes how output looks. The engines harden their own git calls
+// this way (hooks, fsmonitor, askpass, protocols, gc all off). A -c that
+// names a program, path, command, alias, helper, pager, editor, or route is
+// held, since git runs that program with its own folder first on PATH, where
+// a git inside it skips the wrapper; so are the keys whose value is a name,
+// URL, or refspec (alias, remote, url, push, include, credential, branch
+// routing), where even an empty value can reroute (url.<x>.insteadOf=).
+const GIT_DISPLAY_KEYS = new Set(['format.pretty', 'log.showsignature', 'status.showuntrackedfiles', 'core.quotepath', 'core.safecrlf', 'safe.barerepository', 'color.ui']);
+const GIT_ROUTE_KEYS = /^(alias|remote|url|push|include|includeif|credential)\.|^branch\..+\.(remote|pushremote|merge)$/;
+
+function sealedGitConfigOk(pair) {
+  const eq = String(pair).indexOf('=');
+  const key = (eq < 0 ? String(pair) : String(pair).slice(0, eq)).trim().toLowerCase();
+  const value = eq < 0 ? 'true' : String(pair).slice(eq + 1).trim();
+  if (GIT_DISPLAY_KEYS.has(key)) return true;
+  if (key === 'core.hookspath') return value === '/dev/null';
+  if (GIT_ROUTE_KEYS.test(key)) return false;
+  return /^(|false|never|0|no|off)$/i.test(value);
+}
+
+// Only -C, -c that turns something off, and a few output switches go before
+// the command. --config-env and --exec-path are held.
 function sealedGitPrefix(args) {
   const prefix = [];
   for (let i = 0; i < args.length; i += 1) {
     const a = args[i];
-    if (a === '-C') {
-      prefix.push(a, String(args[i + 1] === undefined ? '' : args[i + 1]));
+    if (a === '-C' || a === '-c') {
+      const value = String(args[i + 1] === undefined ? '' : args[i + 1]);
+      if (a === '-c' && !sealedGitConfigOk(value)) return { bad: `-c ${value}` };
+      prefix.push(a, value);
       i += 1;
       continue;
     }
@@ -726,9 +747,11 @@ function sealedGit(args, ctx) {
   if (!p.sub) return pass();
   if (GIT_SEALED_READS.has(p.sub) || GIT_SEALED_LOCAL.has(p.sub)) return pass();
   // the questions below are asked of the repo the command names
-  const repo = ctx.forRepo(p.prefix.filter((a, i, all) => a === '-C' || all[i - 1] === '-C'));
+  const repo = ctx.forRepo(p.prefix.filter((a, i, all) => a === '-C' || a === '-c' || all[i - 1] === '-C' || all[i - 1] === '-c'));
   const rest = p.rest;
   switch (p.sub) {
+    // a new repo has no remote; a template or a git folder elsewhere could bring hooks
+    case 'init': return rest.some(a => /^--(template|separate-git-dir)(=|$)/.test(a)) ? hold('git init with a template or a git folder elsewhere can bring hooks') : pass();
     case 'push': return sealedPush(p, repo);
     case 'fetch': return sealedFetch(rest, repo);
     case 'commit': return isMainRef(repo.currentBranch()) ? hold('a commit here would land on master') : pass();
@@ -764,7 +787,9 @@ function sealedPush(p, repo) {
     words.push(a);
   }
   if (words.length !== 2 || words[0] !== 'origin') return hold(`a handed-off job pushes one branch to origin; ${PUSH_HINT}`);
-  const head = words[1].match(/^HEAD:refs\/heads\/(.+)$/);
+  // HEAD:<branch> is written out as HEAD:refs/heads/<branch>, so a name that
+  // matches a tag on origin can never update the tag
+  const head = words[1].match(/^HEAD:(?:refs\/heads\/(?=.))?(?!refs\/)(.+)$/);
   const branch = head ? head[1] : words[1];
   if (!head && (branch.includes(':') || branch.startsWith('refs/'))) return hold(`git push ${words[1]} names more than a branch; ${PUSH_HINT}`);
   if (isMainRef(branch)) return hold(`git push to master lands on master; ${PUSH_HINT}`);
@@ -964,6 +989,8 @@ const ATRIS_SEALED = {
 function sealedAtris(args, missionId) {
   const [cmd = '', sub = ''] = args;
   if (args.length === 1 && ['--version', '-v', '--help', '-h'].includes(cmd)) return pass();
+  // the boot read: atris prints the welcome screen for its spec file and stops
+  if (args.length === 1 && (cmd === 'atris.md' || cmd.endsWith('/atris.md'))) return pass();
   const allowed = Object.prototype.hasOwnProperty.call(ATRIS_SEALED, cmd) ? ATRIS_SEALED[cmd] : null;
   if (!allowed) return hold(`atris ${cmd} is not on the list a handed-off job may run`);
   const subOk = allowed === true || ['help', '--help', '-h'].includes(sub)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.2",
+  "version": "3.74.4",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",