atris 3.74.21 → 3.74.23

package/lib/claude-spend-guard.js

@@ -0,0 +1,288 @@
+'use strict';
+
+// Claude spend guard. On 2026-10-28 unattended jobs ran Opus and Fable models
+// in loops and billed about $900 of paid Claude usage in one day.
+//
+// The rule, enforced in two places:
+// 1. Our own launchers call checkClaudeSpend() before starting `claude`, and
+//    hand it claudeChildEnv() so the pay-per-use key never reaches it.
+// 2. `atris spend guard install` adds a Claude Code hook on this computer that
+//    applies the same rule to every unattended `claude` run, whatever script
+//    started it.
+//
+// Haiku runs freely. Any other Claude model in an unattended run needs the
+// owner's yes for that run: ATRIS_CLAUDE_SPEND_OK=<model>[,<model>].
+// A person typing in an interactive Claude session is never blocked.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const APPROVAL_ENV = 'ATRIS_CLAUDE_SPEND_OK';
+const KEY_OK_ENV = 'ATRIS_CLAUDE_KEY_OK';
+// Either of these moves a `claude` run from the plan login to metered billing.
+const PAID_KEY_VARS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+const HOOK_MARK = 'claude-spend-guard';
+
+function home(env = process.env) {
+  return env.HOME || os.homedir();
+}
+
+function ledgerPath(env = process.env) {
+  return path.join(home(env), '.atris', 'spend', 'claude-guard.jsonl');
+}
+
+function isFreeModel(model) {
+  return /haiku/i.test(String(model || ''));
+}
+
+function approvedModels(env = process.env) {
+  return String(env[APPROVAL_ENV] || '')
+    .split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+
+function hasPaidKey(env = process.env) {
+  return PAID_KEY_VARS.some((name) => Boolean(env[name]));
+}
+
+// The model a `claude` run will use when no --model flag is given: the
+// ANTHROPIC_MODEL env var, then the user's settings, then the account default,
+// which on Max is Opus.
+function defaultClaudeModel(env = process.env) {
+  if (env.ANTHROPIC_MODEL) return env.ANTHROPIC_MODEL;
+  try {
+    const settings = JSON.parse(fs.readFileSync(path.join(home(env), '.claude', 'settings.json'), 'utf8'));
+    if (settings && typeof settings.model === 'string' && settings.model) return settings.model;
+  } catch {}
+  return 'default';
+}
+
+// `--model haiku` can be remapped by ANTHROPIC_DEFAULT_HAIKU_MODEL; judge the
+// model that actually runs.
+function resolveAlias(model, env = process.env) {
+  const alias = String(model).toLowerCase().replace(/\[1m\]$/, '');
+  const mapped = { opus: 'ANTHROPIC_DEFAULT_OPUS_MODEL', sonnet: 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    haiku: 'ANTHROPIC_DEFAULT_HAIKU_MODEL' }[alias];
+  return (mapped && env[mapped]) || model;
+}
+
+function record(entry, env = process.env) {
+  try {
+    const file = ledgerPath(env);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify({ ts: new Date().toISOString(), host: os.hostname(), ...entry }) + '\n');
+  } catch {}
+}
+
+function blockMessage(model, job) {
+  const who = job ? `${job}: ` : '';
+  return `${who}${model} is a paid Claude model and this run is unattended. Haiku runs free. `
+    + `Get the owner's yes with a dollar estimate, then rerun with ${APPROVAL_ENV}=${model}.`;
+}
+
+// Decide whether an unattended Claude run may start.
+// Returns { ok, reason, message }. Never throws.
+function checkClaudeSpend({ model, job = '', env = process.env, checkKey = false, log = true } = {}) {
+  const resolved = resolveAlias(String(model || '').trim() || defaultClaudeModel(env), env);
+  if (checkKey && hasPaidKey(env) && env[KEY_OK_ENV] !== '1') {
+    const message = `${job ? `${job}: ` : ''}this unattended Claude run carries a pay-per-use key `
+      + `(${PAID_KEY_VARS.join(' or ')}). Unset it so the run uses the plan login.`;
+    if (log) record({ decision: 'blocked', reason: 'paid_key', model: resolved, job, cwd: process.cwd() }, env);
+    return { ok: false, reason: 'paid_key', model: resolved, message };
+  }
+  if (isFreeModel(resolved)) return { ok: true, reason: 'free_model', model: resolved };
+  if (approvedModels(env).includes(resolved.toLowerCase())) {
+    if (log) record({ decision: 'approved', model: resolved, job, cwd: process.cwd() }, env);
+    return { ok: true, reason: 'approved', model: resolved };
+  }
+  if (log) record({ decision: 'blocked', reason: 'paid_model', model: resolved, job, cwd: process.cwd() }, env);
+  return { ok: false, reason: 'paid_model', model: resolved, message: blockMessage(resolved, job) };
+}
+
+// A copy of env safe to hand a `claude` child: no pay-per-use key, so the run
+// bills the plan login. ATRIS_CLAUDE_KEY_OK=1 keeps the key (servers only).
+function claudeChildEnv(env = process.env) {
+  const out = { ...env };
+  if (out[KEY_OK_ENV] === '1') return out;
+  for (const name of PAID_KEY_VARS) delete out[name];
+  return out;
+}
+
+// ---- Claude Code hook --------------------------------------------------
+
+function processArgs(pid) {
+  try {
+    if (process.platform === 'linux') {
+      return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    }
+    const line = execFileSync('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8', timeout: 3000 }).trim();
+    return line ? line.split(/\s+/) : [];
+  } catch {
+    return [];
+  }
+}
+
+function parentPid(pid) {
+  try {
+    const out = execFileSync('ps', ['-o', 'ppid=', '-p', String(pid)], { encoding: 'utf8', timeout: 3000 }).trim();
+    const n = Number(out);
+    return Number.isInteger(n) && n > 1 ? n : 0;
+  } catch {
+    return 0;
+  }
+}
+
+function isClaudeArgv(argv) {
+  if (!argv.length) return false;
+  if (path.basename(argv[0]) === 'claude') return true;
+  return argv.slice(0, 3).some((a) => /claude-code|[\\/]claude$/.test(a));
+}
+
+// The argv of the `claude` process that ran this hook. Hooks run as direct
+// children of claude; walk a few levels up in case a shell sits between.
+function claudeArgv(startPid = process.ppid) {
+  let pid = startPid;
+  for (let i = 0; i < 4 && pid; i += 1) {
+    const argv = processArgs(pid);
+    if (isClaudeArgv(argv)) return argv;
+    pid = parentPid(pid);
+  }
+  return null;
+}
+
+function modelFromArgv(argv) {
+  let model = '';
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--model' && argv[i + 1]) model = argv[i + 1];
+    else if (argv[i].startsWith('--model=')) model = argv[i].slice('--model='.length);
+  }
+  return model;
+}
+
+// Unattended means print mode or an SDK run. A person's interactive session
+// reports CLAUDE_CODE_ENTRYPOINT=cli and has no -p flag.
+function isUnattended(argv, env = process.env) {
+  if (String(env.CLAUDE_CODE_ENTRYPOINT || '').startsWith('sdk')) return true;
+  return argv.includes('-p') || argv.includes('--print');
+}
+
+// Decide for the hook. Returns { block, message }.
+function hookDecision({ argv, env = process.env }) {
+  if (!argv || !isUnattended(argv, env)) return { block: false };
+  const verdict = checkClaudeSpend({ model: modelFromArgv(argv), job: 'claude spend guard', env, checkKey: true });
+  return verdict.ok ? { block: false } : { block: true, message: verdict.message };
+}
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+// Entry point for the UserPromptSubmit hook. Exit 2 stops the run before any
+// model call; anything unexpected fails open so a guard bug never breaks work.
+function hookMain() {
+  let event = {};
+  try { event = JSON.parse(readStdin() || '{}'); } catch {}
+  if (event.hook_event_name && event.hook_event_name !== 'UserPromptSubmit') return 0;
+  const decision = hookDecision({ argv: claudeArgv() });
+  if (!decision.block) return 0;
+  try { fs.writeSync(2, `${decision.message}\n`); } catch {}
+  return 2;
+}
+
+// ---- install into ~/.claude/settings.json ------------------------------
+
+function settingsPath(env = process.env) {
+  return path.join(home(env), '.claude', 'settings.json');
+}
+
+function hookScriptPath(env = process.env) {
+  return path.join(home(env), '.claude', 'hooks', `${HOOK_MARK}.js`);
+}
+
+function nodeBinary() {
+  for (const candidate of ['/opt/homebrew/bin/node', '/usr/local/bin/node', '/usr/bin/node']) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return process.execPath;
+}
+
+function readSettings(file) {
+  if (!fs.existsSync(file)) return {};
+  const text = fs.readFileSync(file, 'utf8');
+  if (!text.trim()) return {};
+  return JSON.parse(text);
+}
+
+function guardEntries(settings) {
+  const groups = (settings.hooks && settings.hooks.UserPromptSubmit) || [];
+  return groups.filter((g) => (g.hooks || []).some((h) => String(h.command || '').includes(HOOK_MARK)));
+}
+
+function guardStatus(env = process.env) {
+  let settings = {};
+  let readable = true;
+  try { settings = readSettings(settingsPath(env)); } catch { readable = false; }
+  return {
+    installed: readable && guardEntries(settings).length > 0 && fs.existsSync(hookScriptPath(env)),
+    settings: settingsPath(env),
+    script: hookScriptPath(env),
+    readable,
+  };
+}
+
+function installGuard({ env = process.env, modulePath = __filename } = {}) {
+  const file = settingsPath(env);
+  const settings = readSettings(file); // throws on unparseable settings: never clobber them
+  // The hook is a copy of this file, so it keeps working if the CLI moves.
+  // Rerun install after a CLI update to pick up guard fixes.
+  const script = hookScriptPath(env);
+  fs.mkdirSync(path.dirname(script), { recursive: true });
+  fs.copyFileSync(modulePath, script);
+  fs.chmodSync(script, 0o755);
+  settings.hooks = settings.hooks || {};
+  const groups = settings.hooks.UserPromptSubmit || [];
+  const kept = groups.filter((g) => !guardEntries({ hooks: { UserPromptSubmit: [g] } }).length);
+  // First in line, so it runs before any hook that might spend.
+  settings.hooks.UserPromptSubmit = [
+    { hooks: [{ type: 'command', command: `${nodeBinary()} ${script}` }] },
+    ...kept,
+  ];
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.atris-tmp-${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
+  fs.renameSync(tmp, file);
+  return guardStatus(env);
+}
+
+function uninstallGuard({ env = process.env } = {}) {
+  const file = settingsPath(env);
+  const settings = readSettings(file);
+  if (settings.hooks && settings.hooks.UserPromptSubmit) {
+    const kept = settings.hooks.UserPromptSubmit.filter((g) => !guardEntries({ hooks: { UserPromptSubmit: [g] } }).length);
+    if (kept.length) settings.hooks.UserPromptSubmit = kept;
+    else delete settings.hooks.UserPromptSubmit;
+    const tmp = `${file}.atris-tmp-${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
+    fs.renameSync(tmp, file);
+  }
+  try { fs.unlinkSync(hookScriptPath(env)); } catch {}
+  return guardStatus(env);
+}
+
+module.exports = {
+  APPROVAL_ENV,
+  checkClaudeSpend,
+  claudeChildEnv,
+  hookDecision,
+  guardStatus,
+  installGuard,
+  uninstallGuard,
+  ledgerPath,
+};
+
+if (require.main === module) process.exit(hookMain());

package/lib/engine-ask.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { spawn, spawnSync } = require('child_process');
 const {
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
   RUNNER_PROFILE_DEFS,
 } = require('./runner-command');
 const {
@@ -252,7 +253,9 @@ function resolveAskModel(engine, modelName = '') {
       : currentClaudeModel(requested);
   }
   if (engine !== 'claude' && engine !== 'fable' && engine !== 'haiku') return '';
-  return RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+  // No model named: this is the unattended default, so it goes through the
+  // spend gate. A model a person typed is their own yes.
+  return applySpendGate(RUNNER_PROFILE_DEFS[engine]?.model || DEFAULT_CLAUDE_RUNNER_MODEL);
 }
 
 // The effort flag as argv, from the same profile table the runners use
@@ -289,7 +292,7 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '', {
       bin: profile.bin,
       args: [
         '-p', request,
-        '--model', model || profile.model || DEFAULT_CLAUDE_RUNNER_MODEL,
+        '--model', model || applySpendGate(profile.model || DEFAULT_CLAUDE_RUNNER_MODEL),
         ...effortArgs,
         '--tools', 'Read,Glob,Grep,WebSearch,WebFetch',
         '--permission-mode', 'plan',

package/lib/engine-validate.js

@@ -6,6 +6,7 @@ const os = require('node:os');
 const path = require('node:path');
 const {
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
   RUNNER_PROFILE_DEFS,
 } = require('./runner-command');
 const { canonicalEngineName } = require('./engine-registry');
@@ -78,7 +79,7 @@ function refereeModel(engine) {
   const profile = RUNNER_PROFILE_DEFS[engine];
   if (!profile) return '';
   if (engine === 'claude' || engine === 'fable' || engine === 'haiku') {
-    return profile.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+    return applySpendGate(profile.model || DEFAULT_CLAUDE_RUNNER_MODEL);
   }
   return profile.model || '';
 }

package/lib/known-commands.js

@@ -4,7 +4,7 @@ const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'work
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
                        'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'campaign', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout', 'zen',
-                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
+                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'spend', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi', 'pay', 'trust'];
 
 // Damerau-Levenshtein edit distance between two short strings. Counts an

package/lib/member-save-work.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { TRAILER } = require('../commands/sign');
 
 // A member that passed its check but never committed leaves its work loose in
 // a side checkout that cleanup later deletes (member lab 2026-10-24: navigator
@@ -45,7 +46,7 @@ function saveLeftoverMemberWork({ worktreePath, member = 'member', objective = '
   const staged = stagedAll.filter((file) => !SECRET_PATH.test(file));
   if (!staged.length) return { saved: false, reason: 'nothing_left', ...(skipped.length ? { skipped } : {}) };
   const title = String(objective || '').split('\n').map((line) => line.trim()).find(Boolean) || 'finished work';
-  const message = `${member}: ${title.slice(0, 72)}\n\nSaved by atris after the check passed; the member left these changes uncommitted.`;
+  const message = `${member}: ${title.slice(0, 72)}\n\nSaved by atris after the check passed; the member left these changes uncommitted.\n\n${TRAILER}`;
   const commit = git(['commit', '-q', '-m', message], worktreePath);
   if (!commit.ok) return { saved: false, reason: 'commit_failed', files: staged };
   return { saved: true, files: staged, ...(skipped.length ? { skipped } : {}), sha: git(['rev-parse', 'HEAD'], worktreePath).stdout };

package/lib/roster-models.js

@@ -13,6 +13,7 @@ const {
   RUNNER_PROFILE_DEFS,
   RUNNER_PROFILE_ALIASES,
   DEFAULT_CLAUDE_RUNNER_MODEL,
+  applySpendGate,
 } = require('./runner-command');
 
 const CLAUDE_FAMILY = Object.freeze(['claude', 'fable', 'haiku']);
@@ -77,7 +78,8 @@ function engineRunsView(engineId, { model = '', effort = '' } = {}, options = {}
       view.model_source = 'codex settings';
     }
   } else if (CLAUDE_FAMILY.includes(id)) {
-    view.model = String(process.env.ATRIS_RUNNER_MODEL || '').trim() || def.model || DEFAULT_CLAUDE_RUNNER_MODEL;
+    // Shown as it really runs: the spend gate may have dropped it to the cheap model.
+    view.model = applySpendGate(String(process.env.ATRIS_RUNNER_MODEL || '').trim() || def.model || DEFAULT_CLAUDE_RUNNER_MODEL, { silent: true });
     view.model_source = 'atris default';
   } else if (ATRIS_PINNED.includes(id) && def.model) {
     view.model = def.model;

package/lib/roster-runs.js

@@ -21,7 +21,7 @@ const RUNS_FILE = path.join('.atris', 'state', 'roster_runs.jsonl');
 const ROTATED_NAME = /^roster_runs\.\d.*\.jsonl$/;
 const ROTATED_KEEP = 3;
 const ROTATED_READ = 2;
-const OUTCOMES = Object.freeze(['landed', 'failed', 'stalled', 'credit out']);
+const OUTCOMES = Object.freeze(['landed', 'failed', 'stalled', 'credit out', 'review unavailable']);
 const DEFAULT_DAYS = 7;
 const TAIL_BYTES = 512 * 1024;
 // Past this size the log is renamed aside before the append, never trimmed:
@@ -131,6 +131,7 @@ function runReason(run) {
   if (given) return given.slice(0, 240);
   if (run.outcome === 'stalled') return 'it did not finish in time';
   if (run.outcome === 'credit out') return 'the engine hit its usage limit';
+  if (run.outcome === 'review unavailable') return 'the second review was unavailable';
   return 'it failed and the tool gave no reason';
 }
 
@@ -340,12 +341,15 @@ function summarizeRuns(runs, { days = DEFAULT_DAYS } = {}) {
     handed_over: list.filter((run) => run.handed_over_to).length,
     median_seconds: median(list.map((run) => Number(run.seconds)).filter((value) => value >= 0)),
   };
+  const reviewUnavailable = count('review unavailable');
+  if (reviewUnavailable) summary.review_unavailable = reviewUnavailable;
   const tokens = list.map((run) => run.tokens).filter((value) => Number.isFinite(value));
   if (tokens.length) summary.tokens = tokens.reduce((sum, value) => sum + value, 0);
   const parts = [`${summary.runs} run${summary.runs === 1 ? '' : 's'}`];
   if (summary.landed) parts.push(`${summary.landed} landed`);
   if (summary.stalled) parts.push(`${summary.stalled} stalled`);
   if (summary.failed) parts.push(`${summary.failed} failed`);
+  if (summary.review_unavailable) parts.push(`${summary.review_unavailable} review unavailable`);
   if (summary.credit_out) parts.push(`${summary.credit_out} credit out`);
   if (summary.median_seconds !== null) parts.push(`median ${durationText(summary.median_seconds)}`);
   summary.text = `last ${days} day${days === 1 ? '' : 's'}: ${parts.join(', ')}`;

package/lib/roster-suggest.js

@@ -26,7 +26,7 @@ const BOOT_TAIL_BYTES = 64 * 1024;
 // engine health already benches it, so credit out runs are left out.
 function judgedRuns(runs) {
   return runs
-    .filter((run) => run.outcome !== 'credit out')
+    .filter((run) => run.outcome !== 'credit out' && run.outcome !== 'review unavailable')
     .map((run, index) => ({ run, index }))
     .sort((a, b) => (Date.parse(b.run.at) - Date.parse(a.run.at)) || (b.index - a.index))
     .slice(0, SUGGEST_WINDOW_RUNS)

package/lib/roster-swap.js

@@ -261,7 +261,7 @@ function swapMember(root, memberName, engineWords, modelWords, options = {}) {
 // model this machine offers that can do the member's work, grouped by tool.
 // A model's last 7 days in the owner's words: the phone's swap card shows it
 // under the model, so it says finished, never the team's own word for it.
-const recordWords = seen => `${seen.landed} of ${seen.runs} finished this week`;
+const recordWords = seen => `${seen.landed} of ${seen.runs - (seen.review_unavailable || 0)} finished this week${seen.review_unavailable ? `, ${seen.review_unavailable} awaiting review` : ''}`;
 
 // The current model is on top; models with a record in the last 7 days come
 // next, most landed first; the rest keep --available's order.

package/lib/router-brain.js

@@ -219,7 +219,7 @@ function readRosterRunObservations(root, now) {
   if (!fs.existsSync(file) && !rotatedRunsPaths(root).length) return [];
   const source = path.relative(root, file);
   return readRosterRuns(root, { days: ROSTER_RUN_DAYS, ...(now !== undefined ? { now } : {}) }).flatMap((run) => {
-    if (run.outcome === 'credit out') return [];
+    if (run.outcome === 'credit out' || run.outcome === 'review unavailable') return [];
     const words = String(run.job || '').trim().toLowerCase().split(/\s+/);
     const role = ROSTER_JOB_ROLES[words[words.length - 1]];
     const atMs = Date.parse(run.at);