atris 3.74.6 → 3.74.7

package/bin/atris.js

@@ -1967,6 +1967,15 @@ function showWelcomeVisualization() {
     // Silent: the lineup is a hint, not a gate.
   }
 
+  // The four values settle close calls, so every new chat sees them, not
+  // only an agent that reads atris.md to the end (lib/values.js).
+  try {
+    const values = require('../lib/values').valuesForRoot(cwd);
+    values.forEach((value, index) => console.log(row(index ? '' : 'values', `${value.name.padEnd(14)}${value.gist}`)));
+  } catch {
+    // Advisory only; never blocks boot.
+  }
+
   const hasNoTasks = glance.active === 0
     && glance.review === 0
     && glance.reviewCertified === 0;

package/commands/idea.js

@@ -31,6 +31,7 @@ function ideaUsage() {
     '       atris idea retry <n> [--repo <path>] [--verify "<cmd>"]',
     '       atris idea tick [--repo <path>] [--max-minutes <n>]',
     '       atris idea on|off [--repo <path>] [--dry-run]',
+    '       atris idea login|logout   (the Claude login sealed builds use)',
   ].join('\n');
 }
 
@@ -213,6 +214,35 @@ function retryIdea(ref, { repo, verify = '', json, log }) {
   return 0;
 }
 
+// One command for the login a sealed build needs: Claude's own setup-token
+// runs on the person's terminal, the token is picked off the screen (or
+// pasted when it cannot be), proven with a sign-in from a blank home, then
+// saved where only the owner can read it. Nothing is saved when it fails.
+function ideaLogin({ log = console.log, deps = {} } = {}) {
+  const login = { ...require('../lib/engine-login'), ...deps };
+  const tty = deps.isTTY !== undefined ? deps.isTTY : Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!tty) {
+    log('run this in your own terminal: atris idea login');
+    return 2;
+  }
+  log('a browser window opens for Claude. approve it there; there is nothing to copy.');
+  let token = login.findToken(login.recordSetupToken().text);
+  if (!token && login.askToken) token = String(login.askToken() || '').trim();
+  if (!token) {
+    log('no login came back from claude setup-token. nothing saved.');
+    return 1;
+  }
+  const check = login.checkToken(token);
+  if (!check.ok) {
+    log(`that login did not sign in${check.detail ? `: ${check.detail}` : ''}. nothing saved.`);
+    return 1;
+  }
+  login.saveToken(token);
+  log('done. sealed builds now sign in to Claude on your subscription.');
+  log('undo: atris idea logout');
+  return 0;
+}
+
 function ideaAtris(args = process.argv.slice(3), { cwd = process.cwd(), log = console.log, keepDeps = {} } = {}) {
   const list = Array.isArray(args) ? args : [];
   if (argsWantHelp(list)) {
@@ -224,6 +254,12 @@ function ideaAtris(args = process.argv.slice(3), { cwd = process.cwd(), log = co
   const json = flags.json === true;
   const verb = words[0];
 
+  if (verb === 'login' && words.length === 1) return ideaLogin({ log, deps: keepDeps.login });
+  if (verb === 'logout' && words.length === 1) {
+    const { forgetToken } = require('../lib/engine-login');
+    log(forgetToken() ? 'sealed builds no longer have a Claude login.' : 'there was no saved login.');
+    return 0;
+  }
   if (verb === 'retry' && words.length <= 2) return retryIdea(words[1], { repo, verify: flags.verify || '', json, log });
   if ((verb === 'on' || verb === 'off') && words.length === 1) {
     return switchTimer(verb === 'on', { repo, dryRun: flags.dryRun === true, json, log, keepDeps });

package/commands/zen.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { abandonedDaysFromEnv, checkZen, sideCopyLines } = require('../lib/zen');
+const { abandonedDaysFromEnv, checkZen, nextSaveIn, sideCopyLines } = require('../lib/zen');
 const { applyZen } = require('../lib/zen-apply');
 const { workspaceZen } = require('../lib/zen-workspace');
 const { fleetFile, fleetRepos, fleetZen, printFleet } = require('../lib/zen-fleet');
@@ -97,7 +97,9 @@ function printCheck(result, workspace) {
     console.log('  run atris zen to make it zen');
   }
   if (result.worktrees_with_work.length) {
-    for (const text of sideCopyLines(result.worktrees_with_work, abandonedDaysFromEnv())) console.log(`  ${text}`);
+    const days = abandonedDaysFromEnv();
+    const wait = nextSaveIn(result.worktrees_with_work, days);
+    for (const text of sideCopyLines(result.worktrees_with_work, days, wait)) console.log(`  ${text}`);
   }
   const held = result.worktrees_locked?.length || 0;
   if (held) {

package/lib/engine-login.js

@@ -0,0 +1,105 @@
+'use strict';
+
+// The one Claude login a sealed build may use. A sealed build hides the real
+// home, and the normal Claude login lives in the macOS keychain and refreshes
+// itself, so a build cannot borrow it. `atris idea login` runs Claude's own
+// `claude setup-token` (a long-lived login on the same subscription), keeps the
+// token in a file only the owner can read, and the sealed build passes it in.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { atrisHome } = require('./state-home');
+
+const TOKEN_PATTERN = /sk-ant-oat\d{2}-[A-Za-z0-9_-]{20,}/g;
+
+function tokenFile(env = process.env) {
+  return path.join(atrisHome(env), 'secrets', 'claude-oauth-token');
+}
+
+// The token from a recording of `claude setup-token`, colors and cursor moves
+// stripped. The last one wins, since the screen may redraw.
+function findToken(text) {
+  const plain = String(text || '').replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '').replace(/\x1b[\]P][^\x07\x1b]*(\x07|\x1b\\)/g, '');
+  const hits = plain.match(TOKEN_PATTERN);
+  return hits ? hits[hits.length - 1] : '';
+}
+
+function savedToken(env = process.env) {
+  try {
+    return fs.readFileSync(tokenFile(env), 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function saveToken(token, env = process.env) {
+  const file = tokenFile(env);
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.chmodSync(path.dirname(file), 0o700);
+  fs.writeFileSync(file, `${token}\n`, { mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+  return file;
+}
+
+function forgetToken(env = process.env) {
+  const file = tokenFile(env);
+  if (!fs.existsSync(file)) return false;
+  fs.rmSync(file, { force: true });
+  return true;
+}
+
+// Runs `claude setup-token` on the person's own terminal while `script`
+// records what it prints, then reads the recording and deletes it.
+function recordSetupToken({ spawn = spawnSync, platform = process.platform } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-login-'));
+  fs.chmodSync(dir, 0o700);
+  const log = path.join(dir, 'screen');
+  try {
+    const args = platform === 'darwin'
+      ? ['-q', log, 'claude', 'setup-token']
+      : ['-q', '-c', 'claude setup-token', log];
+    const result = spawn('script', args, { stdio: 'inherit' });
+    const text = fs.existsSync(log) ? fs.readFileSync(log, 'utf8') : '';
+    return { status: result.status, text };
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// When the token cannot be read off the screen, the person pastes it once,
+// without it showing on screen.
+function askToken({ spawn = spawnSync } = {}) {
+  const script = 'printf "paste the token claude printed (it stays hidden): " >&2; stty -echo; read -r t; stty echo; printf "\\n" >&2; printf %s "$t"';
+  const result = spawn('sh', ['-c', script], { stdio: ['inherit', 'pipe', 'inherit'], encoding: 'utf8' });
+  return String(result.stdout || '').trim();
+}
+
+// Signs in the way a sealed build does: a blank home, no keychain, only the
+// token. Returns { ok, detail }.
+function checkToken(token, { spawn = spawnSync } = {}) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-login-check-'));
+  try {
+    const result = spawn('claude', ['-p', 'Reply with the single word ok.', '--model', 'haiku',
+      '--settings', JSON.stringify({ disableAllHooks: true }), '--strict-mcp-config', '--tools', ''], {
+      cwd: home,
+      encoding: 'utf8',
+      timeout: 120000,
+      env: {
+        PATH: process.env.PATH || '',
+        HOME: home,
+        CLAUDE_CONFIG_DIR: path.join(home, '.claude'),
+        CLAUDE_CODE_OAUTH_TOKEN: token,
+        ANTHROPIC_API_KEY: '',
+      },
+    });
+    const out = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    const ok = result.status === 0 && /\bok\b/i.test(result.stdout || '');
+    return { ok, detail: ok ? '' : (out.split('\n').pop() || `exit ${result.status}`).slice(0, 200) };
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+module.exports = { findToken, savedToken, saveToken, forgetToken, recordSetupToken, askToken, checkToken };

package/lib/fleet.js

@@ -1907,7 +1907,10 @@ function reviewOnlyEngineEnvironment(worktreePath, options = {}) {
     // owner policy: claude work runs on the subscription login, never API
     // billing, so the api key is stripped even when the parent env has one.
     ANTHROPIC_API_KEY: '',
-    CLAUDE_CODE_OAUTH_TOKEN: selectedSecret(['claude'], 'CLAUDE_CODE_OAUTH_TOKEN'),
+    // `atris idea login` saves this one login for sealed builds; a token
+    // already in the environment wins.
+    CLAUDE_CODE_OAUTH_TOKEN: selectedSecret(['claude'], 'CLAUDE_CODE_OAUTH_TOKEN')
+      || (selectedEngine === 'claude' ? require('./engine-login').savedToken() : ''),
     CURSOR_API_KEY: selectedSecret(['cursor'], 'CURSOR_API_KEY'),
     DEVIN_API_KEY: selectedSecret(['devin'], 'DEVIN_API_KEY'),
     XAI_API_KEY: selectedSecret(['grok'], 'XAI_API_KEY'),

package/lib/idea-tick.js

@@ -186,6 +186,19 @@ function defaultRunLap(text, options) {
   return require('../commands/one-lap').runOneLap(text, options);
 }
 
+// Sealed builds get no keychain, so a Claude build with no saved login fails
+// at its first word. Saying so before the build keeps the idea's attempts.
+function defaultLoginGap(repo) {
+  try {
+    const executor = require('../commands/one-lap').readyExecutor(repo);
+    if (!executor || executor.id !== 'claude') return '';
+    if (process.env.CLAUDE_CODE_OAUTH_TOKEN || require('./engine-login').savedToken()) return '';
+    return 'no Claude login for sealed builds';
+  } catch {
+    return '';
+  }
+}
+
 // Where a stopped lap stopped: its check failed, its check passed but the
 // review did not, or it never got that far.
 function lapStage(lap) {
@@ -248,6 +261,7 @@ async function runIdeaTick({
   lockOptions = {},
   loopRepo = null,
   clock = () => Date.now(),
+  loginGap = runLap === defaultRunLap ? defaultLoginGap : () => '',
 } = {}) {
   const repo = path.resolve(root);
   const lock = acquireTickLock(repo, lockOptions);
@@ -282,6 +296,12 @@ async function runIdeaTick({
       return stop(idea, { stage: 'checks', cause: 'no fast check found', reason: `this repo has no fast check I can find; give one: atris idea retry ${idea.n} --verify "<cmd>"` });
     }
 
+    const gap = loginGap(repo);
+    if (gap) {
+      log(`idea ${idea.n} waits: ${gap}. run: atris idea login`);
+      return { status: 'needs_login', idea_id: idea.id, reason: gap };
+    }
+
     started = iso();
     current = updateIdea(repo, idea.id, { status: 'building', attempts: Number(idea.attempts || 0) + 1, started_at: started }) || idea;
     log(`building idea ${idea.n}: ${oneLine(idea.text, 80)}`);

package/lib/values.js

@@ -0,0 +1,38 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PACKAGE_ROOT = path.join(__dirname, '..');
+
+// The bold-lead bullets under `## values` in atris.md, each as its name and
+// its first sentence, so the boot can show them in every new chat instead of
+// leaving them deep in a long file. A workspace made before the values
+// shipped has no such section; the package copy stands in for it.
+function extractValues(content) {
+  const lines = String(content || '').split(/\r?\n/);
+  const start = lines.findIndex((line) => /^## values\s*$/i.test(line));
+  if (start === -1) return [];
+  const values = [];
+  for (let index = start + 1; index < lines.length && !/^##\s+/.test(lines[index]); index += 1) {
+    const match = lines[index].match(/^- \*\*([^*]+?)\.\*\*\s+([^.]+)\./);
+    if (match) values.push({ name: match[1].toLowerCase(), gist: match[2][0].toLowerCase() + match[2].slice(1) });
+  }
+  return values;
+}
+
+function readValues(root) {
+  for (const file of [path.join(root, 'atris.md'), path.join(root, 'atris', 'atris.md')]) {
+    if (!fs.existsSync(file)) continue;
+    const found = extractValues(fs.readFileSync(file, 'utf8'));
+    if (found.length) return found;
+  }
+  return [];
+}
+
+function valuesForRoot(root = process.cwd()) {
+  const own = readValues(root);
+  return own.length ? own : readValues(PACKAGE_ROOT);
+}
+
+module.exports = { extractValues, valuesForRoot };

package/lib/zen-apply.js

@@ -16,6 +16,7 @@ const {
   checkZen,
   defaultBranch,
   dirtyEntries,
+  folderLinksOnly,
   dirtyFiles,
   FRESH_MINUTES,
   gitOut,
@@ -26,6 +27,7 @@ const {
   mtime,
   idleWithOnlyNotes,
   lastTouched,
+  nextSaveIn,
   sideCopyLines,
   scheduledCopies,
   untrackedFiles,
@@ -151,6 +153,19 @@ function putAwaySideCopies(root, cutoff, staleCutoff, tag, teamState) {
       busy.push(wt.path);
       continue;
     }
+    // A copy whose only changes are links to ignored folders is clean: the
+    // links go, then the copy, and they come back if git will not remove it.
+    const links = status.stdout.trim() ? folderLinksOnly(wt.path, root) : [];
+    if (links.length) {
+      const targets = links.map((rel) => [path.join(wt.path, rel), fs.readlinkSync(path.join(wt.path, rel))]);
+      for (const [at] of targets) fs.unlinkSync(at);
+      if (runGit(['worktree', 'remove', wt.path], root).status === 0) removed += 1;
+      else {
+        for (const [at, to] of targets) fs.symlinkSync(to, at);
+        busy.push(wt.path);
+      }
+      continue;
+    }
     if (status.stdout.trim()) {
       // Unsaved work nobody has touched in days goes to a branch, then away.
       // So does an idle copy holding only team notes: nothing in it is work.
@@ -529,7 +544,7 @@ function applyZen({ cwd = process.cwd(), fetch = true, freshMinutes, abandonedDa
     done.push(`saved ${plural(copies.kept.length, 'side copy', 'side copies')} untouched for ${plural(staleDays, 'day', 'days')} to zen-backup/ and put ${copies.kept.length === 1 ? 'it' : 'them'} away`);
     saved.push(...copies.kept.map((b) => `refs/heads/${b}`));
   }
-  if (copies.busy.length) left.push(...sideCopyLines(copies.busy, staleDays));
+  if (copies.busy.length) left.push(...sideCopyLines(copies.busy, staleDays, nextSaveIn(copies.busy, staleDays, now.getTime())));
   if (copies.scheduled) left.push(`${plural(copies.scheduled, 'side copy is', 'side copies are')} used by a scheduled job, so ${copies.scheduled === 1 ? 'it stays' : 'they stay'}`);
   if (copies.locked) left.push(`${plural(copies.locked, 'side copy is', 'side copies are')} locked by ${copies.locked === 1 ? 'its owner, so it stays' : 'their owners, so they stay'}`);
   if (copies.inUse) left.push(`${plural(copies.inUse, 'side copy was', 'side copies were')} used in ${window}`);

package/lib/zen.js

@@ -231,6 +231,27 @@ function lastTouched(checkout) {
   return newest;
 }
 
+// Links a side copy holds where the repo ignores a folder, like node_modules
+// pointing at another checkout's packages. A link holds no work, but git only
+// matches `node_modules/` against a real folder, so it reads as unsaved. The
+// rule is asked of the main checkout, where that path is not a link. Empty
+// when anything else in the copy changed.
+function folderLinksOnly(checkout, root) {
+  const entries = dirtyEntries(checkout);
+  const links = [];
+  for (const entry of entries) {
+    if (entry.xy !== '??') return [];
+    const rel = entry.path.replace(/\/+$/, '');
+    let link = false;
+    try {
+      link = fs.lstatSync(path.join(checkout, rel)).isSymbolicLink();
+    } catch {}
+    if (!link || runGit(['check-ignore', '-q', `${rel}/`], root).status !== 0) return [];
+    links.push(rel);
+  }
+  return links;
+}
+
 // A side copy whose only changes are team notes, untouched and not switched
 // or committed in the fresh window, holds nothing anyone is working on. Live
 // data files never count as notes, so a copy holding one is left alone.
@@ -278,14 +299,37 @@ function lastEntryTime(log) {
   }
 }
 
-// True when a checkout switched or made a commit after the cutoff.
-function headMovedSince(checkout, cutoff) {
+// When a checkout last switched or made a commit.
+function headTime(checkout) {
   const gitDir = gitOut(['rev-parse', '--git-dir'], checkout);
-  if (!gitDir) return false;
+  if (!gitDir) return 0;
   const dir = path.resolve(checkout, gitDir);
   const logged = lastEntryTime(path.join(dir, 'logs', 'HEAD'));
-  if (logged !== null) return logged > cutoff;
-  return Math.max(mtime(path.join(dir, 'logs', 'HEAD')), mtime(path.join(dir, 'HEAD'))) > cutoff;
+  if (logged !== null) return logged;
+  return Math.max(mtime(path.join(dir, 'logs', 'HEAD')), mtime(path.join(dir, 'HEAD')));
+}
+
+// True when a checkout switched or made a commit after the cutoff.
+function headMovedSince(checkout, cutoff) {
+  return headTime(checkout) > cutoff;
+}
+
+// How long until the first of these side copies has sat untouched long
+// enough for zen to save it, or null when none is waiting on the clock.
+function nextSaveIn(paths, days, now = Date.now()) {
+  let soonest = null;
+  for (const p of paths) {
+    const wait = Math.max(headTime(p), lastTouched(p)) + days * 86400000 - now;
+    if (wait > 0 && (soonest === null || wait < soonest)) soonest = wait;
+  }
+  return soonest;
+}
+
+function waitText(ms) {
+  const hours = Math.ceil(ms / 3600000);
+  if (hours < 24) return `${hours} ${hours === 1 ? 'hour' : 'hours'}`;
+  const days = Math.round(hours / 24);
+  return `${days} ${days === 1 ? 'day' : 'days'}`;
 }
 
 // True when a branch was made or moved after the cutoff. A running job makes
@@ -381,7 +425,7 @@ function checkZen({ cwd = process.cwd(), fetch = true, freshMinutes = freshMinut
     }
     const status = runGit(['status', '--porcelain'], wt.path);
     if (status.status !== 0) busy.push(wt);
-    else if (status.stdout.trim()) (idleWithOnlyNotes(wt.path, teamState, cutoff) ? notesOnly : busy).push(wt);
+    else if (status.stdout.trim() && !folderLinksOnly(wt.path, root).length) (idleWithOnlyNotes(wt.path, teamState, cutoff) ? notesOnly : busy).push(wt);
     else if (headMovedSince(wt.path, cutoff)) inUse.push(wt);
     else idle.push(wt);
   }
@@ -439,27 +483,44 @@ function checkZen({ cwd = process.cwd(), fetch = true, freshMinutes = freshMinut
   };
 }
 
-// Where the side copies are, so a line about them can be acted on: home
-// shortened to ~, at most three named.
-// Side copies left with unsaved work: one place per line so a long path
-// still fits a narrow pane, then when zen will take them over.
-function sideCopyLines(paths, days) {
+// A place a person can paste: home as ~, and the system temp folder (git
+// may report it through /private) as $TMPDIR when that variable is set, so a
+// test leftover there fits a narrow pane.
+function shortPlace(p) {
   const home = os.homedir();
+  const tmp = (process.env.TMPDIR || '').replace(/\/+$/, '');
+  if (tmp) {
+    let real = tmp;
+    try {
+      real = fs.realpathSync(tmp);
+    } catch {}
+    for (const dir of new Set([tmp, real])) {
+      if (p === dir || p.startsWith(dir + path.sep)) return `$TMPDIR${p.slice(dir.length)}`;
+    }
+  }
+  return p === home || p.startsWith(home + path.sep) ? `~${p.slice(home.length)}` : p;
+}
+
+// Side copies left with unsaved work: at most three named, one place per
+// line so a long path still fits a narrow pane, then when zen will take
+// them over and, when known, how long until the first one goes.
+function sideCopyLines(paths, days, waitMs = null) {
   const n = paths.length;
   const lines = [`${n} side ${n === 1 ? 'copy has' : 'copies have'} unsaved work, left for ${n === 1 ? 'its owner' : 'their owners'}`];
-  for (const p of paths.slice(0, 3)) {
-    lines.push(`  ${p === home || p.startsWith(home + path.sep) ? `~${p.slice(home.length)}` : p}`);
-  }
+  for (const p of paths.slice(0, 3)) lines.push(`  ${shortPlace(p)}`);
   if (n > 3) lines.push(`  and ${n - 3} more`);
   lines.push(`zen saves ${n === 1 ? 'it' : 'each one'} to zen-backup/ once nobody has touched it for ${days} ${days === 1 ? 'day' : 'days'}`);
+  if (waitMs > 0) lines.push(`${n === 1 ? 'that is' : 'the first one is'} due in ${waitText(waitMs)}`);
   return lines;
 }
 
 module.exports = {
   ABANDONED_DAYS,
   branchMovedSince,
+  folderLinksOnly,
   idleWithOnlyNotes,
   lastTouched,
+  nextSaveIn,
   untrackedFiles,
   abandonedDaysFromEnv,
   sideCopyLines,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.6",
+  "version": "3.74.7",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",