atris 3.76.0 → 3.78.0

package/lib/runner-command.js

@@ -191,20 +191,23 @@ function shellWord(value) {
   return `'${s.replace(/'/g, "'\\''")}'`;
 }
 
-function firstConfiguredEnv(names) {
+// Every reader below takes the environment it reads from and defaults to this process's. A launch is built in
+// this process, so it reads process.env; a caller that wants to know what a launch would carry (launchFor) hands
+// in the environment the launch would be built in, and nothing here looks at this process then.
+function firstConfiguredEnv(names, env = process.env) {
   for (const name of names) {
-    const value = String(process.env[name] || '').trim();
+    const value = String(env[name] || '').trim();
     if (value) return value;
   }
   return '';
 }
 
-function resolveRunnerProfileName() {
-  return String(process.env.ATRIS_RUNNER_PROFILE || '').trim();
+function resolveRunnerProfileName(env = process.env) {
+  return String(env.ATRIS_RUNNER_PROFILE || '').trim();
 }
 
-function resolveRunnerProfile() {
-  const name = resolveRunnerProfileName();
+function resolveRunnerProfile(env = process.env) {
+  const name = resolveRunnerProfileName(env);
   if (!name) return null;
   const profile = RUNNER_PROFILES[name];
   if (!profile) {
@@ -213,8 +216,8 @@ function resolveRunnerProfile() {
   return profile;
 }
 
-function runnerProfileValue(key) {
-  const profile = resolveRunnerProfile();
+function runnerProfileValue(key, env = process.env) {
+  const profile = resolveRunnerProfile(env);
   return profile && profile[key] ? profile[key] : '';
 }
 
@@ -233,10 +236,10 @@ function isSpendGatedModel(model) {
 
 // `fallback` is the model to run instead. An engine that is not the claude cli
 // cannot take a claude model id, so it passes '' and rides its own default.
-function applySpendGate(model, { silent = false, fallback = SPEND_FALLBACK_MODEL } = {}) {
+function applySpendGate(model, { silent = false, fallback = SPEND_FALLBACK_MODEL, env = process.env } = {}) {
   const value = String(model || '').trim();
   if (!value || !isSpendGatedModel(value)) return value;
-  if (String(process.env.ATRIS_CLAUDE_SPEND_OK || '').trim() === value) return value;
+  if (String(env.ATRIS_CLAUDE_SPEND_OK || '').trim() === value) return value;
   if (!silent && !spendGateWarned.has(`${value}>${fallback}`)) {
     spendGateWarned.add(`${value}>${fallback}`);
     const instead = fallback || "that engine's own default model";
@@ -251,37 +254,37 @@ function resetSpendGateWarnings() {
 
 // Engines that run only their own vendor's models drop any claude model name
 // later, so the gate has nothing to stop there and stays quiet.
-function runnerDropsClaudeModels() {
-  const name = resolveRunnerProfileName();
+function runnerDropsClaudeModels(env = process.env) {
+  const name = resolveRunnerProfileName(env);
   const def = name ? RUNNER_PROFILE_DEFS[RUNNER_PROFILE_ALIASES[name] || name] : null;
   if (def && def.ownModelsOnly) return true;
-  return Boolean(ownModelsOnlyEngineForBin(resolveClaudeRunnerBin()));
+  return Boolean(ownModelsOnlyEngineForBin(resolveClaudeRunnerBin(env)));
 }
 
 // Whether the launch goes through the claude cli, the only engine that can take
 // the cheap claude fallback by name.
-function runnerRidesClaudeCli() {
-  const name = resolveRunnerProfileName();
+function runnerRidesClaudeCli(env = process.env) {
+  const name = resolveRunnerProfileName(env);
   const canonical = name ? (RUNNER_PROFILE_ALIASES[name] || name) : '';
   return !canonical || canonical === 'claude' || canonical === 'fable' || canonical === 'haiku';
 }
 
 // The choke point: every unattended Claude launch (mission, autopilot, run,
 // pulse, fleet) resolves its model here, directly or via buildRunnerCommand.
-function resolveClaudeRunnerModel(mission) {
-  const model = resolveClaudeRunnerModelUngated(mission);
-  if (!isSpendGatedModel(model) || runnerDropsClaudeModels()) return model;
-  return applySpendGate(model, { fallback: runnerRidesClaudeCli() ? SPEND_FALLBACK_MODEL : '' });
+function resolveClaudeRunnerModel(mission, { env = process.env, silent = false } = {}) {
+  const model = resolveClaudeRunnerModelUngated(mission, env);
+  if (!isSpendGatedModel(model) || runnerDropsClaudeModels(env)) return model;
+  return applySpendGate(model, { fallback: runnerRidesClaudeCli(env) ? SPEND_FALLBACK_MODEL : '', env, silent });
 }
 
-function resolveClaudeRunnerModelUngated(mission) {
+function resolveClaudeRunnerModelUngated(mission, env = process.env) {
   const explicit = mission && mission.model != null ? normalizeClaudeModelName(mission.model) : '';
   if (explicit) return explicit;
-  const env = normalizeClaudeModelName(firstConfiguredEnv(['ATRIS_RUNNER_MODEL']));
-  if (env) return env;
-  const profileModel = normalizeClaudeModelName(runnerProfileValue('model'));
+  const fromEnv = normalizeClaudeModelName(firstConfiguredEnv(['ATRIS_RUNNER_MODEL'], env));
+  if (fromEnv) return fromEnv;
+  const profileModel = normalizeClaudeModelName(runnerProfileValue('model', env));
   if (profileModel) return profileModel;
-  const legacyEnv = normalizeClaudeModelName(firstConfiguredEnv(['ATRIS_CLAUDE_MODEL']));
+  const legacyEnv = normalizeClaudeModelName(firstConfiguredEnv(['ATRIS_CLAUDE_MODEL'], env));
   if (legacyEnv) return legacyEnv;
   return DEFAULT_CLAUDE_RUNNER_MODEL;
 }
@@ -290,12 +293,12 @@ function resolveClaudeRunnerModelUngated(mission) {
 // mission model) or the profile's own pin. ATRIS_RUNNER_MODEL is left out on
 // purpose: it usually names a claude model, which devin or grok would reject.
 // '' means nothing is pinned, so the engine's CLI picks its own default.
-function resolvePinnedRunnerModel(mission) {
+function resolvePinnedRunnerModel(mission, { env = process.env, silent = false } = {}) {
   const explicit = mission && mission.model != null ? String(mission.model).trim() : '';
-  const pinned = explicit || runnerProfileValue('model');
+  const pinned = explicit || runnerProfileValue('model', env);
   // Cheap check first: an ungated pin never needs the profile looked up.
-  if (!isSpendGatedModel(pinned) || runnerDropsClaudeModels()) return pinned;
-  return applySpendGate(pinned, { fallback: runnerRidesClaudeCli() ? SPEND_FALLBACK_MODEL : '' });
+  if (!isSpendGatedModel(pinned) || runnerDropsClaudeModels(env)) return pinned;
+  return applySpendGate(pinned, { fallback: runnerRidesClaudeCli(env) ? SPEND_FALLBACK_MODEL : '', env, silent });
 }
 
 // The own-models-only engine a runner bin launches ("codex", "/opt/bin/grok"),
@@ -326,22 +329,22 @@ function runnerModelFor(engineId, model) {
   return isClaudeFamilyModel(value) ? '' : value;
 }
 
-function resolveClaudeRunnerBin() {
-  const env = firstConfiguredEnv(['ATRIS_RUNNER_BIN']);
-  if (env) return env;
-  const profileBin = runnerProfileValue('bin');
+function resolveClaudeRunnerBin(env = process.env) {
+  const fromEnv = firstConfiguredEnv(['ATRIS_RUNNER_BIN'], env);
+  if (fromEnv) return fromEnv;
+  const profileBin = runnerProfileValue('bin', env);
   if (profileBin) return profileBin;
-  const legacyEnv = firstConfiguredEnv(['ATRIS_CLAUDE_BIN']);
+  const legacyEnv = firstConfiguredEnv(['ATRIS_CLAUDE_BIN'], env);
   if (legacyEnv) return legacyEnv;
   return DEFAULT_CLAUDE_RUNNER_BIN;
 }
 
-function resolveClaudeRunnerCommandTemplate() {
-  const env = firstConfiguredEnv(['ATRIS_RUNNER_COMMAND_TEMPLATE']);
-  if (env) return env;
-  const profileTemplate = runnerProfileValue('commandTemplate');
+function resolveClaudeRunnerCommandTemplate(env = process.env) {
+  const fromEnv = firstConfiguredEnv(['ATRIS_RUNNER_COMMAND_TEMPLATE'], env);
+  if (fromEnv) return fromEnv;
+  const profileTemplate = runnerProfileValue('commandTemplate', env);
   if (profileTemplate) return profileTemplate;
-  return firstConfiguredEnv(['ATRIS_CLAUDE_COMMAND_TEMPLATE']);
+  return firstConfiguredEnv(['ATRIS_CLAUDE_COMMAND_TEMPLATE'], env);
 }
 
 function buildRunnerAvailabilityCommand() {
@@ -453,6 +456,42 @@ function buildRunnerCommand({ promptFile, allowedTools, model, effort } = {}) {
   return cmd;
 }
 
+// What the launch of one engine would carry, decided from `env` (this process's by default) and without launching
+// anything or saying anything: { engine, bin, model }, or null for an engine nobody knows. `model` is the pin a
+// caller would hand buildRunnerCommand (a roster pick). The model is the --model of the command buildRunnerCommand
+// builds for this engine under ATRIS_RUNNER_PROFILE=<engine>, the way the fleet builds it: the same precedence,
+// the same spend gate, and a claude model dropped by an engine that cannot take one. '' means the launch carries
+// none. A caller that must judge the launch (the builder picker asks the Claude spend guard about it) asks here
+// and never works the model out for itself.
+//
+// Only the fleet's own launch is read. A command template somebody wrote (ATRIS_RUNNER_COMMAND_TEMPLATE, or the
+// older ATRIS_CLAUDE_COMMAND_TEMPLATE) can start anything with anything: a model in it may be a flag, a word of the
+// prompt, another command's, or one the shell works out only when it runs. It is never read for its model. The
+// answer is { engine, bin, model: '', custom: true }, and a caller that has to judge it counts the model as one it
+// cannot tell. A template that is the engine's own is the fleet's launch like any other.
+function launchFor(engineId, { env = process.env, model } = {}) {
+  const asked = String(engineId || '').trim().toLowerCase();
+  const name = RUNNER_PROFILE_ALIASES[asked] || asked;
+  if (!name || !RUNNER_PROFILE_DEFS[name]) return null;
+  const scoped = { ...env, ATRIS_RUNNER_PROFILE: name };
+  const bin = resolveClaudeRunnerBin(scoped);
+  const template = resolveClaudeRunnerCommandTemplate(scoped);
+  if (template && template !== runnerProfileValue('commandTemplate', scoped)) {
+    return { engine: name, bin, model: '', custom: true };
+  }
+  const mission = { model };
+  const binEngine = ownModelsOnlyEngineForBin(bin);
+  const modelFor = (value) => {
+    const forProfile = runnerModelFor(name, value);
+    return binEngine ? runnerModelFor(binEngine, forProfile) : forProfile;
+  };
+  const hasModelSlot = !template || /\{(?:model|modelFlag)\}/.test(template);
+  const hasPinSlot = Boolean(template) && /\{pinnedModelFlag\}/.test(template);
+  const resolved = hasModelSlot ? resolveClaudeRunnerModel(mission, { env: scoped, silent: true }) : '';
+  const pinned = hasPinSlot ? resolvePinnedRunnerModel(mission, { env: scoped, silent: true }) : '';
+  return { engine: name, bin, model: modelFor(hasModelSlot ? resolved : pinned) };
+}
+
 // Whether the installed codex prints JSONL events and can write its final
 // answer to a file. Asked once per program; an older codex without the flags
 // keeps today's plain launch.
@@ -518,4 +557,5 @@ module.exports = {
   buildRunnerAvailabilityCommand,
   runnerAvailabilityFailureMessage,
   buildRunnerCommand,
+  launchFor,
 };

package/lib/task-db.js

@@ -645,13 +645,34 @@ const NAMED_CLAIM_SQL = `AND (? IS NULL OR EXISTS (
      AND (tasks.claimed_at IS NULL OR e.created_at >= tasks.claimed_at)
      AND e.version = (SELECT MAX(version) FROM task_events WHERE task_id = tasks.id AND event_type = 'claimed')))`;
 
+// The job as it stands when a claim is made: its title and tags, saved on the claim itself. The builder picker
+// (lib/builder-pick.js) gives a play the lane its job was in when the claim was made, and tagging or renaming a
+// finished job later must not change that. Every way of claiming a job writes it (claimTask, and the claim that
+// starting work on an open or unowned job makes); a claim made before this existed has none and is never rebuilt
+// from the job's history.
+function jobAtClaim(row, metadata) {
+  const meta = metadata && typeof metadata === 'object' ? metadata : {};
+  return {
+    title: String(row.title == null ? '' : row.title),
+    tag: row.tag || null,
+    tags: Array.isArray(meta.tags) ? meta.tags : [],
+    todo_tags: Array.isArray(meta.todo_tags) ? meta.todo_tags : [],
+  };
+}
+
 // Atomic claim. Returns { claimed: true, row, event } only if THIS call won the row; event is the claimed event
 // this claim wrote, the one name for it (see latestClaim). Race-safe via single UPDATE with WHERE status='open'
 // guard. SQLite serializes writes; busy_timeout absorbs contention. Caller must check `.claimed`.
 //
 // The row and its claimed event are written in one transaction. Before, the row was claimed first and the event
 // followed a git call later, and in that gap a late release naming the claim before could pass for the new one.
-function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
+//
+// refuseIf is a check the caller makes on the job as it stands when the claim is made: it is asked with the open job
+// (as getTask shows it) inside the same transaction, with the write lock held, so nothing can change the job between
+// the look and the claim. It answers with a reason to refuse, and the job is then not claimed and nothing is written
+// ({ claimed: false, reason }); an empty answer lets the claim go on. A job that is not open is not asked about, and
+// answers as it always did. A check that throws takes the claim with it: nothing is claimed.
+function claimTask(db, { id, claimedBy, leaseMinutes, leasePid, refuseIf = null }) {
   if (!id) throw new Error('id required');
   if (!claimedBy) throw new Error('claimedBy required');
   const now = Date.now();
@@ -672,6 +693,11 @@ function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
   `);
   const lease = leaseMinutes == null ? null : JSON.stringify({ until: new Date(now + leaseMinutes * 60000).toISOString(), minutes: leaseMinutes, holder: claimedBy, pid: leasePid });
   const won = inWriteTransaction(db, () => {
+    if (refuseIf) {
+      const current = getTask(db, id);
+      const why = current && current.status === 'open' ? refuseIf(current) : '';
+      if (why) return { refused: String(why) };
+    }
     const result = withBusyRetry(() => stmt.run(claimedBy, now, now, lease, lease, id));
     if (result.changes !== 1) return null;
     let row = db.prepare('SELECT * FROM tasks WHERE id = ?').get(id);
@@ -693,10 +719,16 @@ function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
       workspaceRoot: row.workspace_root,
       actor: claimedBy,
       eventType: 'claimed',
-      payload: { claimed_by: claimedBy, ...(startCommit ? { start_commit: startCommit } : {}) },
+      payload: {
+        claimed_by: claimedBy,
+        ...(startCommit ? { start_commit: startCommit } : {}),
+        // Written in this transaction, so a claim never exists without it.
+        job_at_claim: jobAtClaim(row, claimedMetadata),
+      },
     });
     return { row, event };
   });
+  if (won && won.refused) return { claimed: false, reason: won.refused };
   if (won) {
     const enriched = { ...won.row, metadata: won.row.metadata ? safeJSON(won.row.metadata) : null };
     // The work log is a note for people, written once the claim is saved. A note that cannot be written must not
@@ -2300,7 +2332,7 @@ function stageTaskSteps(db, {
       workspaceRoot: updated.workspace_root,
       actor: claimedWorker,
       eventType: 'claimed',
-      payload: { claimed_by: claimedWorker },
+      payload: { claimed_by: claimedWorker, job_at_claim: jobAtClaim(updated, updated.metadata) },
     });
   }
   const event = appendTaskEvent(db, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.76.0",
+  "version": "3.78.0",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",