atris 3.80.0 → 3.82.1

package/commands/auth.js

@@ -737,7 +737,7 @@ async function loginAtris(options = {}) {
 
       openBrowser(loginUrl);
 
-      const code = await promptUser('CLI code: ');
+      const code = await promptUser('CLI code: ', { secret: true });
       if (!code) {
         console.error('Error: Code is required.');
         process.exit(1);
@@ -774,7 +774,7 @@ async function loginAtris(options = {}) {
     } else if (methodChoice === '2') {
       console.log('\nGet your token from: https://atris.ai/auth/cli\n');
 
-      const tokenInput = await promptUser('API token: ');
+      const tokenInput = await promptUser('API token: ', { secret: true });
 
       if (!tokenInput) {
         console.error('Error: Token is required.');

package/commands/autoland.js

@@ -9,7 +9,8 @@ const { localDay } = require('../lib/local-day');
 const autoland = require('../lib/autoland');
 const { gateForHuman, plainLandingReason } = require('../lib/voice-gate');
 const { evaluateAutoAccept } = require('../lib/auto-accept-certified');
-const { sweepEngineAskReceipts } = require('../lib/engine-receipt-sweep');
+const { sweepEngineAskReceipts, sweepFleetReceipts } = require('../lib/engine-receipt-sweep');
+const { acquireFileLock } = require('../lib/file-lock');
 const { readSshAgents, findLeakedSshAgents, findAgentStartLines, agentStartLineText, stopLeakedSshAgents, closeLostRuns, readResourceHistory, errorReason, leakGrowthNote } = require('../lib/engine-resource');
 const { validateRecentAskReceipts } = require('../lib/engine-validate');
 const { operatorReady, hasAgentJargon, explainResult } = autoland;
@@ -731,15 +732,6 @@ function runDigest(root, args, { forceSend = false } = {}) {
   return 0;
 }
 
-function pidAlive(pid) {
-  try {
-    process.kill(Number(pid), 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 async function runTick(root, args) {
   const json = args.includes('--json');
   const policy = autoland.readPolicy(root);
@@ -756,24 +748,23 @@ async function runTick(root, args) {
   // double-alarms, and double-digests. A stale lock (dead pid or >55min)
   // never wedges the loop.
   const lockPath = path.join(root, '.atris', 'state', 'autoland.tick.lock');
+  let lock;
   try {
-    const prev = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
-    const fresh = Date.now() - Number(prev.at || 0) < 55 * 60 * 1000;
-    if (fresh && pidAlive(prev.pid)) {
-      receipt.skipped_reason = 'tick_already_running';
-      if (json) console.log(JSON.stringify(receipt));
-      else console.log('autoland tick: another tick is still running; skipped.');
-      return 0;
-    }
-  } catch {}
-  try {
-    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
-    fs.writeFileSync(lockPath, JSON.stringify({ pid: process.pid, at: Date.now() }));
-  } catch {}
+    lock = acquireFileLock(lockPath, { staleAfterMs: 55 * 60 * 1000 });
+  } catch {
+    lock = null;
+  }
+  if (lock && !lock.ok) {
+    receipt.skipped_reason = 'tick_already_running';
+    if (json) console.log(JSON.stringify(receipt));
+    else console.log('autoland tick: another tick is still running; skipped.');
+    return 0;
+  }
   try {
     return await runTickBody(root, { json, policy, receipt });
   } finally {
-    try { fs.unlinkSync(lockPath); } catch {}
+    // Only removes the lock while it is still this tick's.
+    if (lock) lock.release();
   }
 }
 
@@ -864,8 +855,10 @@ function digestTickStatus(receipt) {
 
 function engineReceiptSweepNote(receipt) {
   const finalized = Number(receipt.engine_receipt_sweep?.finalized) || 0;
-  if (!finalized) return '';
-  return `, finalized ${finalized} stale engine receipt${finalized === 1 ? '' : 's'} as presumed dead`;
+  const flights = Number(receipt.fleet_receipt_sweep?.finalized) || 0;
+  const engineNote = finalized ? `, finalized ${finalized} stale engine receipt${finalized === 1 ? '' : 's'} as presumed dead` : '';
+  const fleetNote = flights ? `, marked ${flights} crashed flight${flights === 1 ? '' : 's'} presumed dead` : '';
+  return engineNote + fleetNote;
 }
 
 // Read only: how many ssh-agents look leaked right now, and which readers
@@ -1041,6 +1034,12 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
   } catch (err) {
     receipt.engine_receipt_sweep_error = String((err && err.message) || err).slice(0, 200);
   }
+  try {
+    const fleetSweep = sweepFleetReceipts(root);
+    if (fleetSweep.scanned > 0) receipt.fleet_receipt_sweep = fleetSweep;
+  } catch (err) {
+    receipt.fleet_receipt_sweep_error = String((err && err.message) || err).slice(0, 200);
+  }
 
   runSshAgentSweep(root, receipt);
   runLostRunSweep(root, receipt);

package/commands/autopilot-front.js

@@ -12,6 +12,7 @@ const { wantsJson, hasYesFlag } = require('../lib/noninteractive');
 const { isUnboundScratchFolder, refuseUnboundScratch } = require('../lib/scratch-root');
 const { resolveWorkspaceRoot } = require('../lib/mission-root');
 const { personName } = require('../lib/first-minute');
+const { acquireFileLock } = require('../lib/file-lock');
 
 const CLI_PATH = path.join(__dirname, '..', 'bin', 'atris.js');
 const DEFAULT_LEG_WALL_SECONDS = 3600;
@@ -21,6 +22,7 @@ const MAX_FAST_FAILS = 5;
 
 function statePath(root) { return path.join(root, '.atris', 'state', 'autopilot.json'); }
 function stopPath(root) { return path.join(root, '.atris', 'state', 'autopilot.stop'); }
+function lockPath(root) { return path.join(root, '.atris', 'state', 'autopilot.lock'); }
 
 function readState(root) {
   try { return JSON.parse(fs.readFileSync(statePath(root), 'utf8')); } catch { return null; }
@@ -42,6 +44,26 @@ function requestStop(root) {
 }
 function clearStop(root) { try { fs.unlinkSync(stopPath(root)); } catch {} }
 
+// When `autopilot stop` wrote its marker, in ms, or null without one.
+function stopRequestedAtMs(root) {
+  let stat;
+  try { stat = fs.statSync(stopPath(root)); } catch { return null; }
+  let stamped = NaN;
+  try { stamped = Date.parse(fs.readFileSync(stopPath(root), 'utf8').trim()); } catch {}
+  return Number.isFinite(stamped) ? Math.max(stamped, stat.mtimeMs) : stat.mtimeMs;
+}
+
+// A stop marker left over from before this start is cleared. One written
+// after this process launched is a real stop that raced the start, so it is
+// kept and honored. Returns true when such a stop is pending.
+function clearStaleStop(root, startRequestedAtMs) {
+  const at = stopRequestedAtMs(root);
+  if (at == null) return false;
+  if (at >= startRequestedAtMs) return true;
+  clearStop(root);
+  return false;
+}
+
 function pidAlive(pid) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   try { process.kill(pid, 0); return true; } catch { return false; }
@@ -261,8 +283,28 @@ async function autopilotFront(args = []) {
     console.log(`Autopilot already running (pid ${existing.pid}). Stop it first: atris autopilot stop`);
     return 1;
   }
+  // The state check above is read-then-write; two starts in the same instant
+  // both passed it. The lock file is created exclusively, so only one wins.
+  const lock = acquireFileLock(lockPath(root));
+  if (!lock.ok) {
+    console.log(`Autopilot already running (pid ${lock.holder?.pid || '?'}). Stop it first: atris autopilot stop`);
+    return 1;
+  }
+  try {
+    return await runFrontLoop(root, args, lock);
+  } finally {
+    lock.release();
+  }
+}
 
-  clearStop(root);
+async function runFrontLoop(root, args, lock) {
+  // The moment this process launched. A stop issued after it is not stale.
+  const startRequestedAtMs = Date.now() - Math.round(process.uptime() * 1000);
+  if (clearStaleStop(root, startRequestedAtMs)) {
+    clearStop(root);
+    console.log('\nAutopilot off (stop requested). Legs run: 0.');
+    return 0;
+  }
   const budgetSeconds = runBudgetSeconds(args);
   const legWallDefault = positiveNumber(readValueFlag(args, '--leg-wall')) || DEFAULT_LEG_WALL_SECONDS;
   // Honor the legacy contract callers still speak: `--iterations=N` caps the
@@ -283,6 +325,8 @@ async function autopilotFront(args = []) {
     console.log(`\nAutopilot off (${reason}). Legs run: ${state.legs}.`);
     clearState(root);
     clearStop(root);
+    // process.exit skips the caller's finally, so release here.
+    try { lock.release(); } catch {}
     process.exit(130);
   };
   process.on('SIGINT', onSignal);
@@ -344,6 +388,7 @@ module.exports = {
   stopRequested,
   requestStop,
   clearStop,
+  clearStaleStop,
   readState,
   writeState,
   watchStopFile,

package/commands/autopilot.js

@@ -1867,24 +1867,41 @@ function isDoPhaseTimeoutMessage(message) {
  * un-struck bullet whose normalized text contains the normalized title
  * prefix; `- **T33:** …` becomes `- [x] **T33:** …`, `- [ ]` becomes `- [x]`.
  * Returns true if a bullet was marked.
+ *
+ * A rendered TODO.md (it carries the "Regenerated from durable Atris task
+ * state" marker) is a view of the task database, so there the job itself is
+ * finished, the way `atris task done` finishes it, and the view re-rendered.
+ * Returns false when no single open or claimed job matches: re-rendering alone
+ * used to return true, and the tick reported a job advanced that never moved.
  */
 function markTodoBulletDone(cwd, taskTitle) {
+  const needle = taskMatchNeedle(taskTitle);
+  let isRenderedView = false;
   try {
-    // A rendered TODO.md carries the "Regenerated from durable Atris task
-    // state" marker; those are projections and never hand-edited. Legacy
-    // hand-written TODO.md files (no marker) keep the bullet-mark fallback.
     const renderedTodoPath = path.join(cwd, 'atris', 'TODO.md');
-    const isRenderedView = fs.existsSync(renderedTodoPath)
+    isRenderedView = fs.existsSync(renderedTodoPath)
       && fs.readFileSync(renderedTodoPath, 'utf8').includes('Regenerated from durable Atris task state');
-    if (isRenderedView) {
+  } catch {
+    isRenderedView = false;
+  }
+  if (isRenderedView) {
+    if (!needle) return false;
+    try {
       require('node:sqlite');
-      const rendered = require('./task').autoRenderTodoFromDb(cwd);
-      if (rendered) return true;
+      const out = require('./task').completeTodoTaskByTitle(cwd, taskTitle, {
+        matches: (title) => {
+          const norm = normalizeForMatch(title);
+          // The reverse test covers a tick title with a prefix ("T33: ..."); a short job title must not match by it.
+          return Boolean(norm) && (norm.includes(needle) || (norm.length >= 12 && needle.includes(norm)));
+        },
+        actor: 'autopilot',
+        proof: `autopilot tick finished "${String(taskTitle || '').slice(0, 200)}" and its completion receipt is in today's journal`,
+      });
+      return Boolean(out && out.completed);
+    } catch {
+      // Older Node runtimes without node:sqlite fall through to the markdown edit.
     }
-  } catch {
-    // Older Node runtimes and legacy workspaces retain the markdown fallback.
   }
-  const needle = taskMatchNeedle(taskTitle);
   if (!needle) return false;
   for (const name of ['TODO.md', 'todo.md']) {
     const todoPath = path.join(cwd, 'atris', name);
@@ -2211,26 +2228,38 @@ function logCompletion(description) {
   ensureLogDirectory();
   const { logFile, dateFormatted } = getLogPath();
 
-  if (!fs.existsSync(logFile)) {
-    createLogFile(logFile, dateFormatted);
-  }
+  // The next C number is read and the entry written as one step under a lock file, so two ticks
+  // finishing at once cannot both take the same number. A lock that cannot be had in a few seconds
+  // does not cost the entry: it is written anyway, as before.
+  const write = () => {
+    if (!fs.existsSync(logFile)) {
+      createLogFile(logFile, dateFormatted);
+    }
 
-  let content = fs.readFileSync(logFile, 'utf8');
+    let content = fs.readFileSync(logFile, 'utf8');
 
-  const completionMatch = content.match(/\*\*C(\d+):/g);
-  const nextId = completionMatch
-    ? Math.max(...completionMatch.map(m => parseInt(m.match(/\d+/)[0]))) + 1
-    : 1;
+    const completionMatch = content.match(/\*\*C(\d+):/g);
+    const nextId = completionMatch
+      ? Math.max(...completionMatch.map(m => parseInt(m.match(/\d+/)[0]))) + 1
+      : 1;
 
-  const entry = `- **C${nextId}:** ${description} [reviewed]`;
+    const entry = `- **C${nextId}:** ${description} [reviewed]`;
 
-  if (content.includes('## Completed')) {
-    content = content.replace(/(## Completed[^\n]*\n)/, `$1\n${entry}\n`);
-  } else {
-    content += `\n## Completed\n\n${entry}\n`;
-  }
+    // Readers look for "## Completed ✅" (and, since this fix, a bare "## Completed" too).
+    if (/^## Completed\b/m.test(content)) {
+      content = content.replace(/^(## Completed[^\n]*\n)/m, `$1\n${entry}\n`);
+    } else {
+      content += `\n## Completed ✅\n\n${entry}\n`;
+    }
 
-  fs.writeFileSync(logFile, content);
+    fs.writeFileSync(logFile, content);
+  };
+  try {
+    require('../lib/handoff-wake').withFileLock(`${logFile}.lock`, write, { staleMs: 60 * 1000, waitMs: 5 * 1000 });
+  } catch (err) {
+    if (!/stayed locked/.test(String(err && err.message))) throw err;
+    write();
+  }
 }
 
 /**
@@ -4055,6 +4084,7 @@ module.exports = {
   diffAdvancedRepoHeads,
   reconcileTimedOutTick,
   markTodoBulletDone,
+  logCompletion,
   findCompletionReceipt,
   isDoPhaseTimeoutMessage,
   validateVerifyCommandShape,

package/commands/clean.js

@@ -359,23 +359,34 @@ function findStaleTasks(atrisDir) {
  * Detects both out-of-bounds AND drift (symbol moved to different line)
  * Returns { healed: number, unhealable: array }
  */
-// The boot map routes; atris/refs/MAP-NOTES.md holds the deep file:line refs.
-// Heal both. Entries from the notes file carry `map` so reports can say where.
+// The boot map routes; atris/refs/MAP-NOTES.md holds the deep file:line refs,
+// or indexes area notes under atris/refs/map/ that hold them. Heal every one.
+// Entries from a notes file carry `map` so reports can say where.
 const MAP_NOTES_FILE = path.join('refs', 'MAP-NOTES.md');
+const MAP_NOTES_DIR = path.join('refs', 'map');
+
+function mapNoteFiles(atrisDir) {
+  const files = [path.join(atrisDir, MAP_NOTES_FILE)];
+  try {
+    for (const name of fs.readdirSync(path.join(atrisDir, MAP_NOTES_DIR)).sort()) {
+      if (name.endsWith('.md')) files.push(path.join(atrisDir, MAP_NOTES_DIR, name));
+    }
+  } catch { /* no area notes */ }
+  return files.filter((file) => { try { return fs.statSync(file).isFile(); } catch { return false; } });
+}
 
 function healBrokenMapRefs(cwd, atrisDir, dryRun = false, homeDir = os.homedir()) {
   const mapFile = path.join(atrisDir, 'MAP.md');
   if (!fs.existsSync(mapFile)) return { healed: 0, unhealable: [] };
   const result = healMapFileRefs(cwd, mapFile, dryRun, homeDir);
-  const notesFile = path.join(atrisDir, MAP_NOTES_FILE);
-  if (!fs.existsSync(notesFile)) return result;
-  const notes = healMapFileRefs(cwd, notesFile, dryRun, homeDir);
-  const map = path.relative(cwd, notesFile).split(path.sep).join('/');
-  return {
-    healed: result.healed + notes.healed,
-    unhealable: [...result.unhealable, ...notes.unhealable.map((entry) => ({ ...entry, map }))],
-    replacements: [...result.replacements, ...notes.replacements.map((entry) => ({ ...entry, map }))],
-  };
+  for (const notesFile of mapNoteFiles(atrisDir)) {
+    const notes = healMapFileRefs(cwd, notesFile, dryRun, homeDir);
+    const map = path.relative(cwd, notesFile).split(path.sep).join('/');
+    result.healed += notes.healed;
+    result.unhealable = [...result.unhealable, ...notes.unhealable.map((entry) => ({ ...entry, map }))];
+    result.replacements = [...(result.replacements || []), ...notes.replacements.map((entry) => ({ ...entry, map }))];
+  }
+  return result;
 }
 
 function healMapFileRefs(cwd, mapFile, dryRun, homeDir) {