atris 3.80.1 → 3.82.2

package/lib/business-core.js

@@ -900,10 +900,9 @@ function seedBusinessStarterTask(cwd, todoPath, starterAction) {
         verify: 'atris business record atris/reports/<recap>.md --outcome mixed --metric "operator speed"',
       },
     });
-    const projection = taskDb.taskProjection(db, { workspaceRoot, limit: 500 });
-    const projectionPath = path.join(cwd, '.atris', 'state', 'tasks.projection.json');
-    fs.mkdirSync(path.dirname(projectionPath), { recursive: true });
-    fs.writeFileSync(projectionPath, `${JSON.stringify(projection, null, 2)}\n`, 'utf8');
+    // The one projection writer (same shape as `atris task`, temp file and rename).
+    const { writeDefaultProjection } = require('../commands/task');
+    const projectionPath = writeDefaultProjection(taskDb, db, { root: cwd }).outPath;
     return { ok: true, inserted: Boolean(result.inserted), taskId: result.id, projectionPath };
   } catch (error) {
     return { ok: false, error: error && error.message ? error.message : String(error) };

package/lib/campaign-run-lock.js

@@ -9,6 +9,11 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { stealStaleLock } = require('./file-lock');
+
+// A lock is created empty and its holder record lands a moment later, so an
+// unreadable lock this young is still someone's, not stale.
+const UNREADABLE_GRACE_MS = 5000;
 
 function lockPath(home, campaignId) {
   return path.join(home, 'campaigns', campaignId, 'run.lock');
@@ -48,10 +53,16 @@ function acquireRunLock(home, campaignId, { pid = process.pid, host = os.hostnam
     } catch (error) {
       if (error.code !== 'EEXIST') throw error;
     }
+    let judged;
+    try { judged = fs.statSync(file); } catch { continue; }
+    let raw = null;
+    try { raw = fs.readFileSync(file, 'utf8'); } catch {}
     const holder = readHolder(file);
     if (holder && holder.host === host && isAlive(holder.pid)) return { ok: false, holder };
     if (holder && holder.host !== host) return { ok: false, holder };
-    fs.rmSync(file, { force: true });
+    if (!holder && Date.now() - judged.mtimeMs < UNREADABLE_GRACE_MS) return { ok: false, holder: null };
+    // Rename-then-verify, so a second waiter never deletes a fresh lock.
+    stealStaleLock(file, judged, raw);
   }
   return { ok: false, holder: readHolder(file) };
 }

package/lib/engine-ask.js

@@ -246,7 +246,7 @@ function assertAskModelSupported(engine, model) {
 function resolveAskModel(engine, modelName = '') {
   const requested = String(modelName || '').trim();
   if (requested) {
-    // A display name ("opus 5.5") becomes an id only for the claude cli; every
+    // A spaced display name becomes an id only for the claude cli; every
     // other engine gets its model name as typed.
     return engine === 'claude' || engine === 'fable' || engine === 'haiku'
       ? claudeModelId(requested)

package/lib/engine-receipt-sweep.js

@@ -93,6 +93,70 @@ function sweepEngineAskReceipts(root, deps = {}) {
   return summary;
 }
 
+// Fleet and dispatch flights write a running receipt with the driver's pid
+// and rewrite it when they finish. A crashed flight never rewrites it, so the
+// receipt read as running forever. Flights run long, so the age bar is an hour
+// and a live pid always keeps the receipt as it is.
+const DISPATCH_RECEIPT_SCHEMA = 'atris.dispatch_receipt.v1';
+const FLEET_GRACE_MS = 60 * 60 * 1000;
+const FLEET_SWEEP_NOTE = 'stale receipt sweep marked this flight presumed dead: its process is gone and it never finished.';
+
+function isFleetReceipt(name, receipt) {
+  if (receipt.schema === DISPATCH_RECEIPT_SCHEMA) return name.startsWith('dispatch-');
+  return !receipt.schema && name.startsWith('fleet-') && Array.isArray(receipt.results);
+}
+
+function sweepFleetReceipts(root, deps = {}) {
+  const fsModule = deps.fs || fs;
+  const kill = deps.kill || process.kill;
+  const now = deps.now ? deps.now() : new Date();
+  const nowMs = now.getTime();
+  const graceMs = deps.graceMs === undefined ? FLEET_GRACE_MS : Number(deps.graceMs);
+  const summary = { scanned: 0, finalized: 0, skipped_alive: 0, skipped_young: 0 };
+  const runsDir = path.join(root, 'atris', 'runs');
+  let names;
+  try {
+    names = fsModule.readdirSync(runsDir)
+      .filter((name) => name.endsWith('.json') && (name.startsWith('fleet-') || name.startsWith('dispatch-')))
+      .sort();
+  } catch {
+    return summary;
+  }
+  for (const name of names) {
+    const receiptPath = path.join(runsDir, name);
+    let receipt;
+    let stat;
+    try {
+      receipt = JSON.parse(fsModule.readFileSync(receiptPath, 'utf8'));
+      stat = fsModule.statSync(receiptPath);
+    } catch {
+      continue;
+    }
+    if (!receipt || typeof receipt !== 'object' || receipt.status !== 'running' || !isFleetReceipt(name, receipt)) continue;
+    summary.scanned += 1;
+    // Age from the last write, not the start: a long flight rewrites its
+    // receipt as tasks land.
+    const lastWriteMs = Math.max(receiptStartedMs(receipt, stat), stat.mtimeMs);
+    if (nowMs - lastWriteMs < graceMs) {
+      summary.skipped_young += 1;
+      continue;
+    }
+    if (processIsAlive(Number(receipt.pid), kill)) {
+      summary.skipped_alive += 1;
+      continue;
+    }
+    atomicWriteReceipt(receiptPath, {
+      ...receipt,
+      status: 'presumed_dead',
+      swept_at: now.toISOString(),
+      note: FLEET_SWEEP_NOTE,
+    }, fsModule);
+    summary.finalized += 1;
+  }
+  return summary;
+}
+
 module.exports = {
   sweepEngineAskReceipts,
+  sweepFleetReceipts,
 };

package/lib/file-lock.js

@@ -0,0 +1,175 @@
+'use strict';
+
+// One exclusive lock file per resource, shared by the loops that must not run
+// twice at once (autoland tick, autopilot, mission, campaign run).
+//
+// - Create is exclusive (`wx`), so two takers never both win.
+// - The file records { pid, host, token, at }. Release removes it only while
+//   the token (or the open file) is still ours, so a tick that lost its lock
+//   to a stale-steal never deletes the next owner's lock.
+// - A stale lock is stolen by renaming it to a unique tombstone first. If the
+//   renamed file turns out not to be the one judged stale (someone replaced
+//   it in between), it is linked back without clobbering. Two waiters that
+//   both judged the same lock stale can no longer delete each other's fresh
+//   lock.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function pidAlive(pid) {
+  const n = Number(pid);
+  if (!Number.isInteger(n) || n <= 0) return false;
+  try {
+    process.kill(n, 0);
+    return true;
+  } catch (error) {
+    return Boolean(error) && error.code === 'EPERM';
+  }
+}
+
+function readRaw(file) {
+  try { return fs.readFileSync(file, 'utf8'); } catch { return null; }
+}
+
+function parseHolder(raw) {
+  if (raw == null) return null;
+  try {
+    const value = JSON.parse(raw);
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function sameFile(a, b) {
+  return Boolean(a && b) && a.ino === b.ino && a.dev === b.dev;
+}
+
+// Remove `file` only if it is still the file described by `judged` (stat) and
+// `judgedRaw` (contents). Returns true when the caller should retry create.
+function stealStaleLock(file, judged, judgedRaw) {
+  const tomb = `${file}.stale-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+  try {
+    fs.renameSync(file, tomb);
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return true;
+    throw error;
+  }
+  let moved = null;
+  try { moved = fs.statSync(tomb); } catch {}
+  const movedRaw = readRaw(tomb);
+  if (!sameFile(moved, judged) || (judgedRaw != null && movedRaw !== judgedRaw)) {
+    // We grabbed a lock that was replaced after we judged it. Put it back
+    // without overwriting anything created since.
+    try { fs.linkSync(tomb, file); } catch {}
+  }
+  try { fs.unlinkSync(tomb); } catch {}
+  return true;
+}
+
+// Decide whether a lock someone else holds may be taken over.
+function judgeHolder(holder, ageMs, { host, isAlive, staleAfterMs, unreadableGraceMs }) {
+  if (!holder) return ageMs > unreadableGraceMs ? 'stale' : 'held';
+  const holderPid = Number(holder.pid);
+  const atMs = typeof holder.at === 'number' ? holder.at : Date.parse(holder.at || holder.started_at || '');
+  const heldFor = Number.isFinite(atMs) ? Date.now() - atMs : ageMs;
+  if (Number.isFinite(staleAfterMs) && heldFor > staleAfterMs) return 'stale';
+  if (holder.host && holder.host !== host) return 'held';
+  if (!Number.isInteger(holderPid) || holderPid <= 0) return ageMs > unreadableGraceMs ? 'stale' : 'held';
+  return isAlive(holderPid) ? 'held' : 'stale';
+}
+
+// Returns { ok: true, file, token, fd?, release() } or { ok: false, file, holder }.
+// Options:
+//   meta              extra fields written into the lock record
+//   pid, host         identity written into the record (defaults: this process)
+//   staleAfterMs      a lock older than this is stale even with a live pid
+//   unreadableGraceMs an empty/unreadable lock younger than this is held
+//                     (its owner may still be writing the record)
+//   keepOpen          return the open fd (release then checks the inode)
+//   isAlive           pid liveness probe (tests)
+function acquireFileLock(file, options = {}) {
+  const {
+    meta = {},
+    pid = process.pid,
+    host = os.hostname(),
+    staleAfterMs = Infinity,
+    unreadableGraceMs = 5000,
+    keepOpen = false,
+    isAlive = pidAlive,
+    attempts = 5,
+  } = options;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const token = crypto.randomBytes(8).toString('hex');
+  const record = JSON.stringify({ ...meta, pid, host, token, at: new Date().toISOString() });
+  let lastHolder = null;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    let fd;
+    try {
+      fd = fs.openSync(file, 'wx');
+    } catch (error) {
+      if (!error || error.code !== 'EEXIST') throw error;
+    }
+    if (fd !== undefined) {
+      try {
+        fs.writeSync(fd, record);
+      } catch (error) {
+        try { fs.closeSync(fd); } catch {}
+        try { fs.unlinkSync(file); } catch {}
+        throw error;
+      }
+      let ino = null;
+      try { ino = fs.fstatSync(fd); } catch {}
+      if (!keepOpen) {
+        try { fs.closeSync(fd); } catch {}
+        fd = undefined;
+      }
+      const lock = { ok: true, file, token, fd, stat: ino, record };
+      lock.release = () => releaseFileLock(lock);
+      return lock;
+    }
+    let judged;
+    try {
+      judged = fs.statSync(file);
+    } catch (error) {
+      if (error && error.code === 'ENOENT') continue;
+      throw error;
+    }
+    const raw = readRaw(file);
+    const holder = parseHolder(raw);
+    lastHolder = holder;
+    const verdict = judgeHolder(holder, Date.now() - judged.mtimeMs, { host, isAlive, staleAfterMs, unreadableGraceMs });
+    if (verdict === 'held') return { ok: false, file, holder };
+    stealStaleLock(file, judged, raw);
+  }
+  return { ok: false, file, holder: lastHolder || parseHolder(readRaw(file)) };
+}
+
+// Remove the lock only while it is still ours.
+function releaseFileLock(lock) {
+  if (!lock || !lock.ok || lock.released) return false;
+  lock.released = true;
+  let ours = false;
+  if (lock.fd != null) {
+    try {
+      ours = sameFile(fs.fstatSync(lock.fd), fs.statSync(lock.file));
+    } catch {
+      ours = false;
+    }
+    try { fs.closeSync(lock.fd); } catch {}
+  } else {
+    const holder = parseHolder(readRaw(lock.file));
+    ours = Boolean(holder) && holder.token === lock.token;
+  }
+  if (!ours) return false;
+  try { fs.unlinkSync(lock.file); } catch { return false; }
+  return true;
+}
+
+module.exports = {
+  acquireFileLock,
+  stealStaleLock,
+  pidAlive,
+};

package/lib/first-minute.js

@@ -8,6 +8,7 @@ const { spawnSync } = require('child_process');
 const { isGenericScratchRoot } = require('./scratch-root');
 const { resolveDefaultVerifier } = require('./default-verifier');
 const { nonFalsifyingIssue } = require('./accept-verify-gate');
+const { reconcileTaskRows } = require('./next-work-context');
 
 const FIRST_USE_COMMAND = 'atris "help me choose the first useful step for this project"';
 const FIRST_TALK_ASK = 'what do you want here';
@@ -176,8 +177,10 @@ function titlesFromTodoSection(root, section) {
   }
 }
 
-function loadLocalTasks(root = process.cwd()) {
+function loadLocalTaskState(root = process.cwd(), { taskIds = [] } = {}) {
   let dbRows = [];
+  let lookup = () => null;
+  let databaseRead = false;
   try {
     const taskDb = require('./task-db');
     // Reading never creates the db, so a first look writes nothing.
@@ -185,20 +188,49 @@ function loadLocalTasks(root = process.cwd()) {
     const db = taskDb.open();
     const workspaceRoot = taskDb.workspaceRoot(root);
     const rows = taskDb.listTasks(db, { workspaceRoot, limit: 200 });
+    // Busy queues must not crowd the last outcomes out of the handoff.
+    const recent = ['done', 'failed'].flatMap((status) => taskDb.listTasks(db, { workspaceRoot, status, limit: 3, orderBy: 'updated_at' }));
+    const seen = new Set(rows.map((row) => row.id));
+    rows.push(...recent.filter((row) => !seen.has(row.id)));
     if (Array.isArray(rows) && rows.length) dbRows = taskDb.withTaskDisplayRefs(rows);
+    databaseRead = true;
+    lookup = (id) => {
+      const row = taskDb.getTask(db, id);
+      // A foreign id in a damaged projection is not this workspace's work.
+      if (row && !taskDb.rowInWorkspace(row, workspaceRoot)) return false;
+      return row ? taskDb.withTaskDisplayRefs([row])[0] : null;
+    };
+    // A shortlist is an output budget, not authority to invent a bound job.
+    for (const id of taskIds.slice(0, 8)) {
+      if (dbRows.some((row) => row.id === id)) continue;
+      const row = lookup(id);
+      if (row) dbRows.push(row);
+    }
   } catch {
     // Fall through to the local projection. Tests and fresh folders often have no db.
   }
-  if (dbRows.some(isActionableTask)) return dbRows;
+  if (dbRows.some(isActionableTask)) return { tasks: dbRows, source: 'database' };
   const projectionPath = path.join(root, '.atris', 'state', 'tasks.projection.json');
   try {
     const parsed = JSON.parse(fs.readFileSync(projectionPath, 'utf8'));
+    if (parsed.workspace_root && path.resolve(parsed.workspace_root) !== path.resolve(require('./task-db').workspaceRoot(root))) {
+      return { tasks: dbRows, source: databaseRead ? 'database' : 'none' };
+    }
     const projected = Array.isArray(parsed.tasks) ? parsed.tasks : [];
-    if (projected.some(isActionableTask) || !dbRows.length) return projected;
+    if (projected.some(isActionableTask) || !dbRows.length) {
+      const tasks = reconcileTaskRows(dbRows, projected, lookup);
+      const known = new Set(dbRows.map((row) => row.id));
+      const unknown = tasks.some((row) => !row.id || (!known.has(row.id) && !lookup(row.id)));
+      return { tasks, source: unknown || !databaseRead ? (dbRows.length ? 'mixed' : 'projection') : 'database', generated_at: parsed.generated_at || null };
+    }
   } catch {
     // Keep any done-only db rows below.
   }
-  return dbRows;
+  return { tasks: dbRows, source: databaseRead ? 'database' : 'none' };
+}
+
+function loadLocalTasks(root = process.cwd()) {
+  return loadLocalTaskState(root).tasks;
 }
 
 function loadLatestRecap(root = process.cwd()) {
@@ -1170,6 +1202,7 @@ module.exports = {
   spokenBuiltList,
   taskStartedAt,
   loadLocalTasks,
+  loadLocalTaskState,
   firstTalkBuildCommand,
   renderWhatsNextAsk,
   isLeftoverVerbLook,

package/lib/fleet.js

@@ -179,7 +179,7 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   lines.push(
     'Rules:',
     mapNotesPath(worktreePath || process.cwd())
-      ? '- Read atris/MAP.md first to locate the code, then atris/refs/MAP-NOTES.md for exact file:line refs; never guess file locations.'
+      ? '- Read atris/MAP.md first to locate the code, then atris/refs/MAP-NOTES.md (or the area note it points to) for exact file:line refs; never guess file locations.'
       : '- Read atris/MAP.md first to locate the code; never guess file locations.',
     ...SHARED_BRIEF_RULES,
     '- Run git status first. Stage ONLY files you changed. Never revert or touch files another agent modified.',