atris 3.82.12 → 3.82.15

package/commands/business.js

@@ -52,38 +52,38 @@ const {
   findAtrisDir,
 } = require('../lib/business-core');
 
-async function findExistingBusinessBySlug(slug, token) {
+async function findExistingBusinessBySlug(slug, token, { api = apiRequestJson, loadLocal = loadBusinesses } = {}) {
   if (!slug) return null;
 
-  // Local cache first, no network round-trip needed.
-  const local = loadBusinesses();
-  if (local[slug]) {
-    return { id: local[slug].business_id, name: local[slug].name, slug, source: 'local' };
-  }
-  for (const v of Object.values(local)) {
-    if (businessMatchesSlug(v, slug)) {
-      return { id: v.business_id, name: v.name, slug, source: 'local' };
-    }
-  }
+  const local = loadLocal();
+  const localMatch = local[slug]
+    ? { id: local[slug].business_id, name: local[slug].name, slug, source: 'local' }
+    : (() => {
+      const v = Object.values(local).find((b) => businessMatchesSlug(b, slug));
+      return v ? { id: v.business_id, name: v.name, slug, source: 'local' } : null;
+    })();
 
-  if (!token) return null;
+  if (!token) return localMatch;
 
-  // Cloud lookup, covers businesses the user is a member of but hasn't added.
-  const direct = await apiRequestJson(`/business/by-slug/${encodeURIComponent(slug)}`, {
-    method: 'GET',
-    token,
-  });
+  // The cloud is the truth. The Mac's list can hold a business that was
+  // deleted, and trusting it refused to recreate one that no longer existed.
+  const direct = await api(`/business/by-slug/${encodeURIComponent(slug)}`, { method: 'GET', token });
   if (direct.ok && direct.data && direct.data.id) {
     return { id: direct.data.id, name: direct.data.name, slug: direct.data.slug || slug, source: 'cloud' };
   }
 
-  const list = await apiRequestJson('/business/', { method: 'GET', token });
+  const list = await api('/business/', { method: 'GET', token });
   if (list.ok && Array.isArray(list.data)) {
     const match = list.data.find(b => businessMatchesSlug(b, slug));
     if (match) return { id: match.id, name: match.name, slug: match.slug, source: 'cloud' };
+    if (localMatch) {
+      console.warn(`  Note: this Mac still lists "${slug}", but the cloud has no such business. Run: atris business doctor --fix`);
+    }
+    return null;
   }
 
-  return null;
+  // Cloud unreachable: fall back to the Mac's list rather than risk a duplicate.
+  return localMatch;
 }
 
 async function addBusiness(slug) {
@@ -1158,93 +1158,6 @@ async function businessTeam(slug) {
   console.log('');
 }
 
-async function connectService(connector, ...flags) {
-  if (!connector) {
-    console.log('Usage: atris business connect <service> [--business <slug>]');
-    console.log('');
-    console.log('Available connectors:');
-    // List skills that look like integrations
-    const skillDirs = [
-      path.join(__dirname, '..', '..', '.claude', 'skills'),
-      path.join(require('os').homedir(), '.claude', 'skills'),
-    ];
-    const seen = new Set();
-    for (const dir of skillDirs) {
-      if (!fs.existsSync(dir)) continue;
-      for (const name of fs.readdirSync(dir)) {
-        const skillFile = path.join(dir, name, 'SKILL.md');
-        if (fs.existsSync(skillFile) && !seen.has(name)) {
-          seen.add(name);
-        }
-      }
-    }
-    const integrations = [...seen].filter(s =>
-      ['slack', 'hubspot', 'linear', 'notion', 'google-drive', 'github',
-       'calendar', 'email-agent', 'x-search', 'youtube', 'ramp'].includes(s)
-    ).sort();
-    for (const s of integrations) {
-      console.log(`  ${s}`);
-    }
-    if (integrations.length === 0) console.log('  (none found, install skills first)');
-    return;
-  }
-
-  // Parse --business flag
-  let bizSlug = null;
-  for (let i = 0; i < flags.length; i++) {
-    if ((flags[i] === '--business' || flags[i] === '-b') && flags[i + 1]) {
-      bizSlug = flags[i + 1];
-      i++;
-    }
-  }
-
-  // Find the skill
-  const skillDirs = [
-    path.join(__dirname, '..', '..', '.claude', 'skills', connector),
-    path.join(require('os').homedir(), '.claude', 'skills', connector),
-  ];
-  let skillPath = null;
-  for (const dir of skillDirs) {
-    const p = path.join(dir, 'SKILL.md');
-    if (fs.existsSync(p)) { skillPath = p; break; }
-  }
-
-  if (!skillPath) {
-    console.error(`Skill "${connector}" not found.`);
-    console.error('Check: .claude/skills/ or ~/.claude/skills/');
-    process.exit(1);
-  }
-
-  console.log(`\n  Connecting: ${connector}`);
-  console.log(`  Skill:     ${skillPath}`);
-  if (bizSlug) console.log(`  Business:  ${bizSlug}`);
-
-  // Read skill to check for required secrets
-  const skillContent = fs.readFileSync(skillPath, 'utf8');
-  const secretMatches = skillContent.match(/[A-Z][A-Z0-9_]*_(?:KEY|TOKEN|SECRET|PASSWORD|API_KEY)/g) || [];
-  const uniqueSecrets = [...new Set(secretMatches)];
-
-  if (uniqueSecrets.length > 0) {
-    console.log(`\n  Required secrets:`);
-    for (const secret of uniqueSecrets) {
-      console.log(`    ${secret}`);
-    }
-    console.log(`\n  Store secrets with: atris computer run "echo $${uniqueSecrets[0]}"`);
-    console.log(`  Or set in: ~/.atris/secrets/${connector}/`);
-  }
-
-  // Create local secrets directory
-  const secretsDir = path.join(stateHome(), '.atris', 'secrets', connector);
-  if (!fs.existsSync(secretsDir)) {
-    fs.mkdirSync(secretsDir, { recursive: true });
-    console.log(`\n  Created secrets dir: ${secretsDir}/`);
-  }
-
-  console.log(`\n  Connected "${connector}" skill.`);
-  console.log(`  Agent can now use ${connector} capabilities.`);
-  console.log('');
-}
-
 async function setNotificationMode(mode, ...flags) {
   const validModes = ['digest', 'silent', 'push'];
   if (!mode || !validModes.includes(mode)) {
@@ -1588,6 +1501,7 @@ function printBusinessHelp() {
   console.log('  add <slug>           Register an existing cloud business');
   console.log('  list                 Show registered businesses');
   console.log('  room [slug]          Show wallet, members, apps, store, and recent orders');
+  console.log('  scoreboard [slug]    Revenue, orders, visitors, credits and your own numbers as one board (--doc, --json, add, set, layout)');
   console.log('  products [slug]      List store products');
   console.log('  orders [slug]        List store orders');
   console.log('  store on [slug]      Enable the store with its current catalog');
@@ -1596,7 +1510,7 @@ function printBusinessHelp() {
   console.log('  health [slug]        Full health dashboard');
   console.log('  audit                Audit all businesses');
   console.log('  doctor [--fix]       Find stale business cache, alias, and folder bindings');
-  console.log('  connect <service>    Connect a skill/integration');
+  console.log('  connect [service]    See or make a business connection (slack, telegram, discord, whatsapp, google-drive, hubspot)');
   console.log('  notify <mode>        Set notification mode (digest/silent/push)');
   console.log('  deploy <slug>        Push local business to cloud');
   console.log('  onboard              Seed brief, person, first loop, safe next action, and one-pager from sparse input');
@@ -1678,6 +1592,13 @@ async function businessCommand(subcommand, ...args) {
     case 'room':
       await businessRoom(args[0]);
       break;
+    case 'scoreboard':
+    case 'board':
+    case 'numbers': {
+      const code = await require('./business-scoreboard').scoreboardCommand(args);
+      if (code) process.exitCode = code;
+      break;
+    }
     case 'products':
     case 'product':
       await businessProducts(args[0]);
@@ -1705,7 +1626,7 @@ async function businessCommand(subcommand, ...args) {
       await businessDoctor(...args);
       break;
     case 'connect':
-      await connectService(args[0], ...args.slice(1));
+      process.exitCode = await require('./business-connect').connectCommand(args);
       break;
     case 'notify':
     case 'notification':
@@ -1744,6 +1665,7 @@ async function businessCommand(subcommand, ...args) {
 }
 
 module.exports = {
+  findExistingBusinessBySlug,
   businessCommand,
   businessWorkspaceBase,
   loadBusinesses,

package/commands/computer-login.js

@@ -0,0 +1,327 @@
+'use strict';
+
+// `atris computer login`: put your own Claude or Codex subscription on the
+// cloud computers you own, with one browser approval and nothing to answer.
+//
+// The sign-in happens on this laptop, where the browser is. The result is sent
+// straight to Atris, stored encrypted, and used only on runs you start. It is
+// never printed and never written to a file here.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { loadCredentials } = require('../utils/auth');
+const { apiRequestJson } = require('../utils/api');
+const engineLogin = require('../lib/engine-login');
+
+const ENGINES = ['claude', 'codex'];
+const WORKER_FOR = { claude: 'claude', codex: 'openai' };
+const TEST_MESSAGE = 'Reply with only the word OK.';
+
+function parseLoginArgs(args = []) {
+  const options = { engine: 'claude', business: '', status: false, unlink: false, check: false, test: true, help: false, error: '' };
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (ENGINES.includes(arg)) options.engine = arg;
+    else if (arg === '--status' || arg === 'status') options.status = true;
+    else if (arg === '--unlink' || arg === 'unlink' || arg === 'logout') options.unlink = true;
+    else if (arg === '--check' || arg === 'check') options.check = true;
+    else if (arg === '--no-test') options.test = false;
+    else if (arg === '--help' || arg === '-h' || arg === 'help') options.help = true;
+    else if (arg === '--business') {
+      options.business = String(args[i + 1] || '').trim();
+      i += 1;
+      if (!options.business) options.error = '--business needs a computer name';
+    } else if (arg.startsWith('--business=')) options.business = arg.slice('--business='.length).trim();
+    else options.error = `unknown option: ${arg}`;
+  }
+  return options;
+}
+
+function printHelp(log) {
+  log('Usage: atris computer login [claude|codex] [--business <name>]');
+  log('');
+  log('Puts your own subscription on the cloud computers you own.');
+  log('One browser approval. It is used only on runs you start.');
+  log('');
+  log('  atris computer login                 Claude, on every computer you own');
+  log('  atris computer login codex           Codex instead (a computer holds one at a time)');
+  log('  atris computer login --business x    only the computer named x');
+  log('  atris computer login --status        which computers have a subscription');
+  log('  atris computer login --check         run one small job and show how it was paid');
+  log('  atris computer login --unlink        remove it; add --business x for one');
+  log('  --no-test                            skip the test run at the end');
+}
+
+function findComputer(computers, name) {
+  const wanted = String(name || '').trim().toLowerCase();
+  if (!wanted) return null;
+  return computers.find((item) => [item.slug, item.name, item.business_id]
+    .some((value) => String(value || '').toLowerCase() === wanted)) || null;
+}
+
+function printStatus(computers, log) {
+  if (!computers.length) {
+    log('You do not own any computers on this account.');
+    return;
+  }
+  const width = Math.max(...computers.map((item) => String(item.name || item.slug || '').length));
+  for (const item of computers) {
+    const name = String(item.name || item.slug || item.business_id).padEnd(width);
+    log(`  ${name}  ${item.linked ? `${item.engine} subscription` : 'no subscription'}`);
+  }
+}
+
+// What the server said, in plain words. Never includes the sign-in.
+function explainFailure(result) {
+  if (result.status === 404) return 'The server does not have this yet. It needs the latest deploy.';
+  if (result.status === 403) return String(result.error || 'This is not switched on for your account.');
+  if (result.status === 401) return 'Your Atris sign-in ran out. Run: atris login';
+  if (result.status === 400) return String(result.error || 'The server did not accept that sign-in.');
+  return 'The server did not answer. Try again in a minute.';
+}
+
+// Claude: its own long-lived sign-in command, approved in the browser.
+function claudeSignIn(deps) {
+  const lib = deps.engineLogin || engineLogin;
+  const recorded = lib.recordSetupToken();
+  let token = lib.findToken(recorded.text);
+  if (!token) token = lib.askToken();
+  if (!/^sk-ant-oat/.test(token)) return { error: 'No sign-in came back from Claude.' };
+  // Claude prints the sign-in on screen. Wipe it, scrollback included.
+  (deps.clearScreen || (() => process.stdout.write('\x1b[2J\x1b[3J\x1b[H')))();
+  const check = lib.checkToken(token);
+  if (!check.ok) return { error: `The new sign-in did not work on this laptop (${check.detail}).` };
+  return { credential: token };
+}
+
+// Codex: a fresh sign-in in a throwaway folder, so the cloud gets its own
+// session and this laptop's Codex sign-in is left alone.
+function codexSignIn(deps) {
+  const spawn = deps.spawnSync || spawnSync;
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'atris-codex-login-'));
+  fs.chmodSync(home, 0o700);
+  try {
+    const result = spawn('codex', ['login', '-c', 'cli_auth_credentials_store="file"'], {
+      stdio: 'inherit',
+      env: { ...process.env, CODEX_HOME: home },
+    });
+    if (result.error && result.error.code === 'ENOENT') return { error: 'Codex is not installed on this laptop.' };
+    const file = path.join(home, 'auth.json');
+    if (!fs.existsSync(file)) return { error: 'No sign-in came back from Codex.' };
+    const content = fs.readFileSync(file, 'utf8').trim();
+    try {
+      if (typeof JSON.parse(content) !== 'object') throw new Error('not an object');
+    } catch {
+      return { error: 'Codex wrote a sign-in this tool could not read.' };
+    }
+    return { credential: content };
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+function defaultRunTest(computer, engine) {
+  const result = spawnSync(process.execPath, [
+    path.join(__dirname, '..', 'bin', 'atris.js'), 'computer', 'chat',
+    '--business', String(computer.slug || computer.business_id),
+    '--worker', WORKER_FOR[engine], '--message', TEST_MESSAGE,
+  ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 300000 });
+  const lines = `${result.stdout || ''}`.trim().split('\n').filter(Boolean);
+  return { ok: result.status === 0, reply: lines[lines.length - 1] || '' };
+}
+
+async function lastRun(api, token, computer) {
+  const result = await api(`/ai-computer/subscription/last-run?business_id=${encodeURIComponent(computer.business_id)}`, {
+    method: 'GET', token, timeoutMs: 15000, retries: 1,
+  });
+  return result.ok && result.data ? { ok: true, run: result.data.run || null } : { ok: false, run: null };
+}
+
+// Runs one tiny job as you, then asks the server how that run was paid for.
+// "New" means a different run than the newest one before the test, so no
+// clocks are compared.
+async function proveSubscription({ api, token, computer, engine, deps, log }) {
+  const name = computer.name || computer.slug;
+  const before = await lastRun(api, token, computer);
+  if (!before.ok) {
+    log('Could not read this computer\'s run records, so this is not proven yet.');
+    return false;
+  }
+  log(`Running one small job on ${name}. It may take a minute to wake.`);
+  const test = (deps.runTest || defaultRunTest)(computer, engine);
+  const after = await lastRun(api, token, computer);
+  const record = after.run;
+  const isNew = record && record.execution_id && (!before.run || record.execution_id !== before.run.execution_id);
+  if (!isNew) {
+    log('The test job left no new record, so this is not proven yet.');
+    return false;
+  }
+  if (!record.on_subscription) {
+    log(`Not working: that job was paid as "${record.billing_mode || 'unknown'}", not your subscription.`);
+    return false;
+  }
+  if (record.status !== 'completed' || !/\bok\b/i.test(test.reply || '')) {
+    log(`Not proven: the job was sent to your ${engine} subscription but did not finish cleanly (${record.status || 'unknown'}).`);
+    return false;
+  }
+  if (computer.shared_sign_in) {
+    log(`That job ran on a ${engine} subscription. ${name} also has the older shared sign-in,`);
+    log('so this result cannot tell the two apart.');
+    return true;
+  }
+  log(`Proven: that job ran on your ${engine} subscription.`);
+  return true;
+}
+
+// Ctrl-C during a sign-in goes to the sign-in program. Holding the signal here
+// lets cleanup of its screen recording run instead of dying mid-way.
+function holdingInterrupt(work) {
+  const hold = () => {};
+  process.on('SIGINT', hold);
+  try {
+    return work();
+  } finally {
+    process.removeListener('SIGINT', hold);
+  }
+}
+
+async function computerLogin(args = [], deps = {}) {
+  const log = deps.log || console.log;
+  const fail = deps.error || console.error;
+  const options = parseLoginArgs(args);
+  if (!options.business && deps.business) options.business = String(deps.business).trim();
+  if (options.help) {
+    printHelp(log);
+    return 0;
+  }
+  if (options.error) {
+    fail(options.error);
+    return 1;
+  }
+
+  const credentials = await (deps.loadCredentials || loadCredentials)();
+  if (!credentials || !credentials.token) {
+    fail('Not signed in to Atris. Run: atris login');
+    return 1;
+  }
+  const token = credentials.token;
+  const api = deps.apiRequestJson || apiRequestJson;
+
+  const listed = await api('/ai-computer/subscription', { method: 'GET', token, timeoutMs: 15000, retries: 1 });
+  if (!listed.ok) {
+    fail(explainFailure(listed));
+    return 1;
+  }
+  const computers = Array.isArray(listed.data && listed.data.computers) ? listed.data.computers : [];
+
+  if (options.status) {
+    printStatus(computers, log);
+    return 0;
+  }
+
+  let target = null;
+  if (options.business) {
+    target = findComputer(computers, options.business);
+    if (!target) {
+      fail(`You do not own a computer named "${options.business}".`);
+      return 1;
+    }
+  }
+  if (!computers.length) {
+    fail('You do not own any computers on this account, so there is nothing to sign in to.');
+    return 1;
+  }
+
+  if (options.unlink) {
+    const removed = await api('/ai-computer/subscription/unlink', {
+      method: 'POST', token, body: target ? { business_id: target.business_id } : {}, timeoutMs: 30000, retries: 0,
+    });
+    if (!removed.ok) {
+      fail(explainFailure(removed));
+      return 1;
+    }
+    const count = (removed.data && removed.data.unlinked ? removed.data.unlinked : []).length;
+    const stuck = (removed.data && removed.data.failed ? removed.data.failed : []).length;
+    log(`Removed your subscription from ${count} computer${count === 1 ? '' : 's'}.`);
+    if (stuck) {
+      fail(`${stuck} could not be removed. See which: atris computer login --status`);
+      return 1;
+    }
+    return 0;
+  }
+
+  const binding = (deps.readBusinessBinding || (() => null))();
+  const bound = binding ? findComputer(computers, binding.business_id || binding.id || binding.slug) : null;
+
+  if (options.check) {
+    const checked = target || bound;
+    if (!checked) {
+      fail('Name the computer to check: atris computer login --check --business <name>');
+      return 1;
+    }
+    if (!checked.linked) {
+      fail(`${checked.name || checked.slug} has no subscription yet. Run: atris computer login`);
+      return 1;
+    }
+    const proven = await proveSubscription({ api, token, computer: checked, engine: checked.engine, deps, log });
+    return proven ? 0 : 2;
+  }
+
+  const engine = options.engine;
+  log(`Signing in to ${engine}. A browser page opens. Approve it there.`);
+  const signIn = holdingInterrupt(() => (engine === 'claude'
+    ? (deps.claudeSignIn || claudeSignIn)(deps)
+    : (deps.codexSignIn || codexSignIn)(deps)));
+  if (signIn.error) {
+    fail(`${signIn.error} Nothing was changed.`);
+    return 1;
+  }
+
+  const linked = await api('/ai-computer/subscription/link', {
+    method: 'POST',
+    token,
+    body: { engine, credential: signIn.credential, ...(target ? { business_id: target.business_id } : {}) },
+    timeoutMs: 60000,
+    retries: 0,
+  });
+  if (!linked.ok) {
+    // A refusal means nothing was stored. Anything else (a timeout, a server
+    // error) may have stored it on some computers, so do not claim otherwise.
+    const refused = [400, 401, 403, 404].includes(linked.status);
+    fail(refused
+      ? `${explainFailure(linked)} Nothing was changed.`
+      : 'The server did not confirm. Some computers may have it. See which: atris computer login --status');
+    return 1;
+  }
+  const done = linked.data && Array.isArray(linked.data.linked) ? linked.data.linked : [];
+  const missed = linked.data && Array.isArray(linked.data.failed) ? linked.data.failed : [];
+  const names = done
+    .map((item) => computers.find((computer) => computer.business_id === item.business_id))
+    .filter(Boolean)
+    .map((computer) => computer.name || computer.slug);
+  log(`Your ${engine} subscription is on ${done.length} computer${done.length === 1 ? '' : 's'}${names.length ? `: ${names.join(', ')}` : ''}.`);
+  log('It is used only on runs you start.');
+  if (missed.length) {
+    const missedNames = missed.map((id) => {
+      const computer = computers.find((item) => item.business_id === id);
+      return computer ? (computer.name || computer.slug) : id;
+    });
+    fail(`It could not be added to ${missed.length}: ${missedNames.join(', ')}. Run the command again to retry.`);
+  }
+
+  if (!done.length) return 1;
+  if (!options.test) return missed.length ? 1 : 0;
+  const proofTarget = target || (bound && done.some((item) => item.business_id === bound.business_id) ? bound : null);
+  if (!proofTarget) {
+    log('To prove it on one computer: atris computer login --check --business <name>');
+    return missed.length ? 1 : 0;
+  }
+  const proven = await proveSubscription({ api, token, computer: proofTarget, engine, deps, log });
+  if (!proven) return 2;
+  return missed.length ? 1 : 0;
+}
+
+module.exports = { computerLogin, parseLoginArgs, findComputer, explainFailure, claudeSignIn, codexSignIn };

package/commands/computer.js

@@ -1943,6 +1943,19 @@ async function runComputer(argv = process.argv.slice(3), deps = {}) {
   const cloudOptions = parsed.options;
   const sub = args[0];
 
+  if (sub === 'login') {
+    const { computerLogin } = require('./computer-login');
+    // The shared option reader takes --business wherever it sits, so hand it
+    // on; otherwise a flag typed before `login` would be dropped silently.
+    const code = await computerLogin(argv.slice(argv.indexOf('login') + 1), {
+      readBusinessBinding,
+      business: cloudOptions.businessSlug || '',
+      ...deps,
+    });
+    if (code !== 0) process.exitCode = code;
+    return code;
+  }
+
   if (sub === 'setup') {
     const code = await computerSetup(deps);
     if (code !== 0) process.exitCode = code;