atris 3.82.15 → 3.82.17

package/README.md

@@ -269,7 +269,7 @@ The owner makes the client once. The secret is shown one time, or written to a
 private file with `--secret-file`:
 
 ```bash
-atris agent-client create --name nightly-bot --scopes mcp:read,x-search --secret-file ./bot.secret
+atris agent-client create --name nightly-bot --scopes mcp:workspace:read,x-search --secret-file ./bot.secret
 atris agent-client list
 atris agent-client rotate <client_id>
 atris agent-client revoke <client_id>

package/bin/atris.js

@@ -153,7 +153,7 @@ const dryRunRequested = updateArgs.includes('--dry-run');
 const skipUpdateCheck = Boolean(process.env.ATRIS_SKIP_UPDATE_CHECK || process.env.NO_UPDATE_NOTIFIER || helpRequested || jsonRequested);
 // Local-only commands make no registry call and start no background install.
 // sentinel prints its own one-line notice at the end of the run instead.
-if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel'].includes(updateCommand)))) {
+if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel', 'login'].includes(updateCommand)))) {
   updateCheckPromise = checkForUpdates()
     .then((updateInfo) => {
       if (updateInfo) {
@@ -1047,7 +1047,7 @@ function showReleaseHelp() {
 
 function showAuthHelp(commandName) {
   const usage = {
-    login: 'Usage: atris login [--token <token>] [--force] [--agent] [--client-id <atc_...> --client-secret-file <path>]',
+    login: 'Usage: atris login [--code <code>] [--token <token>] [--force] [--agent] [--client-id <atc_...> --client-secret-file <path>]',
     logout: 'Usage: atris logout',
     whoami: 'Usage: atris whoami [--json]',
     switch: 'Usage: atris switch [account] [--global]',
@@ -1059,10 +1059,13 @@ function showAuthHelp(commandName) {
   console.log('');
   console.log('Description:');
   if (commandName === 'login') {
-    console.log('  Sign in with browser OAuth or a pasted API token.');
-    console.log('  --agent mints a scoped agent token from stored credentials. No browser.');
-    console.log('  --client-id signs an agent in by itself with an agent client (see atris agent-client).');
-    console.log('  The token renews on its own; the secret is never printed.');
+    console.log('  Pick the one that fits you:');
+    console.log('  A person: run atris login. It opens the browser, then you paste the one-time code.');
+    console.log('    No terminal? Open atris.ai/auth/cli and run atris login --code <code>.');
+    console.log('  An agent on its own: atris login --client-id <atc_...> --client-secret-file <path>.');
+    console.log('    Make the client once with atris agent-client. It renews itself and never prints the secret.');
+    console.log('  A script calling the API: atris login --token <atris_... key>.');
+    console.log('  The one-time code is not a token. If you paste it as one, login signs you in with it.');
   } else if (commandName === 'logout') {
     console.log('  Sign out of the current Atris account.');
   } else if (commandName === 'whoami') {
@@ -1077,6 +1080,7 @@ function showAuthHelp(commandName) {
   console.log('');
   console.log('Options:');
   if (commandName === 'login') {
+    console.log('  --code <code>             Sign in with the one-time code from atris.ai/auth/cli. --code - reads it from stdin.');
     console.log('  --token <token>           Save an API token without prompting.');
     console.log('  --force, -f               Re-run login even if credentials already exist.');
     console.log('  --agent                   Mint a scoped agent token from the stored login.');

package/commands/agent-client.js

@@ -10,7 +10,7 @@
 const fs = require('fs');
 const path = require('path');
 const { apiRequestJson } = require('../utils/api');
-const { ensureValidCredentials, readActiveCredentials } = require('../utils/auth');
+const { ensureValidCredentials, readActiveCredentials, listProfiles, loadProfile, getSessionProfile } = require('../utils/auth');
 const agentClient = require('../utils/agent-client');
 const { readFlag } = require('../lib/arg-parser');
 const { wantsJson, wantsHelp, oneLine } = require('../lib/developer-api');
@@ -19,7 +19,52 @@ const BASE_PATH = '/auth/agent-clients';
 const ACTIONS = new Set(['create', 'list', 'revoke', 'rotate']);
 const VALUE_FLAGS = ['--name', '--scopes', '--daily-credit-cap', '--ttl', '--secret-file'];
 const SHOWN_ONCE = 'store this secret now, it will not be shown again:';
-const AGENT_CLIENT_CANNOT_MANAGE = 'agent clients are managed with your own login, not an agent client. run: atris switch <you> or atris login --force';
+// Scopes an agent client can carry today. The server holds the real list and
+// rejects anything else; this is what help and the unknown-scope hint show.
+const COMMON_SCOPES = [
+  'x-search', 'youtube', 'gmail-read', 'calendar-read',
+  'files:read', 'files:write', 'scoreboard:read', 'ai:complete',
+  'mcp:workspace:read', 'mcp:publish',
+];
+
+// The person's own saved logins, so the error can name a real switch command.
+function humanProfileNames(deps = {}) {
+  const list = deps.listProfiles || listProfiles;
+  const load = deps.loadProfile || loadProfile;
+  try {
+    return list().filter((name) => {
+      const profile = load(name);
+      return profile && profile.token && !agentClient.isAgentClientCredential(profile);
+    });
+  } catch {
+    return [];
+  }
+}
+
+// The switch command that actually reaches the login in use. ATRIS_PROFILE
+// beats everything, then this terminal's own pick, then the global login, so
+// a --global switch would not help a terminal that picked its own account.
+function switchCommandFor(name, deps = {}) {
+  const env = deps.env || process.env;
+  if (String(env.ATRIS_PROFILE || '').trim()) return `export ATRIS_PROFILE=${name}`;
+  let session = null;
+  try { session = (deps.getSessionProfile || getSessionProfile)(); } catch { session = null; }
+  return session ? `atris switch ${name}` : `atris switch ${name} --global`;
+}
+
+function cannotManageMessage(deps = {}) {
+  const names = humanProfileNames(deps);
+  const lead = 'agent clients are managed with your own login, not an agent client.';
+  if (names.length === 1) return `${lead} switch back: ${switchCommandFor(names[0], deps)}`;
+  if (names.length > 1) return `${lead} switch back with one of: ${names.map((n) => switchCommandFor(n, deps)).join(' | ')}`;
+  return `${lead} sign in as yourself: atris login --force`;
+}
+
+function withScopeHint(message) {
+  const text = String(message || '');
+  if (!/unknown scope/i.test(text)) return text;
+  return `${text}. scopes you can use: ${COMMON_SCOPES.join(', ')}`;
+}
 
 function showAgentClientHelp(log = console.log) {
   log('usage: atris agent-client create --name <name> --scopes <a,b> [--daily-credit-cap N] [--ttl SECONDS] [--secret-file <path>]');
@@ -30,6 +75,7 @@ function showAgentClientHelp(log = console.log) {
   log('an agent client lets an agent sign itself in, with no person in the loop.');
   log('create and rotate show the secret once. --secret-file writes it to a private file instead.');
   log('the agent then runs: atris login --client-id <atc_...> --client-secret-file <path>');
+  log(`scopes you can use: ${COMMON_SCOPES.join(', ')}`);
   log('needs your own login. add --json for machine output.');
 }
 
@@ -170,7 +216,7 @@ async function agentClientCommand(args = [], deps = {}) {
 
   const readActive = deps.readActiveCredentials || readActiveCredentials;
   if (agentClient.isAgentClientCredential(readActive())) {
-    return fail(AGENT_CLIENT_CANNOT_MANAGE);
+    return fail(cannotManageMessage(deps));
   }
 
   const request = deps.apiRequestJson || apiRequestJson;
@@ -180,7 +226,7 @@ async function agentClientCommand(args = [], deps = {}) {
     return fail('not logged in. run: atris login');
   }
   if (ensured.source === agentClient.AUTH_TYPE || agentClient.isAgentClientCredential(ensured.credentials)) {
-    return fail(AGENT_CLIENT_CANNOT_MANAGE);
+    return fail(cannotManageMessage(deps));
   }
   const token = ensured.credentials.token;
 
@@ -211,7 +257,7 @@ async function agentClientCommand(args = [], deps = {}) {
     const secret = result && result.data && result.data.client_secret;
     const message = status === 404 && parsed.action !== 'revoke' && parsed.action !== 'rotate'
       ? 'agent clients are not live on the server yet. try again after the backend update.'
-      : agentClient.scrub(oneLine(result && (result.data || result.error)), [token, secret]);
+      : withScopeHint(agentClient.scrub(oneLine(result && (result.data || result.error)), [token, secret]));
     return fail(message, { status: status || 0 });
   }
 

package/commands/auth.js

@@ -622,6 +622,108 @@ async function loginAgentClient(request, deps = {}) {
   return 0;
 }
 
+// The browser page at /auth/cli shows a one-time code: secrets.token_urlsafe(32)
+// in the backend, so 43 url-safe characters with no dots. Tokens are JWTs
+// (three dot-joined parts) and API keys start with atris_. A code pasted where
+// a token belongs used to be saved as a token and fail later with a JWT error.
+const CLI_CODE_PATTERN = /^(?!atris_)[A-Za-z0-9_-]{43}$/;
+const CODE_NOT_TOKEN_NOTE = 'that is the one-time code from the browser, not a token. signing you in with it.';
+
+function looksLikeCliCode(value) {
+  return CLI_CODE_PATTERN.test(String(value || '').trim());
+}
+
+// readFlag treats a value starting with "-" as the next flag, but one code in
+// 64 starts with a dash. Take --code=<v> as is, and the next arg when it is
+// code-shaped or not a flag. "-" or nothing means read stdin.
+function readCodeFlag(args = []) {
+  const eq = args.find((arg) => String(arg).startsWith('--code='));
+  if (eq !== undefined) {
+    const value = String(eq).slice('--code='.length);
+    return value === '-' ? '' : value;
+  }
+  const next = args[args.indexOf('--code') + 1];
+  if (next === undefined || next === '-') return '';
+  if (looksLikeCliCode(next) || !String(next).startsWith('-')) return String(next);
+  return '';
+}
+
+function headlessLoginHelp() {
+  const url = `${getAppBaseUrl()}/auth/cli`;
+  return [
+    `open ${url}, sign in, then pass the one-time code it shows:`,
+    '  atris login --code <code>      or      echo <code> | atris login',
+    'agents without a person: atris login --client-id <atc_...> --client-secret-file <path>',
+  ];
+}
+
+// Reads a code piped into stdin. Only reads a pipe, socket, or file, and
+// gives up after a short wait so an open, silent stdin never hangs login.
+function readPipedLoginInput(timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    let stat;
+    try { stat = fs.fstatSync(0); } catch { resolve(''); return; }
+    // Node-launched agents hand stdin over as a socket, shells as a FIFO.
+    if (!stat || !(stat.isFIFO() || stat.isFile() || stat.isSocket())) { resolve(''); return; }
+    let data = '';
+    let finished = false;
+    const finish = () => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners('data');
+      process.stdin.pause();
+      resolve(data.split(/\r?\n/).map((line) => line.trim()).find(Boolean) || '');
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    if (timer.unref) timer.unref();
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => {
+      data += chunk;
+      if (data.length > 8192 || /\n/.test(data)) finish();
+    });
+    process.stdin.on('end', finish);
+    process.stdin.on('error', finish);
+    process.stdin.resume();
+  });
+}
+
+async function exchangeCliCodeAndSave(code, { asJson = false, note = null, quiet = false } = {}) {
+  if (note && !asJson) console.log(note);
+  const exchange = await apiRequestJson('/auth/cli/exchange', {
+    method: 'POST',
+    body: { code: String(code).trim() },
+  });
+  const payload = exchange && exchange.ok ? exchange.data : null;
+  if (!payload || !payload.token || !payload.refresh_token) {
+    const error = !payload
+      ? (exchange && exchange.error) || 'invalid or expired code'
+      : 'the server did not return tokens. try again.';
+    const unreachable = !exchange || !exchange.status;
+    const next = unreachable
+      ? `could not reach ${getApiBaseUrl()}. check the connection and run the same command again.`
+      : `get a fresh code at ${getAppBaseUrl()}/auth/cli. codes last five minutes and work once.`;
+    if (asJson) {
+      console.log(JSON.stringify({ ok: false, logged_in: false, error, next }, null, 2));
+    } else {
+      console.error(`Error: ${error}`);
+      console.error(next);
+    }
+    return 1;
+  }
+  const email = payload.email || null;
+  saveCredentials(payload.token, payload.refresh_token, email, payload.user_id || null, payload.provider || 'atris');
+  if (quiet) return 0;
+  if (asJson) {
+    console.log(JSON.stringify({ ok: true, logged_in: true, email, user_id: payload.user_id || null, provider: payload.provider || 'atris', next: 'atris whoami --json' }, null, 2));
+    return 0;
+  }
+  const name = profileNameFromEmail(email);
+  console.log(`\n✓ Signed in as ${email || 'unknown'}${name ? ` (profile: ${name})` : ''}`);
+  await displayAccountSummary(apiRequestJson);
+  return 0;
+}
+
 async function loginAtris(options = {}) {
   // Support: atris login --token <token> --force
   const args = process.argv.slice(3);
@@ -645,7 +747,11 @@ async function loginAtris(options = {}) {
     const existing = loadCredentials();
 
     if (wantsAgentToken(args)) {
-      if (directToken) {
+      if (directToken && looksLikeCliCode(directToken)) {
+        // sign in with the code first, then mint from that real login
+        const exchanged = await exchangeCliCodeAndSave(directToken, { asJson, note: CODE_NOT_TOKEN_NOTE, quiet: true });
+        if (exchanged !== 0) process.exit(exchanged);
+      } else if (directToken) {
         saveCredentials(
           String(directToken).trim(),
           existing?.refresh_token || null,
@@ -658,7 +764,26 @@ async function loginAtris(options = {}) {
       process.exit(code);
     }
 
+    // One-time code from the browser, no prompt: --code <code>, --code=<code>,
+    // or --code - to read it from stdin. An explicit code means sign in now,
+    // even over an existing login.
+    const codeFlagPresent = args.some((arg) => arg === '--code' || String(arg).startsWith('--code='));
+    if (codeFlagPresent) {
+      let code = readCodeFlag(args);
+      if (!code) code = await readPipedLoginInput(5000);
+      if (!code) {
+        const error = 'no code given.';
+        if (asJson) console.log(JSON.stringify({ ok: false, logged_in: false, error, next: 'atris login --code <code>' }, null, 2));
+        else { console.error(`Error: ${error}`); headlessLoginHelp().forEach((line) => console.error(line)); }
+        process.exit(1);
+      }
+      process.exit(await exchangeCliCodeAndSave(code, { asJson }));
+    }
+
     // Direct token mode (non-interactive)
+    if (directToken && looksLikeCliCode(directToken)) {
+      process.exit(await exchangeCliCodeAndSave(directToken, { asJson, note: CODE_NOT_TOKEN_NOTE }));
+    }
     if (directToken) {
       const trimmed = directToken.trim();
       saveCredentials(trimmed, null, existing?.email || null, existing?.user_id || null, existing?.provider || 'manual');
@@ -675,6 +800,13 @@ async function loginAtris(options = {}) {
       process.exit(0);
     }
 
+    // echo <code> | atris login signs in with no terminal, over an existing
+    // login too. Read once here so the shortcut below cannot swallow it.
+    const piped = (!process.stdin.isTTY && !directToken) ? await readPipedLoginInput() : '';
+    if (piped && looksLikeCliCode(piped)) {
+      process.exit(await exchangeCliCodeAndSave(piped, { asJson }));
+    }
+
     // Already signed in without --force: behave like whoami (no menu).
     // Print local identity without waiting on the network so headless agents
     // never hang on a stale token validation.
@@ -706,13 +838,17 @@ async function loginAtris(options = {}) {
         console.log(JSON.stringify({
           ok: false,
           logged_in: false,
-          error: 'login requires --token in non-interactive mode',
-          next: 'atris login --token <token>',
+          error: piped
+            ? 'what came in on stdin is not a one-time code from the browser'
+            : 'login has no terminal here. pass the one-time code from the browser.',
+          next: 'atris login --code <code>',
+          code_url: `${getAppBaseUrl()}/auth/cli`,
+          agents: 'atris login --client-id <atc_...> --client-secret-file <path>',
         }, null, 2));
       } else {
         console.log('Not signed in.');
-        console.log('login needs a terminal for browser OAuth, or pass a token.');
-        console.log('Next: atris login --token <token>');
+        if (piped) console.log('what came in on stdin is not a one-time code from the browser. for an API token use --token.');
+        headlessLoginHelp().forEach((line) => console.log(line));
       }
       process.exit(1);
     }
@@ -723,7 +859,7 @@ async function loginAtris(options = {}) {
 
     console.log('Choose login method:');
     console.log('  1. Browser OAuth (recommended)');
-    console.log('  2. Paste existing API token');
+    console.log('  2. Paste an API token');
     console.log('  3. Cancel');
 
     const methodChoice = await promptUser('\nEnter choice (1-3): ');
@@ -743,39 +879,17 @@ async function loginAtris(options = {}) {
         process.exit(1);
       }
 
-      const exchange = await apiRequestJson('/auth/cli/exchange', {
-        method: 'POST',
-        body: { code: code.trim() },
-      });
-
-      if (!exchange.ok || !exchange.data) {
-        console.error(`Error: ${exchange.error || 'Invalid or expired code'}`);
-        process.exit(1);
-      }
-
-      const payload = exchange.data;
-      const token = payload.token;
-      const refreshToken = payload.refresh_token;
-
-      if (!token || !refreshToken) {
-        console.error('Error: Backend did not return tokens. Try again.');
-        process.exit(1);
-      }
-
-      const email = payload.email || null;
-      const userId = payload.user_id || null;
-      const provider = payload.provider || 'atris';
-
-      saveCredentials(token, refreshToken, email, userId, provider);
-      const name = profileNameFromEmail(email);
-      console.log(`\n✓ Signed in as ${email || 'unknown'}${name ? ` (profile: ${name})` : ''}`);
-      await displayAccountSummary(apiRequestJson);
-      process.exit(0);
+      process.exit(await exchangeCliCodeAndSave(code));
     } else if (methodChoice === '2') {
-      console.log('\nGet your token from: https://atris.ai/auth/cli\n');
+      console.log('\nPaste an API token (starts with atris_) or a saved session token.');
+      console.log('The one-time code from the browser works here too.\n');
 
       const tokenInput = await promptUser('API token: ', { secret: true });
 
+      if (tokenInput && looksLikeCliCode(tokenInput)) {
+        process.exit(await exchangeCliCodeAndSave(tokenInput, { note: CODE_NOT_TOKEN_NOTE }));
+      }
+
       if (!tokenInput) {
         console.error('Error: Token is required.');
         process.exit(1);

package/commands/campaign.js

@@ -821,7 +821,9 @@ async function driveLoop(args, ctx, verb, view) {
   if (verb === 'propose') {
     const proposals = await loop.propose(view.id);
     const after = getCampaign(ctx.store, view.id);
-    ctx.out(proposals.length ? `${proposals.length} proposed and claimed\n${renderShow(after)}` : 'nothing usable was proposed', { ok: proposals.length > 0, proposals, campaign: after, next: decide(after) });
+    const stall = proposals.length ? null : loop.lastStall();
+    const empty = stall ? `nothing usable was proposed: ${stall.line}` : 'nothing usable was proposed';
+    ctx.out(proposals.length ? `${proposals.length} proposed and claimed\n${renderShow(after)}` : empty, { ok: proposals.length > 0, proposals, campaign: after, next: decide(after), ...(stall ? { engine: stall.engine, cause: stall.kind, next_step: stall.next } : {}) });
     return proposals.length ? 0 : 1;
   }
   if (verb === 'step') {