@gloom-sh/terminal 0.19.2 → 0.19.3

package/src/cli/commands/system.ts

@@ -1,6 +1,6 @@
 import { join } from "path";
 import { logFailure } from "../../utils/log-failure";
-import { VERSION } from "../../version";
+import { versionCommand } from "./version";
 import { saveConfig } from "../../data/config/store";
 import { builtinPluginGroupMembers } from "../../plugins/ownership";
 import type { AppConfig, TelemetryConfig } from "../../types/config";
@@ -9,7 +9,7 @@ import { readBaseCurrency } from "../../utils/base-currency";
 import { NIGHTLY_CHANNEL_SUMMARY, parseUpdateChannel, withUpdateChannel } from "../../updater/channel";
 import type { CliCommandDef } from "../../types/plugin";
 import type { BuiltinCliCommandDef } from "../command-options";
-import { resolveCliDataDir, withCliServices, withConfigData } from "../context";
+import { withCliServices, withConfigData } from "../context";
 import { CLI_COMMAND_GROUPS } from "../help";
 import { dryRunNote, formatBytes, formatStatusCell } from "../helpers";
 import { cliStyles, cliTerminalWidth, renderSection, renderTable, wrapText } from "../../utils/cli-output";
@@ -97,6 +97,21 @@ function describeTimezone(value: unknown): string {
   return typeof value === "string" && value ? value : "not set, times print in UTC alone";
 }
 
+/** What `config get telemetry.attention` prints while the setting is untouched. */
+const ATTENTION_DEFAULT = "default";
+
+/**
+ * Attention Counts as set, not as "on": unset is the default, which counts an
+ * account only once the app has shown it its notice, so it is not `true`.
+ */
+function attentionSetting(telemetry: TelemetryConfig | undefined): boolean | typeof ATTENTION_DEFAULT {
+  return telemetry?.attention ?? ATTENTION_DEFAULT;
+}
+
+function describeAttentionSetting(value: unknown): string {
+  return value === ATTENTION_DEFAULT ? "default: on once the app has shown its notice" : describeConfigValue(value);
+}
+
 function describeConfigValue(value: unknown): string {
   if (value == null) return "nothing";
   if (Array.isArray(value)) return value.length > 0 ? value.join(", ") : "nothing";
@@ -174,32 +189,6 @@ function resourceCacheStats(
 }
 
 export function createSystemCliCommands(): CliCommandDef[] {
-  const versionCommand: CliCommandDef = {
-    name: "version",
-    aliases: ["--version", "-v"],
-    description: "Print the version, runtime, and data folder",
-    help: { group: CLI_COMMAND_GROUPS.app, usage: ["version"] },
-    execute: async (_args, ctx) => {
-      // Where the data lives, or will once a command or the app first runs:
-      // printing the version never creates the folder.
-      let dataDir: string | null = null;
-      try {
-        dataDir = await resolveCliDataDir();
-      } catch (error) {
-        logFailure("cli-system", "Resolve data directory failed")(error);
-        dataDir = null;
-      }
-      ctx.printResult({
-        data: [{
-          version: VERSION,
-          bun: typeof Bun === "undefined" ? null : Bun.version,
-          platform: process.platform,
-          arch: process.arch,
-          dataDir,
-        }],
-      }, { layout: "record" });
-    },
-  };
 
   const doctorCommand: CliCommandDef = {
     name: "doctor",
@@ -259,6 +248,7 @@ export function createSystemCliCommands(): CliCommandDef[] {
         "config set theme <id>",
         "config set telemetry.crashReports false",
         "config set telemetry.usage false",
+        "config set telemetry.attention false",
         "config set starPrompt.enabled false",
         "config set timezone <Region/City>|none",
         "config set updates.channel stable|nightly",
@@ -333,7 +323,7 @@ export function createSystemCliCommands(): CliCommandDef[] {
           valueFlashingEnabled: context.config.valueFlashingEnabled,
           "telemetry.crashReports": context.config.telemetry?.crashReports !== false,
           "telemetry.usage": context.config.telemetry?.usage !== false,
-          "telemetry.attention": context.config.telemetry?.attention === true,
+          "telemetry.attention": attentionSetting(context.config.telemetry),
           [STAR_PROMPT_CONFIG_KEY]: context.config.starPrompt?.enabled !== false,
           [TIMEZONE_CONFIG_KEY]: context.config.timezone ?? null,
           [UPDATE_CHANNEL_CONFIG_KEY]: context.config.updates?.channel ?? "stable",
@@ -348,6 +338,7 @@ export function createSystemCliCommands(): CliCommandDef[] {
               ...(key === "theme" ? { format: (value: unknown) => describeThemeId(String(value)) } : {}),
               ...(key === TIMEZONE_CONFIG_KEY ? { format: describeTimezone } : {}),
               ...(key === "baseCurrency" ? { format: describeBaseCurrency } : {}),
+              ...(key === "telemetry.attention" ? { format: describeAttentionSetting } : {}),
             })),
           });
           return;
@@ -367,7 +358,8 @@ export function createSystemCliCommands(): CliCommandDef[] {
           ctx.printResult({ data: { key, value: safeConfig[key] } }, {
             text: (data) => key === KEYBINDINGS_CONFIG_KEY ? renderKeybindings(data.value)
               : key === TIMEZONE_CONFIG_KEY ? describeTimezone(data.value)
-                : key === "baseCurrency" ? describeBaseCurrency(data.value) : describeConfigValue(data.value),
+                : key === "baseCurrency" ? describeBaseCurrency(data.value)
+                  : key === "telemetry.attention" ? describeAttentionSetting(data.value) : describeConfigValue(data.value),
           });
           return;
         }

package/src/cli/commands/ticker.ts

@@ -72,6 +72,8 @@ import {
   quoteChangeText,
 } from "../helpers";
 import { NotesFiles } from "../../plugins/builtin/notes/files";
+import { getFormDescription } from "../../plugins/builtin/sec/model";
+import { rowSummary, rowSummaryTarget } from "../../plugins/builtin/sec/row-summaries";
 import { isKnownNonUsListing, secFilingItemCodes, US_FUND_FACTS_ONLY } from "../../utils/sec";
 import { currentReportItemsLabel, hiddenFilingsNote, loadLatestFilings, type HiddenFilings } from "../../utils/sec-filings";
 import { canonicalExchange, exchangeLabel, isKnownExchangeCode, isUsListingExchange } from "../../utils/exchanges";
@@ -80,6 +82,7 @@ import {
   resolveCliListing, type CliListing, type ListingDataRequest,
 } from "../listing-arg";
 import { movedAwayChange } from "../../tickers/ticker-changes";
+import { listingChangeLine } from "../../tickers/listing-fate";
 import { companyMemberships, loadCompanyMemberships, type CompanyMemberships, type ListMembership } from "../issuer-membership";
 import { isNotATickerMessage } from "../not-a-ticker";
 import { sharesOutstandingInReceipts } from "../../utils/depositary-receipt";
@@ -305,6 +308,34 @@ function normalizeComparable(value: string): string {
   return value.toUpperCase().replace(/\bFORM\b/g, "").replace(/[^A-Z0-9]+/g, "");
 }
 
+/** A recent filing with what an insider form's own XML says: who filed it and what it reports (`rowSummary`). */
+type RecentFiling = SecFilingItem & { summary?: string };
+
+/**
+ * The recent filings, each insider form (3, 4, 5, 144) with its filer and what it reports, read from the
+ * filing as fn SEC's rows read it: "Fred Thiel: sale of 50K shares". A filing that cannot be read keeps its
+ * form's meaning alone.
+ */
+async function withFilingSummaries(
+  filings: readonly SecFilingItem[],
+  dataProvider: { getSecFilingContent?(filing: SecFilingItem): Promise<string | null> },
+): Promise<RecentFiling[]> {
+  if (!dataProvider.getSecFilingContent) return [...filings];
+  return Promise.all(filings.map(async (filing) => {
+    const target = rowSummaryTarget(filing);
+    if (!target) return filing;
+    const content = await Promise.resolve().then(() => dataProvider.getSecFilingContent!(target))
+      .catch(logFailure("cli.commands-ticker", "Read an insider filing failed", null));
+    const summary = rowSummary(filing.form, content)?.title;
+    return summary ? { ...filing, summary } : filing;
+  }));
+}
+
+/** What the form is: the filing's own description, else the form's meaning ("Insider Transaction"); none beside an 8-K's items. */
+function filingMeaning(filing: SecFilingItem): string {
+  return getFilingDescription(filing) ?? (currentReportItemsLabel(filing.items) ? "" : getFormDescription(filing.form));
+}
+
 function getFilingDescription(filing: SecFilingItem): string | undefined {
   const description = filing.primaryDocDescription?.trim();
   if (!description) return undefined;
@@ -1117,7 +1148,7 @@ export async function buildTickerReport({
   /** "CAR = Avis Budget Group, NASDAQ (different companies on XETRA, ASX)", for a bare symbol several companies list. */
   listingNote?: string;
   recentNews?: NewsArticle[];
-  recentSecFilings?: SecFilingItem[];
+  recentSecFilings?: RecentFiling[];
   /** What `recentSecFilings` left out. */
   hiddenSecFilings?: HiddenFilings;
 }): Promise<string> {
@@ -1226,6 +1257,8 @@ export async function buildTickerReport({
       )
       : "—";
     const volume = reportedQuoteVolume(quote);
+    // A coin's volume is traded value in its quote currency (BTC-USD: US dollars), not a count of coins.
+    const volumeCurrency = quote.currency && isRoundTheClockCoin(quote.symbol ?? symbol, quote.exchangeName) ? ` ${quote.currency}` : "";
     // A futures price is its latest trade; the exchange settlement is its own row, dated by its session.
     appendMetricSection(lines, "Quote", [
       // A price in cents says what it is per: 314.95¢/lb.
@@ -1247,7 +1280,7 @@ export async function buildTickerReport({
         : "—"],
       ["Bid / Ask", bidAskText(quote, quoteOptions)],
       // An index's and a perpetual's 0 means none is counted, not no trades: no Volume row.
-      ["Volume", volume != null ? formatNumber(volume, 0) : "—"],
+      ["Volume", volume != null ? `${formatNumber(volume, 0)}${volumeCurrency}` : "—"],
       ["Updated", formatTimestamp(quoteHeadlineTime(quote))],
     ]);
 
@@ -1338,9 +1371,10 @@ export async function buildTickerReport({
     meta: [
       // The items by number and name, so a results 8-K reads apart from another 8-K filed the same day.
       filingItemsMeta(filing),
-      getFilingDescription(filing) ?? "",
-      filing.primaryDocument ? `Primary Document ${filing.primaryDocument}` : "",
+      // What the form is, and below it who filed an insider form and what it reports: the file name said neither.
+      filingMeaning(filing),
     ],
+    body: filing.summary,
     link: filing.filingUrl,
   })), hiddenFilingsNote(hiddenSecFilings));
 
@@ -1384,7 +1418,7 @@ function buildTickerStructuredData({
   config: AppConfig;
   notes: string;
   recentNews: NewsArticle[];
-  recentSecFilings: SecFilingItem[];
+  recentSecFilings: RecentFiling[];
   hiddenSecFilings: HiddenFilings;
 }) {
   const quote = financials.quote;
@@ -1472,6 +1506,8 @@ function buildTickerStructuredData({
       filingUrl: filing.filingUrl,
       primaryDocumentUrl: filing.primaryDocumentUrl ?? "",
       description: getFilingDescription(filing) ?? "",
+      // An insider form's filer and what it reports, as the text report shows it.
+      summary: filing.summary ?? "",
       items: secFilingItemCodes(filing.items) ?? "",
       // The items by number and name, as the text report shows them.
       itemsLabel: currentReportItemsLabel(filing.items) ?? "",
@@ -1524,7 +1560,7 @@ export async function ticker(symbol: string, dependencies: TickerCommandDependen
     // So does what became of the symbol, read from the research's quote as `history` reads it: a
     // company that moved (HFC became DINO), with nothing new listed there, has no profile of its own.
     const researchQuote = Promise.withResolvers<Quote | null>();
-    const fate = listingFateLoader(listing, { dataProvider }, researchQuote.promise);
+    const fate = listingFateLoader(listing, { dataProvider }, researchQuote.promise, { successor: true });
     const request: ListingDataRequest = { command: "ticker", noun: "research", fate };
     /** Nothing to show: a company that moved is under its new symbol. */
     const failIfMovedAway = async () => {
@@ -1568,8 +1604,8 @@ export async function ticker(symbol: string, dependencies: TickerCommandDependen
     const quote = resolvedFinancials.quote;
     // The quote is the old line's (stopped, or named for the company that left): the profile and figures are another security's.
     researchQuote.resolve(quote ?? null);
-    const { moved } = await fate();
-    if (moved) failMovedSymbol(moved, request);
+    const researchFate = await fate();
+    if (researchFate.moved) failMovedSymbol(researchFate.moved, request);
 
     const notesFiles = new NotesFiles(dataDir);
     const listingName = listingIdentity(listing, quote).name;
@@ -1630,14 +1666,18 @@ export async function ticker(symbol: string, dependencies: TickerCommandDependen
       (currency) => dataProvider.getExchangeRate(currency));
     const notes = notesResult.status === "fulfilled" ? notesResult.value : "";
     const recentNews = newsResult.status === "fulfilled" ? newsResult.value : [];
-    const { filings: recentSecFilings, hidden: hiddenSecFilings } = secFilingsResult.status === "fulfilled"
+    const { filings: secFilings, hidden: hiddenSecFilings } = secFilingsResult.status === "fulfilled"
       ? secFilingsResult.value : { filings: [], hidden: NOTHING_HIDDEN };
+    const recentSecFilings = await withFilingSummaries(secFilings, dataProvider);
 
     // The quote is the feed in this report; without one, the fundamentals date it.
     const freshness = quote ? quotesFreshness([quote]) : fundamentalsFreshness(resolvedFinancials);
     const quoteNote = quote ? undefined : await quoteUnavailableNote(dataProvider, requestSymbol, exchange);
     // A bare coin ticker read as another listing says where the coin is, as `quote` does: from the quote, else from the saved listing.
+    const successor = listingChangeLine(researchFate);
     const choiceNotes = [
+      // What became of the company that had the symbol (GOGL), as `quote` says it, then the listing it was read as.
+      ...successor ? [successor] : [],
       ...await listingChoiceNotes(listing, { store, dataProvider }, quote, venues),
       ...quote || !tickerFile ? [] : coinListingNotes(listing, { name: tickerFile.metadata.name, instrumentType: tickerFile.metadata.assetCategory }),
     ];

package/src/cli/commands/version.ts

@@ -0,0 +1,33 @@
+import { VERSION } from "../../version";
+import { logFailure } from "../../utils/log-failure";
+import type { CliCommandContext, CliCommandDef } from "../../types/plugin";
+import { resolveCliDataDir } from "../data-dir";
+import { CLI_COMMAND_GROUPS } from "../help";
+
+/** Shared by the early entry point and the command registry. */
+export async function printVersion(printResult: CliCommandContext["printResult"]): Promise<void> {
+  // Reading the version never creates the data folder.
+  let dataDir: string | null = null;
+  try {
+    dataDir = await resolveCliDataDir();
+  } catch (error) {
+    logFailure("cli-system", "Resolve data directory failed")(error);
+  }
+  printResult({
+    data: [{
+      version: VERSION,
+      bun: typeof Bun === "undefined" ? null : Bun.version,
+      platform: process.platform,
+      arch: process.arch,
+      dataDir,
+    }],
+  }, { layout: "record" });
+}
+
+export const versionCommand: CliCommandDef = {
+  name: "version",
+  aliases: ["--version", "-v"],
+  description: "Print the version, runtime, and data folder",
+  help: { group: CLI_COMMAND_GROUPS.app, usage: ["version"] },
+  execute: (_args, ctx) => printVersion(ctx.printResult),
+};

package/src/cli/context.ts

@@ -9,8 +9,7 @@ import { createAppServices } from "../core/app-services";
 import type { PluginCapability } from "../capabilities";
 import type { AppConfig } from "../types/config";
 import type { GloomPlugin } from "../types/plugin";
-import { getLoadablePlugins } from "../plugins/catalog";
-import { standaloneSeriesCatalog, standaloneSeriesInvoker } from "../series/standalone";
+import { standaloneSeriesCatalog, standaloneSeriesInvoker, standaloneSeriesNamed } from "../series/standalone";
 import type { PluginRegistry } from "../plugins/registry";
 import type { LoadedExternalPlugin } from "../plugins/loader";
 import { apiClient } from "../api-client";
@@ -73,11 +72,6 @@ function isUnreadableConfig(configFile: string): boolean {
   }
 }
 
-/** The data folder this profile uses, whether or not anything has created it yet. Never writes. */
-export async function resolveCliDataDir(): Promise<string> {
-  return await getDataDir() ?? getGloomberbDirs().data;
-}
-
 /**
  * The data folder and config a command works with. The first command on a new
  * profile creates them with the same `initDataDir` a first launch of the
@@ -120,7 +114,7 @@ function applyPersistedCloudSession(context: Pick<MarketContext, "persistence">)
 export async function initMarketData(options: CliContextOptions = {}): Promise<MarketContext> {
   const context = await initConfigData();
   applyPersistedCloudSession(context);
-  const plugins = options.plugins ?? getLoadablePlugins();
+  const plugins = options.plugins ?? (require("../plugins/catalog") as typeof import("../plugins/catalog")).getLoadablePlugins();
   const capabilities = resolveCliCapabilities(context.config, plugins);
   const dataProvider = new AssetDataRouter(null, [], context.persistence.resources);
   const registryAdapter: Pick<PluginRegistry, "brokers" | "getEnabledCapabilities"> = {
@@ -132,10 +126,12 @@ export async function initMarketData(options: CliContextOptions = {}): Promise<M
   dataProvider.setBackgroundRevalidation(false);
   const seriesCapabilities = standaloneSeriesInvoker(plugins, context.dataDir, context.config.disabledPlugins);
   const findCatalogSeries = standaloneSeriesCatalog(plugins, context.config.disabledPlugins);
-  return { ...context, dataProvider, seriesCapabilities, findCatalogSeries, statementSources: cloudStatementReportSources };
+  const findCatalogSeriesNamed = standaloneSeriesNamed(plugins, context.config.disabledPlugins);
+  return { ...context, dataProvider, seriesCapabilities, findCatalogSeries, findCatalogSeriesNamed, statementSources: cloudStatementReportSources };
 }
 
 export async function initCliServices(options: CliServicesOptions = {}) {
+  const { getLoadablePlugins } = require("../plugins/catalog") as typeof import("../plugins/catalog");
   const { dataDir, config, created } = await openCliDataDir();
   const services = createAppServices({
     config,

package/src/cli/data-dir.ts

@@ -0,0 +1,7 @@
+import { getDataDir } from "../data/config/store";
+import { getGloomberbDirs } from "../data/config/home";
+
+/** The data folder this profile uses, whether or not anything has created it yet. Never writes. */
+export async function resolveCliDataDir(): Promise<string> {
+  return await getDataDir() ?? getGloomberbDirs().data;
+}

package/src/cli/desktop-pane-shot-api-policy.ts

@@ -0,0 +1,85 @@
+/**
+ * Which Gloom Cloud requests the pane screenshot page may send through its
+ * local proxy, which adds the user's session (desktop-pane-shot.ts). The page
+ * only draws panes, so it gets the reads panes make and nothing that acts on
+ * the account: no sign-in or sign-out, billing, keys, chat, sync or sharing,
+ * and no write of any kind.
+ */
+
+/** The API families panes read their data from. */
+const READ_FAMILIES = /^\/(?:cloud|market|news|public|research)(?:\/|$)/;
+/** Auth routes inside a read family. */
+const AUTH_IN_FAMILY = /^\/cloud\/auth(?:\/|$)/;
+/**
+ * Reads outside those families that panes make, none of whose answers holds a
+ * credential, token or key: the session and plan an access gate reads (the
+ * session cut to its user, see `isShotSessionPath`), plan prices, the service
+ * probe, the roadmap, the layout gallery (marketplace and team layouts),
+ * theses, and a signed-in broker's catalog, connection status, holdings,
+ * orders and fills.
+ */
+const READ_PATHS = [
+  /^\/auth\/get-session$/,
+  /^\/account\/cloud$/,
+  /^\/pricing$/,
+  /^\/health$/,
+  /^\/roadmap$/,
+  /^\/layouts(?:\/[^/]+)?$/,
+  /^\/teams\/[^/]+\/layouts$/,
+  /^\/theses(?:\/[^/]+)?$/,
+  /^\/brokers\/connectors$/,
+  /^\/brokers\/[a-z][a-z0-9-]{0,31}(?:\/(?:snapshot|orders|executions))?$/,
+];
+/** Reads sent as a POST because their query is a list: batches, scans and analyses. */
+const READ_POSTS = new Set([
+  "/cloud/exposure/analyze",
+  "/cloud/perps/equities",
+  "/market/financials/batch",
+  "/market/history/batch",
+  "/market/organization-tickers",
+  "/market/quotes/batch",
+  "/market/scanner/live",
+  "/market/search/batch",
+  "/market/ticker-changes/batch",
+  "/research/equity-diagnostic",
+]);
+
+/**
+ * The path as a server could read it: decoded and lower-cased, so an escaped
+ * letter or another case cannot step past a check. Null for one that steps up
+ * a folder or holds a backslash once decoded, which is refused rather than
+ * trusted to reach the server as the path it was checked as. An encoded slash
+ * inside a segment (a symbol such as `EUR/USD`) is fine.
+ */
+function readablePath(path: string): string | null {
+  if (!path.startsWith("/") || path.includes("//")) return null;
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(path);
+  } catch {
+    // Intentional ignore: a path that does not decode is refused outright, never sent on.
+    return null;
+  }
+  if (decoded.includes("\\") || decoded.split("/").some((segment) => segment === "." || segment === "..")) return null;
+  return decoded.toLowerCase();
+}
+
+/**
+ * Whether the page may send `method` to the API path `path` (the part after
+ * the API's base, query excluded). A batch read sent as POST must be named
+ * exactly, with nothing escaped.
+ */
+export function isShotApiRequestAllowed(method: string, path: string): boolean {
+  const readable = readablePath(path);
+  if (readable === null) return false;
+  const verb = method.toUpperCase();
+  if (verb === "POST") return READ_POSTS.has(path);
+  if (verb !== "GET" && verb !== "HEAD") return false;
+  if (READ_PATHS.some((pattern) => pattern.test(readable))) return true;
+  return READ_FAMILIES.test(readable) && !AUTH_IN_FAMILY.test(readable);
+}
+
+/** The session read, whose answer also carries the session's token: the proxy hands the page its user alone. */
+export function isShotSessionPath(path: string): boolean {
+  return readablePath(path) === "/auth/get-session";
+}