gloomberb 0.13.1 → 0.13.3

package/README.md

@@ -62,6 +62,8 @@ curl -fsSL gloom.sh/install | bash
 
 Both install `Gloomberb.app` and a `gloomberb` command that runs the TUI through the app bundle, so the bundled runtime is stored once.
 
+`Gloomberb.app` is Apple Silicon (arm64) only. On an Intel Mac the install script installs the standalone `gloomberb` terminal app instead, and the Homebrew cask refuses to install rather than leaving an app that cannot launch.
+
 Prefer a direct download?
 
 - [Download Gloomberb for Mac](https://gloom.sh/download/desktop)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gloomberb",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "packageManager": "bun@1.3.11",
   "description": "Market research and portfolio tracker for the terminal",
   "module": "src/index.tsx",

package/src/api-client/index.test.ts

@@ -264,6 +264,40 @@ describe("apiClient auth cookies", () => {
     ]);
   });
 
+  test("ignores a stale response cookie after the session credential changes", async () => {
+    let releaseResponse: (() => void) | null = null;
+    let markRequestStarted: (() => void) | null = null;
+    const requestStarted = new Promise<void>((resolve) => {
+      markRequestStarted = resolve;
+    });
+
+    apiClient.setSessionToken("old-session.value");
+    setCloudApiFetchTransport(async () => {
+      markRequestStarted?.();
+      await new Promise<void>((resolve) => {
+        releaseResponse = resolve;
+      });
+      return createResponse({
+        channels: [],
+        onlineCount: 0,
+        channelStates: [],
+        notifications: [],
+      }, {
+        cookies: [
+          "__Secure-gloomberb.session_token=old-session.value; Path=/; HttpOnly; Secure; SameSite=None",
+        ],
+      });
+    });
+
+    const staleRequest = apiClient.getChatState();
+    await requestStarted;
+    apiClient.setSessionToken("new-session.value");
+    releaseResponse?.();
+    await staleRequest;
+
+    expect(apiClient.getSessionToken()).toBe("new-session.value");
+  });
+
   test("uses an installed cloud API fetch transport for auth cookie capture", async () => {
     const seenCookies: Array<string | null> = [];
     globalThis.fetch = mockFetch(async () => {

package/src/api-client/request.ts

@@ -141,6 +141,7 @@ export class CloudApiRequestTransport {
       headers.set("Content-Type", "application/json");
     }
     this.setSessionCookieHeader(headers);
+    const sessionTokenAtRequestStart = this.sessionToken;
     headers.set("Origin", this.baseUrl);
 
     const operation = `${options?.method ?? "GET"} ${path.split("?")[0]}`;
@@ -151,7 +152,9 @@ export class CloudApiRequestTransport {
         credentials: "include",
       });
       throwIfRequestAborted(options?.signal);
-      this.extractSessionCookie(res);
+      if (this.sessionToken === sessionTokenAtRequestStart) {
+        this.extractSessionCookie(res);
+      }
       const text = await res.text();
       throwIfRequestAborted(options?.signal);
 

package/src/cli/desktop-pane-shot.ts

@@ -56,6 +56,33 @@ export interface DesktopPaneShotApiProxy {
   sessionToken: string | null;
 }
 
+/**
+ * The page renders panes that fetch their own data. Left alone it can only
+ * reach the cloud API, so a pane whose values come from a provider the router
+ * merges in (analyst price targets, Yahoo dividends) rendered thinner than the
+ * same pane in the terminal. The bridge lets the page ask the Bun process to
+ * run those requests through the real provider router instead.
+ */
+export interface DesktopPaneShotBridge {
+  marketData(operation: string, args: unknown[]): Promise<unknown>;
+  httpFetch(request: DesktopPaneShotHttpRequest): Promise<DesktopPaneShotHttpResponse>;
+}
+
+export interface DesktopPaneShotHttpRequest {
+  url: string;
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+}
+
+export interface DesktopPaneShotHttpResponse {
+  status: number;
+  statusText: string;
+  headers: Record<string, string>;
+  setCookie: string[];
+  body: string;
+}
+
 export interface DesktopPaneShotRenderedCell {
   columnId?: string;
   columnLabel: string;
@@ -109,13 +136,15 @@ const SHOT_READY_TIMEOUT_MS = 45_000;
 const CDP_CALL_TIMEOUT_MS = 10_000;
 const DEFAULT_DEVICE_SCALE_FACTOR = 2;
 const SHOT_API_PROXY_PREFIX = "/__gloom_cli_api__";
+export const SHOT_MARKET_BRIDGE_PATH = "/__gloom_cli_market__";
+export const SHOT_HTTP_BRIDGE_PATH = "/__gloom_cli_http__";
 const SESSION_COOKIE_NAMES = ["__Secure-gloomberb.session_token", "gloomberb.session_token"] as const;
 
 export async function renderDesktopPaneScreenshot(
   payload: DesktopPaneShotPayload,
   outputPath: string,
   apiProxy: DesktopPaneShotApiProxy,
-  options: { captureImage?: boolean } = {},
+  options: { captureImage?: boolean; bridge?: DesktopPaneShotBridge } = {},
 ): Promise<DesktopPaneShotRenderResult> {
   const tempDir = await mkdtemp(join(tmpdir(), "gloom-pane-shot-"));
   let server: ReturnType<typeof Bun.serve> | null = null;
@@ -123,7 +152,7 @@ export async function renderDesktopPaneScreenshot(
     const outdir = join(tempDir, "assets");
     await mkdir(outdir, { recursive: true });
     await buildShotPage(outdir, payload);
-    server = serveShotPage(outdir, apiProxy);
+    server = serveShotPage(outdir, apiProxy, options.bridge ?? null);
     const chrome = await findChromeExecutable();
     return await capturePageScreenshot({
       chrome,
@@ -183,6 +212,7 @@ async function buildShotPage(outdir: string, payload: DesktopPaneShotPayload): P
 function serveShotPage(
   outdir: string,
   apiProxy: DesktopPaneShotApiProxy,
+  bridge: DesktopPaneShotBridge | null,
 ): ReturnType<typeof Bun.serve> {
   const staticRoot = resolve(outdir);
   return Bun.serve({
@@ -194,11 +224,51 @@ function serveShotPage(
       if (url.pathname.startsWith(`${SHOT_API_PROXY_PREFIX}/`)) {
         return proxyShotApiRequest(request, url, apiProxy);
       }
+      if (url.pathname === SHOT_MARKET_BRIDGE_PATH) {
+        return runShotMarketBridge(request, bridge);
+      }
+      if (url.pathname === SHOT_HTTP_BRIDGE_PATH) {
+        return runShotHttpBridge(request, bridge);
+      }
       return serveShotAsset(url, staticRoot);
     },
   });
 }
 
+async function runShotMarketBridge(
+  request: Request,
+  bridge: DesktopPaneShotBridge | null,
+): Promise<Response> {
+  if (!bridge) return Response.json({ ok: false, error: "No market bridge" }, { status: 404 });
+  try {
+    const payload = await request.json() as { operation?: unknown; args?: unknown };
+    const operation = typeof payload.operation === "string" ? payload.operation : "";
+    const args = Array.isArray(payload.args) ? payload.args : [];
+    const data = await bridge.marketData(operation, args);
+    return Response.json({ ok: true, data });
+  } catch (error) {
+    return Response.json({ ok: false, error: errorMessage(error) });
+  }
+}
+
+async function runShotHttpBridge(
+  request: Request,
+  bridge: DesktopPaneShotBridge | null,
+): Promise<Response> {
+  if (!bridge) return Response.json({ ok: false, error: "No HTTP bridge" }, { status: 404 });
+  try {
+    const payload = await request.json() as DesktopPaneShotHttpRequest;
+    const data = await bridge.httpFetch(payload);
+    return Response.json({ ok: true, data });
+  } catch (error) {
+    return Response.json({ ok: false, error: errorMessage(error) });
+  }
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
 async function serveShotAsset(url: URL, staticRoot: string): Promise<Response> {
   let pathname: string;
   try {

package/src/cli/pane-functions/cloud-session.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "bun:test";
+import { apiClient } from "../../api-client";
+import type { MarketContext } from "../types";
+import {
+  resolvePersistedCloudSessionToken,
+  withPersistedCloudSession,
+} from "./cloud-session";
+
+function contextWithSession(
+  key: string,
+  sessionToken: string,
+): Pick<MarketContext, "persistence"> {
+  return {
+    persistence: {
+      pluginState: {
+        get: (_pluginId: string, candidate: string) => candidate === key
+          ? { value: { sessionToken }, schemaVersion: 1, updatedAt: 1 }
+          : null,
+      },
+    },
+  } as Pick<MarketContext, "persistence">;
+}
+
+describe("pane function Cloud session", () => {
+  test("restores the current and legacy persisted session keys", () => {
+    expect(resolvePersistedCloudSessionToken(
+      contextWithSession("resume:session", "current-session"),
+    )).toBe("current-session");
+    expect(resolvePersistedCloudSessionToken(
+      contextWithSession("session", "legacy-session"),
+    )).toBe("legacy-session");
+  });
+
+  test("scopes the persisted session to one report load", async () => {
+    const initial = apiClient.getSessionToken();
+    apiClient.setSessionToken("previous-session");
+    try {
+      let activeSession: string | null = null;
+      const result = await withPersistedCloudSession(
+        contextWithSession("resume:session", "report-session"),
+        async () => {
+          activeSession = apiClient.getSessionToken();
+          return 42;
+        },
+      );
+
+      expect(result).toBe(42);
+      expect(activeSession).toBe("report-session");
+      expect(apiClient.getSessionToken()).toBe("previous-session");
+    } finally {
+      apiClient.setSessionToken(initial);
+    }
+  });
+});
+
+describe("cloud session token from the environment", () => {
+  test("prefers GLOOMBERB_SESSION_TOKEN over persisted state so containers can authenticate", () => {
+    const context = {
+      persistence: {
+        pluginState: {
+          get: () => ({ value: { sessionToken: "persisted-token" } }),
+        },
+      },
+    } as unknown as Parameters<typeof resolvePersistedCloudSessionToken>[0];
+
+    const previous = process.env.GLOOMBERB_SESSION_TOKEN;
+    try {
+      process.env.GLOOMBERB_SESSION_TOKEN = "env-token";
+      expect(resolvePersistedCloudSessionToken(context)).toBe("env-token");
+      delete process.env.GLOOMBERB_SESSION_TOKEN;
+      expect(resolvePersistedCloudSessionToken(context)).toBe("persisted-token");
+    } finally {
+      if (previous === undefined) delete process.env.GLOOMBERB_SESSION_TOKEN;
+      else process.env.GLOOMBERB_SESSION_TOKEN = previous;
+    }
+  });
+});

package/src/cli/pane-functions/cloud-session.ts

@@ -0,0 +1,47 @@
+import { apiClient } from "../../api-client";
+import type { MarketContext } from "../types";
+
+const CLOUD_PLUGIN_ID = "gloomberb-cloud";
+const CLOUD_SESSION_KEYS = ["resume:session", "session"] as const;
+
+interface PersistedCloudSession {
+  sessionToken?: unknown;
+}
+
+/**
+ * A container has no local plugin state, so a bot or a CI job has no way to
+ * reach Pro gated panes. `GLOOMBERB_SESSION_TOKEN` gives headless callers the
+ * same session the desktop app persists after signing in, and it wins over the
+ * stored one so a service account can be pointed somewhere else without
+ * touching the user's own state.
+ */
+export function resolvePersistedCloudSessionToken(
+  context: Pick<MarketContext, "persistence">,
+): string | null {
+  const fromEnv = process.env.GLOOMBERB_SESSION_TOKEN?.trim();
+  if (fromEnv) return fromEnv;
+  for (const key of CLOUD_SESSION_KEYS) {
+    const value = context.persistence.pluginState.get<PersistedCloudSession>(
+      CLOUD_PLUGIN_ID,
+      key,
+      1,
+    )?.value;
+    if (typeof value?.sessionToken === "string" && value.sessionToken.length > 0) {
+      return value.sessionToken;
+    }
+  }
+  return null;
+}
+
+export async function withPersistedCloudSession<T>(
+  context: Pick<MarketContext, "persistence">,
+  run: () => Promise<T>,
+): Promise<T> {
+  const previousSessionToken = apiClient.getSessionToken();
+  apiClient.setSessionToken(resolvePersistedCloudSessionToken(context));
+  try {
+    return await run();
+  } finally {
+    apiClient.setSessionToken(previousSessionToken);
+  }
+}

package/src/cli/pane-functions/index.ts

@@ -28,6 +28,7 @@ import {
   isDataPaneForDomFallback,
   normalizeCapabilityOptions,
 } from "./capabilities";
+import { withPersistedCloudSession } from "./cloud-session";
 
 async function withPaneRuntime<T>(
   ctx: CliCommandContext,
@@ -63,7 +64,10 @@ export async function runPaneFunction(args: string[], ctx: CliCommandContext) {
           + `Use "gloomberb catalog ${resolved.token}" to inspect readiness.`,
         );
       }
-      const report = await buildFunctionReport(resolved, context, parsed.arg);
+      const report = await withPersistedCloudSession(
+        context,
+        () => buildFunctionReport(resolved, context, parsed.arg),
+      );
       if (parsed.requireBotSafe && (report.data.empty || !report.data.complete)) {
         const unavailable = report.data.unavailableSymbols.length > 0
           ? ` Missing data for ${report.data.unavailableSymbols.join(", ")}.`

package/src/cli/pane-functions/screenshot.test.ts

@@ -3,6 +3,7 @@ import type { RemoteUiNodeSnapshot } from "../../remote/types";
 import {
   chartSeriesEvidenceWithinRange,
   chartEvidenceMismatchesFor,
+  createDesktopShotBridge,
   isPaneScreenshotUsable,
   missingActiveTabSelections,
   resolveDesktopShotApiProxy,
@@ -94,6 +95,32 @@ describe("pane screenshot payload credentials", () => {
   });
 });
 
+describe("pane screenshot market bridge", () => {
+  /**
+   * The page can only reach the cloud API on its own, and the cloud carries no
+   * per-rating price targets. Serving research requests from the router is what
+   * keeps a screenshot showing the same values as `gloomberb fn`.
+   */
+  test("answers research requests from the routed provider and refuses anything else", async () => {
+    const calls: Array<[string, unknown[]]> = [];
+    const bridge = createDesktopShotBridge({
+      dataProvider: {
+        getAnalystResearch: (...args: unknown[]) => {
+          calls.push(["getAnalystResearch", args]);
+          return Promise.resolve({ symbol: "NKE", ratings: [{ currentPriceTarget: 42 }] });
+        },
+      } as any,
+    });
+
+    expect(await bridge.marketData("getAnalystResearch", ["NKE", "NYSE"])).toEqual({
+      symbol: "NKE",
+      ratings: [{ currentPriceTarget: 42 }],
+    });
+    expect(calls).toEqual([["getAnalystResearch", ["NKE", "NYSE"]]]);
+    await expect(bridge.marketData("getOptionsChain", ["NKE"])).rejects.toThrow(/does not serve/);
+  });
+});
+
 describe("pane screenshot active-state verification", () => {
   const expected: PaneScreenshotExpectedSelection[] = [
     { control: "statement", label: "Cash Flow" },

package/src/cli/pane-functions/screenshot.ts

@@ -11,6 +11,9 @@ const DEFAULT_SHOT_DEVICE_SCALE_FACTOR = 2;
 import {
   renderDesktopPaneScreenshot,
   type DesktopPaneShotApiProxy,
+  type DesktopPaneShotBridge,
+  type DesktopPaneShotHttpRequest,
+  type DesktopPaneShotHttpResponse,
   type DesktopPaneShotIntradayHistory,
   type DesktopPaneShotPayload,
   type DesktopPaneShotRenderResult,
@@ -19,6 +22,7 @@ import { optionPaneState } from "./options";
 import type { ResolvedPaneFunction } from "./resolver";
 import type { MarketContext } from "../types";
 import { capabilityPluginState } from "./capabilities";
+import { resolvePersistedCloudSessionToken } from "./cloud-session";
 import type { RemoteUiNodeSnapshot } from "../../remote/types";
 import {
   graphRowsForFinancials,
@@ -76,8 +80,6 @@ const DESKTOP_CELL_HEIGHT_PX = 18;
 const OPTIONS_PANE_ID = "options";
 const MARKET_VALUATION_PANE_ID = "market-valuation";
 const ECON_STATISTICS_PANE_ID = "econ-statistics";
-const CLOUD_PLUGIN_ID = "gloomberb-cloud";
-const CLOUD_SESSION_KEYS = ["resume:session", "session"] as const;
 const CREDENTIAL_FIELD_NAMES = new Set([
   "accesstoken",
   "accessurl",
@@ -96,10 +98,6 @@ const CREDENTIAL_FIELD_NAMES = new Set([
   "token",
 ]);
 
-interface PersistedShotCloudSession {
-  sessionToken?: unknown;
-}
-
 /**
  * The proxy receives the desktop session out of band. Keeping this separate
  * from DesktopPaneShotPayload prevents the token from entering the page,
@@ -138,21 +136,85 @@ export function stripDesktopShotCredentials<T>(value: T): T {
 export function resolveDesktopShotApiProxy(
   context: Pick<MarketContext, "persistence">,
 ): DesktopPaneShotApiProxy {
-  let sessionToken: string | null = null;
-  for (const key of CLOUD_SESSION_KEYS) {
-    const value = context.persistence.pluginState.get<PersistedShotCloudSession>(
-      CLOUD_PLUGIN_ID,
-      key,
-      1,
-    )?.value;
-    if (typeof value?.sessionToken === "string" && value.sessionToken.length > 0) {
-      sessionToken = value.sessionToken;
-      break;
-    }
-  }
   return {
     baseUrl: getCloudApiBaseUrl(),
-    sessionToken,
+    sessionToken: resolvePersistedCloudSessionToken(context),
+  };
+}
+
+/**
+ * Data the page may request while it renders. The cloud API is only one of the
+ * router's sources, so calling it directly from the page dropped whatever
+ * another provider contributes: analyst rating price targets came back empty
+ * and corporate actions vanished whenever the cloud leg failed. Quotes are
+ * here for board panes that list symbols the payload was never built for.
+ * These run on the Bun side through the same router `gloomberb fn` uses.
+ */
+const SHOT_BRIDGE_MARKET_OPERATIONS = new Set([
+  "getAnalystResearch",
+  "getCorporateActions",
+  "getEarningsCalendar",
+  "getHolders",
+  "getPriceHistory",
+  "getQuote",
+  "getQuotesBatch",
+  "getSecFilings",
+]);
+
+const SHOT_BRIDGE_HTTP_TIMEOUT_MS = 20_000;
+
+export function createDesktopShotBridge(
+  context: Pick<MarketContext, "dataProvider">,
+): DesktopPaneShotBridge {
+  return {
+    async marketData(operation, args) {
+      if (!SHOT_BRIDGE_MARKET_OPERATIONS.has(operation)) {
+        throw new Error(`Screenshot market bridge does not serve "${operation}".`);
+      }
+      const provider = context.dataProvider as unknown as Record<string, unknown>;
+      const handler = provider[operation];
+      if (typeof handler !== "function") {
+        throw new Error(`No provider available for ${operation}.`);
+      }
+      return await (handler as (...values: unknown[]) => Promise<unknown>).apply(
+        context.dataProvider,
+        args,
+      );
+    },
+    httpFetch: (request) => runDesktopShotHttpFetch(request),
+  };
+}
+
+/**
+ * Panes such as DVD fetch a third-party API directly. A browser cannot: the
+ * request is cross-origin and dies in CORS, so the pane reported that the
+ * ticker pays no dividend. The desktop renderer already proxies these through
+ * its native half; the screenshot page gets the same treatment.
+ */
+async function runDesktopShotHttpFetch(
+  request: DesktopPaneShotHttpRequest,
+): Promise<DesktopPaneShotHttpResponse> {
+  const target = new URL(request.url);
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new Error(`Screenshot HTTP bridge refuses ${target.protocol} requests.`);
+  }
+  const response = await fetch(request.url, {
+    method: request.method ?? "GET",
+    headers: request.headers,
+    body: request.body,
+    redirect: "follow",
+    signal: AbortSignal.timeout(SHOT_BRIDGE_HTTP_TIMEOUT_MS),
+  });
+  const headers: Record<string, string> = {};
+  response.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  return {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+    setCookie: response.headers.getSetCookie?.() ?? [],
+    body: await response.text(),
   };
 }
 
@@ -634,7 +696,10 @@ export async function renderDesktopShot({
       scale ?? 1,
       watermark ?? null,
     );
-    render = await renderDesktopPaneScreenshot(payload, outputPath, apiProxy, { captureImage });
+    render = await renderDesktopPaneScreenshot(payload, outputPath, apiProxy, {
+      captureImage,
+      bridge: createDesktopShotBridge(context),
+    });
   } finally {
     apiClient.setSessionToken(previousSessionToken);
   }