mindvest-atlas 0.23.2 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.23.2",
+  "version": "0.26.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -22,6 +22,7 @@ import {
   beatRunner,
   setPaused, writeHelpers, askModel, listModels, chatModel, answerPermission,
   createProject, ensureProjectFiles, listChats, readChat, deleteChat, appendChat,
+  computerUseAllowed,
   readSchedule, cronMatches, dueMinutes, scheduleMatches, scheduleDueMinutes, writeNext,
   SCRIPTS_DIR, projectsForAlert, readMode,
 } from '../remote-control.js';
@@ -381,6 +382,17 @@ async function runJob(job, root, timeoutMs) {
   ensureProjectFiles(dir);
 
   eprintln(color.dim(`▶ ${name}`));
+  // MAY THIS RUN USE THE COMPUTER? Read per run, from this machine's own
+  // settings, so turning the switch off takes effect at the next job rather
+  // than at the next restart. The helper refuses without it and writes the
+  // refusal down; nothing here pretends that is a sandbox, only that there is
+  // one path that asks first and keeps a record.
+  const computerEnv = computerUseAllowed(root)
+    ? {
+      ATLAS_COMPUTER_USE: '1',
+      ATLAS_COMPUTER_SESSION: new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19),
+    }
+    : {};
   const env = {
     ...process.env,
     // Secrets first (shared .env, then the job's own), so a job's own env can
@@ -398,6 +410,8 @@ async function runJob(job, root, timeoutMs) {
     // one job's questions stay one conversation and do not blend into another's.
     ATLAS_JOB: path.basename(dir),
     ATLAS_JOB_PAYLOAD: JSON.stringify(job.payload || {}),
+    // Last, so a job's own env cannot switch this on for itself.
+    ...computerEnv,
   };
   const r = await runOnce(argv, dir, env, timeoutMs);
   const finished = Date.now();

package/src/commands/tools.js

@@ -11,6 +11,30 @@ function firstLine(desc) {
   return '';
 }
 
+// Commands this CLI has of its OWN. They are not in the account's tool catalog
+// and never will be, so a search that finds nothing there should still say when
+// one of these is what the person meant (owner, 2026-09-05: an agent concluded
+// there was no screenshot tool while `atlas screenshot` was right there).
+const LOCAL_COMMANDS = {
+  screenshot: "atlas screenshot --job <project> [--all]   a picture of a project's dashboard, reviewed in words",
+  share: 'atlas share <state|publish|off|peek|install|updates>   hand a project to someone, or take one in',
+  alerts: 'atlas alerts                              watch your alerts as they fire',
+  flow: 'atlas flow                                options flow, live',
+  'remote-control': "atlas remote-control                      run this computer's projects",
+  'historical-contract': "atlas historical-contract ...             an option's past greeks",
+  'update-cli': 'atlas update-cli                          fetch the newest Atlas',
+  whoami: 'atlas whoami                              who this computer is signed in as',
+};
+
+/** Commands of this CLI whose name or line contains the search term. */
+function localMatches(term) {
+  if (!term) return [];
+  return Object.entries(LOCAL_COMMANDS)
+    .filter(([name, line]) => name.includes(term) || line.toLowerCase().includes(term))
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([, line]) => line);
+}
+
 export async function toolsCommand(args) {
   const flags = args.flags;
   const catalog = await fetchCatalog({ force: !!flags.refresh });
@@ -38,7 +62,17 @@ export async function toolsCommand(args) {
   for (const r of rows) {
     println('  ' + color.cyan(r.slug.padEnd(width)) + color.dim(r.desc));
   }
-  if (!rows.length) println(color.dim('  (no tools match "' + filter + '")'));
+  if (!rows.length) {
+    println(color.dim('  (no tools match "' + filter + '")'));
+    // A COMMAND is not a tool, and looking for one in the catalog is an easy
+    // mistake to make: they are both things you type after `atlas`.
+    const local = localMatches(filter);
+    if (local.length) {
+      println('');
+      println(color.dim('  Not a tool, but this CLI can do it:'));
+      for (const line of local) println('    ' + line);
+    }
+  }
   println();
   println(color.dim('Run ') + color.cyan('atlas <tool> --help') + color.dim(' for parameters.'));
   return 0;

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.23.2';
+export const VERSION = '0.26.0';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/helpers/atlas_env.js

@@ -1,7 +1,7 @@
 // Secrets for this job. Written by Atlas — edits are overwritten.
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import url_ from "node:url";
 //
 // Values come from the environment Atlas set up before starting this script. Do
 // NOT open .env: this module is the supported way to reach a secret, and the
@@ -58,7 +58,7 @@ export async function atlas(tool, params = {}) {
  * starts up once, later questions can refer to earlier ones); fresh:true is for
  * independent questions that should not pile into one context.
  */
-export async function ask(prompt, { tools = true, fresh = false, timeoutMs = 600000, model = "" } = {}) {
+export async function ask(prompt, { tools = true, fresh = false, timeoutMs = 600000 } = {}) {
   const url = process.env.ATLAS_ASK_URL;
   const token = process.env.ATLAS_ASK_TOKEN;
   if (!url || !token) {
@@ -70,12 +70,7 @@ export async function ask(prompt, { tools = true, fresh = false, timeoutMs = 600
   const res = await fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Atlas-Token": token },
-    // `model` is sent only when named, so a script that does not care keeps
-    // whatever is connected rather than pinning itself to today's default.
-    body: JSON.stringify({
-      job: process.env.ATLAS_JOB || "", prompt: String(prompt), tools, fresh,
-      ...(String(model || "").trim() ? { model: String(model).trim() } : {}),
-    }),
+    body: JSON.stringify({ job: process.env.ATLAS_JOB || "", prompt: String(prompt), tools, fresh }),
     signal: AbortSignal.timeout(timeoutMs),
   });
   const out = await res.json().catch(() => ({}));
@@ -83,77 +78,6 @@ export async function ask(prompt, { tools = true, fresh = false, timeoutMs = 600
   return out.answer || "";
 }
 
-/**
- * A PICTURE OF THE DASHBOARD, AND WHAT IS WRONG WITH IT.
- *
- * You build a page you never see rendered: the thing that draws it is the Atlas
- * app, not the browser the file opens in, and that gap is where the UI bugs
- * live. Atlas MEASURES the render as well as photographing it and hands back
- * what it found in words, because you cannot see a PNG (owner, 2026-09-04:
- * "can the AI take a screenshot and review it — right now the UI is just
- * guessing").
- *
- *     await screenshot();                          // computer, dark
- *     await screenshot({ phone: true });           // phone, dark
- *     await screenshot({ theme: "light" });        // computer, light
- *     await screenshot({ phone: true, theme: "light" });
- *
- * All four. The phone is where this is most likely to be broken and the view
- * you are least able to picture.
- *
- * Returns { path, summary, findings, facts }. `summary` is the line to read;
- * `broken` findings are faults, `style` findings are design rules this page is
- * not following. PRINT THE SUMMARY so it lands in the run log, fix what it
- * names, and take another. {} means the app was not reachable.
- */
-export async function screenshot({ theme = "dark", phone = false, width, height, timeoutMs = 60000 } = {}) {
-  const url = process.env.ATLAS_ASK_URL;
-  const token = process.env.ATLAS_ASK_TOKEN;
-  if (!url || !token) return {};
-  const job = path.basename(path.dirname(fileURLToPath(import.meta.url)));
-  const body = { job, theme, phone: !!phone };
-  if (width) body.width = Number(width);
-  if (height) body.height = Number(height);
-  try {
-    const res = await fetch(url.replace("/ask", "/screenshot"), {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-Atlas-Token": token },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    const out = await res.json().catch(() => ({}));
-    if (!res.ok || !out.ok) return {};
-    return {
-      path: out.path || "", summary: out.summary || "",
-      findings: out.findings || [], facts: out.facts || {},
-    };
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Every model this computer can reach.
- *
- * Returns [{ id, label }]. Pass an `id` to ask(..., { model }). An empty list
- * means no model is connected, in which case ask() says so too.
- */
-export async function models() {
-  const url = process.env.ATLAS_ASK_URL;
-  const token = process.env.ATLAS_ASK_TOKEN;
-  if (!url || !token) return [];
-  try {
-    const res = await fetch(url.replace("/ask", "/models"), {
-      headers: { "X-Atlas-Token": token },
-      signal: AbortSignal.timeout(20000),
-    });
-    const out = await res.json().catch(() => ({}));
-    return (out.models || []).filter((m) => m && m.id);
-  } catch {
-    return [];
-  }
-}
-
 /**
  * Call a tool on one of YOUR connected MCP servers.
  *
@@ -178,6 +102,156 @@ export async function mcpTools({ server = "", search = "" } = {}) {
   return atlas("mcp-tools", { server, search });
 }
 
+/**
+ * Use this project's dashboard the way a person would.
+ *
+ * screenshot() showed you what it LOOKS like. This lets you find out whether it
+ * WORKS: press the button, type in the box, look again at what happened. A
+ * layout fault is visible in a picture; a filter that returns nothing and a form
+ * that will not submit are not, and those are most of what is actually broken.
+ *
+ *     await dashboard.open();
+ *     for (const thing of await dashboard.find("button")) console.log(thing);
+ *     await dashboard.click(x, y);
+ *     await dashboard.type("AAPL");
+ *     console.log((await dashboard.shot()).summary);
+ *     await dashboard.close();
+ *
+ * It drives the dashboard and nothing else, so the person's real pointer never
+ * moves and they can carry on working while you click. Coordinates are inside
+ * the dashboard, from its top left, and they are not the same between shapes:
+ * reopening at { phone: true } draws a different layout.
+ */
+async function driveDashboard(op, body = {}) {
+  const url = process.env.ATLAS_ASK_URL || "";
+  const token = process.env.ATLAS_ASK_TOKEN || "";
+  if (!url || !token) {
+    throw new Error(
+      "The dashboard can only be driven from Atlas Remote Control, which is "
+      + "what draws it. Run this project from the app.",
+    );
+  }
+  const job = path.basename(path.dirname(url_.fileURLToPath(import.meta.url)));
+  const res = await fetch(url.replace("/ask", "/dashboard-drive"), {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Atlas-Token": token },
+    body: JSON.stringify({ ...body, job, op }),
+  });
+  const out = await res.json().catch(() => ({}));
+  if (!res.ok || out.ok === false) {
+    throw new Error(out.error || "The dashboard would not do that.");
+  }
+  return out;
+}
+
+export const dashboard = {
+  open: (opts = {}) => driveDashboard("open", {
+    phone: !!opts.phone,
+    theme: opts.theme || "dark",
+    width: opts.width,
+    height: opts.height,
+  }),
+  /** Where things are, without reading pixels. This is your own page: ask it. */
+  find: async (selector = "button, a, input, select, [role=button]") =>
+    (await driveDashboard("read", { selector })).found || [],
+  click: (x, y, opts = {}) => driveDashboard("click", {
+    x, y, button: opts.button || "left", count: opts.count || 1,
+  }),
+  doubleClick: (x, y) => driveDashboard("click", { x, y, count: 2 }),
+  move: (x, y) => driveDashboard("move", { x, y }),
+  scroll: (x, y, dx = 0, dy = -300) => driveDashboard("scroll", { x, y, dx, dy }),
+  type: (text) => driveDashboard("type", { text: String(text) }),
+  key: (...keys) => driveDashboard("key", { keys: keys.map(String) }),
+  /** A picture AND what is wrong with it, because you cannot see a PNG. */
+  shot: () => driveDashboard("shot"),
+  /** All four views, each measured: computer and phone, dark and light. */
+  check: async () => (await driveDashboard("check")).views || [],
+  close: () => driveDashboard("close"),
+};
+
+/**
+ * See the screen, move the mouse, type: the whole computer, not just your page.
+ *
+ * Runs through the project's Python, which is where the machinery lives
+ * (pyautogui and the recording), so the switch, the one-run-at-a-time claim, the
+ * action log and standing back when somebody picks up the mouse are all exactly
+ * the same rules whichever language the script is written in. There is one
+ * implementation, not two that can disagree about what is allowed.
+ *
+ *     await computer.screen();          // look FIRST, always
+ *     await computer.click(x, y);
+ *     await computer.type("hello");
+ *     await computer.note("signing in");
+ *
+ * Off until the person turns it on, under This Computer in Atlas Remote
+ * Control. Read skills/computer-use before using any of it.
+ */
+async function useComputer(op, args = []) {
+  const { spawn } = await import("node:child_process");
+  const dir = path.dirname(url_.fileURLToPath(import.meta.url));
+  const py = process.env.ATLAS_PYTHON || (process.platform === "win32" ? "python" : "python3");
+  const code =
+    "import json,sys,atlas_env\n"
+    + "op=sys.argv[1]; args=json.loads(sys.argv[2])\n"
+    + "out=getattr(atlas_env,op)(*args)\n"
+    + "sys.stdout.write('\\n__ATLAS__'+json.dumps(out,default=str))\n";
+  return await new Promise((done, fail) => {
+    const p = spawn(py, ["-c", code, op, JSON.stringify(args)], { cwd: dir });
+    let out = "", err = "";
+    p.stdout.on("data", (d) => { out += d; });
+    p.stderr.on("data", (d) => { err += d; });
+    p.on("error", () => fail(new Error(
+      "No Python on this computer, and using the computer runs through it. "
+      + "Install Python 3, or use dashboard for work on your own page.",
+    )));
+    p.on("close", (codeOut) => {
+      if (codeOut !== 0) {
+        // The last line of a Python traceback is the message the helper wrote,
+        // and that message is the one worth showing: it says which switch to
+        // turn on or who is holding the mouse.
+        const lines = err.trim().split("\n").filter(Boolean);
+        const last = lines[lines.length - 1] || "That did not work.";
+        return fail(new Error(last.replace(/^\w*Error:\s*/, "")));
+      }
+      const mark = out.lastIndexOf("__ATLAS__");
+      if (mark < 0) return done(null);
+      try {
+        done(JSON.parse(out.slice(mark + 9)));
+      } catch {
+        done(null);
+      }
+    });
+  });
+}
+
+export const computer = {
+  ready: () => useComputer("computer_ready"),
+  screen: () => useComputer("screen"),
+  region: (x, y, w, h) => useComputer("region", [x, y, w, h]),
+  screens: () => useComputer("screens"),
+  useScreen: (n) => useComputer("use_screen", [n]),
+  click: (x, y) => useComputer("click", [x, y]),
+  doubleClick: (x, y) => useComputer("double_click", [x, y]),
+  rightClick: (x, y) => useComputer("right_click", [x, y]),
+  move: (x, y) => useComputer("move", [x, y]),
+  drag: (x1, y1, x2, y2) => useComputer("drag", [x1, y1, x2, y2]),
+  scroll: (x, y, dx, dy) => useComputer("scroll", [x, y, dx, dy]),
+  type: (text) => useComputer("type", [String(text)]),
+  key: (...keys) => useComputer("key", keys.map(String)),
+  copy: (text) => useComputer("copy", [String(text)]),
+  focusWindow: (title) => useComputer("focus_window", [String(title)]),
+  cursor: () => useComputer("get_cursor"),
+  /** Say what you are doing. Somebody is watching a strip that shows this. */
+  note: (text) => useComputer("note", [String(text)]),
+  pauseRecording: (why = "") => useComputer("pause_recording", [String(why)]),
+  resumeRecording: () => useComputer("resume_recording"),
+  /** After a person used it by hand. Look again before you call this. */
+  takeOver: () => useComputer("take_over"),
+  release: () => useComputer("release_computer"),
+  /** Only when the person asked you to work inside Atlas itself. */
+  useAtlasApp: () => useComputer("use_atlas_app"),
+};
+
 /**
  * Stop cleanly when a secret has not been filled in yet.
  *