mindvest-atlas 0.4.3 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -15,8 +15,8 @@ import { requestJson } from '../api/client.js';
 import { runStream } from '../util/stream-loop.js';
 import { color, eprintln } from '../util/ui.js';
 import {
-  DEFAULT_TIMEOUT_MS, computerName, jobEnv, machineId, osLabel,
-  staleness, summarize, tail, workspace, workspaceRoot,
+  DEFAULT_TIMEOUT_MS, computerName, jobEnv, listJobFiles, machineId, osLabel,
+  readJobFile, staleness, summarize, tail, workspace, workspaceRoot,
 } from '../remote-control.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -95,6 +95,27 @@ function runOnce(argv, dir, env, timeoutMs) {
   });
 }
 
+/** Send one answer back up. Pass-through: the server relays it to whoever asked
+ *  and stores none of it, which is what keeps a file's contents on this computer
+ *  even while someone is looking at them. */
+async function answer(requestId, payload) {
+  try {
+    await requestJson(API.remoteAnswer, { method: 'POST', body: { request_id: requestId, ...payload } });
+  } catch (err) {
+    eprintln(color.dim(`  ↳ could not answer: ${err.message}`));
+  }
+}
+
+/** A question from the web about THIS computer's workspace. Read-only and
+ *  confined to the jobs folder: it can list what is there and show one file; it
+ *  cannot write, delete, or reach outside. */
+async function handleAsk(ask, root) {
+  if (!ask?.request_id) return;
+  if (ask.op === 'list') return answer(ask.request_id, { ok: true, jobs: listJobFiles(root) });
+  if (ask.op === 'read') return answer(ask.request_id, readJobFile(ask.job || '', ask.path || '', root));
+  return answer(ask.request_id, { ok: false, error: 'Unknown request.' });
+}
+
 async function runJob(job, root, timeoutMs) {
   const name = job.name || job.automation_id || 'job';
   const started = Date.now();
@@ -177,6 +198,8 @@ export async function remoteControlCommand(args) {
     onEvent: async ({ event, payload }) => {
       if (event === 'job' || event === 'message' || event === 'run') {
         await runJob(payload, root, timeoutMs);
+      } else if (event === 'ask') {
+        await handleAsk(payload, root);
       }
     },
   });

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.4.3';
+export const VERSION = '0.5.0';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';
@@ -41,6 +41,7 @@ export const API = {
   remoteJobs: '/api/v1/remote-computer/jobs',
   remotePending: '/api/v1/remote-computer/pending',
   remoteStatus: '/api/v1/remote-computer/status',
+  remoteAnswer: '/api/v1/remote-computer/answer',
   localRuns: '/api/local/runs',
 };
 

package/src/remote-control.js

@@ -218,3 +218,68 @@ export function summarize(output, ok) {
   if (!lines.length) return ok ? 'Ran and finished.' : null;
   return lines[lines.length - 1].slice(0, 2000);
 }
+
+/** Files bigger than this are not read into a browser: a job's script or log is
+ *  a few KB, and anything past it is a data file the viewer would choke on. */
+export const MAX_VIEW_BYTES = 256 * 1024;
+const SKIP_DIRS = new Set(['.venv', 'node_modules', '__pycache__']);
+
+/**
+ * Every job folder and what is in it, as plain metadata.
+ *
+ * Names, sizes and times only — never contents. Confined to the workspace: this
+ * answers a request that arrived over the network, so it must not be able to
+ * describe anything outside the folder Atlas was given.
+ */
+export function listJobFiles(root) {
+  const base = path.join(workspaceRoot(root), SCRIPTS_DIR);
+  let jobs = [];
+  try {
+    jobs = fs.readdirSync(base, { withFileTypes: true })
+      .filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch { return []; }
+  return jobs.map((job) => {
+    const files = [];
+    const walk = (dir, rel) => {
+      if (files.length >= 200) return;
+      let entries = [];
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+      for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (SKIP_DIRS.has(e.name)) continue;
+        const abs = path.join(dir, e.name);
+        const r = rel ? `${rel}/${e.name}` : e.name;
+        if (e.isDirectory()) { walk(abs, r); continue; }
+        try {
+          const st = fs.statSync(abs);
+          files.push({ path: r, size: st.size, modified: st.mtimeMs / 1000 });
+        } catch { /* vanished mid-walk */ }
+        if (files.length >= 200) return;
+      }
+    };
+    walk(path.join(base, job), '');
+    return { job, files };
+  });
+}
+
+/**
+ * One file's text, or a reason it cannot be shown.
+ *
+ * The path is resolved and then checked to still be INSIDE the job's folder,
+ * which is what stops `../../.ssh/id_rsa` — a request arriving over the network
+ * must not reach a file the user never put in the workspace.
+ */
+export function readJobFile(job, rel, root) {
+  const base = path.resolve(path.join(workspaceRoot(root), SCRIPTS_DIR, safeSlug(job)));
+  const target = path.resolve(path.join(base, rel));
+  if (target !== base && !target.startsWith(base + path.sep)) {
+    return { ok: false, error: "That file is outside this job's folder." };
+  }
+  try {
+    if (fs.statSync(target).size > MAX_VIEW_BYTES) {
+      return { ok: false, error: 'That file is too large to show here.' };
+    }
+    return { ok: true, text: fs.readFileSync(target, 'utf8') };
+  } catch {
+    return { ok: false, error: 'That file could not be read.' };
+  }
+}