mindvest-atlas 0.4.3 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.4.3",
+  "version": "0.6.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -15,8 +15,8 @@ import { requestJson } from '../api/client.js';
 import { runStream } from '../util/stream-loop.js';
 import { color, eprintln } from '../util/ui.js';
 import {
-  DEFAULT_TIMEOUT_MS, computerName, jobEnv, machineId, osLabel,
-  staleness, summarize, tail, workspace, workspaceRoot,
+  DEFAULT_TIMEOUT_MS, computerName, jobEnv, listJobFiles, listRuns, machineId, osLabel,
+  readJobFile, staleness, summarize, tail, workspace, workspaceRoot,
 } from '../remote-control.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -53,30 +53,15 @@ function writeLog(dir, job, status, started, finished, text) {
 }
 
 /**
- * POST that a run happened. METADATA ONLY — never what the script printed.
+ * Deliberately does nothing.
  *
- * Best-effort: a failed report must not take down the runner, and the next job
- * still deserves to run.
+ * A run is recorded in the log beside the script that produced it, on the
+ * computer that ran it, and nowhere else. This is kept as the single place every
+ * outcome funnels through, so "where does a run go" has one answer rather than
+ * five call sites each deciding.
  */
-async function report(job, status, started, finished) {
-  try {
-    await requestJson(API.localRuns, {
-      method: 'POST',
-      body: {
-        automation_id: job.automation_id || job.id,
-        name: job.name || '',
-        source: job.source || 'schedule',
-        status,
-        started_at: iso(started),
-        finished_at: iso(finished),
-        // One account can run jobs on several computers; the results view says
-        // which one produced each record.
-        machine: computerName(),
-      },
-    });
-  } catch (err) {
-    eprintln(color.dim(`  ↳ could not report the run: ${err.message}`));
-  }
+async function report() {
+  return undefined;
 }
 
 function runOnce(argv, dir, env, timeoutMs) {
@@ -95,6 +80,28 @@ function runOnce(argv, dir, env, timeoutMs) {
   });
 }
 
+/** Send one answer back up. Pass-through: the server relays it to whoever asked
+ *  and stores none of it, which is what keeps a file's contents on this computer
+ *  even while someone is looking at them. */
+async function answer(requestId, payload) {
+  try {
+    await requestJson(API.remoteAnswer, { method: 'POST', body: { request_id: requestId, ...payload } });
+  } catch (err) {
+    eprintln(color.dim(`  ↳ could not answer: ${err.message}`));
+  }
+}
+
+/** A question from the web about THIS computer's workspace. Read-only and
+ *  confined to the jobs folder: it can list what is there and show one file; it
+ *  cannot write, delete, or reach outside. */
+async function handleAsk(ask, root) {
+  if (!ask?.request_id) return;
+  if (ask.op === 'list') return answer(ask.request_id, { ok: true, jobs: listJobFiles(root) });
+  if (ask.op === 'runs') return answer(ask.request_id, { ok: true, runs: listRuns(root) });
+  if (ask.op === 'read') return answer(ask.request_id, readJobFile(ask.job || '', ask.path || '', root));
+  return answer(ask.request_id, { ok: false, error: 'Unknown request.' });
+}
+
 async function runJob(job, root, timeoutMs) {
   const name = job.name || job.automation_id || 'job';
   const started = Date.now();
@@ -177,6 +184,8 @@ export async function remoteControlCommand(args) {
     onEvent: async ({ event, payload }) => {
       if (event === 'job' || event === 'message' || event === 'run') {
         await runJob(payload, root, timeoutMs);
+      } else if (event === 'ask') {
+        await handleAsk(payload, root);
       }
     },
   });

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.4.3';
+export const VERSION = '0.6.0';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';
@@ -41,6 +41,7 @@ export const API = {
   remoteJobs: '/api/v1/remote-computer/jobs',
   remotePending: '/api/v1/remote-computer/pending',
   remoteStatus: '/api/v1/remote-computer/status',
+  remoteAnswer: '/api/v1/remote-computer/answer',
   localRuns: '/api/local/runs',
 };
 

package/src/remote-control.js

@@ -218,3 +218,112 @@ export function summarize(output, ok) {
   if (!lines.length) return ok ? 'Ran and finished.' : null;
   return lines[lines.length - 1].slice(0, 2000);
 }
+
+/** Files bigger than this are not read into a browser: a job's script or log is
+ *  a few KB, and anything past it is a data file the viewer would choke on. */
+export const MAX_VIEW_BYTES = 256 * 1024;
+const SKIP_DIRS = new Set(['.venv', 'node_modules', '__pycache__']);
+
+/**
+ * Every job folder and what is in it, as plain metadata.
+ *
+ * Names, sizes and times only — never contents. Confined to the workspace: this
+ * answers a request that arrived over the network, so it must not be able to
+ * describe anything outside the folder Atlas was given.
+ */
+export function listJobFiles(root) {
+  const base = path.join(workspaceRoot(root), SCRIPTS_DIR);
+  let jobs = [];
+  try {
+    jobs = fs.readdirSync(base, { withFileTypes: true })
+      .filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch { return []; }
+  return jobs.map((job) => {
+    const files = [];
+    const walk = (dir, rel) => {
+      if (files.length >= 200) return;
+      let entries = [];
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+      for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (SKIP_DIRS.has(e.name)) continue;
+        const abs = path.join(dir, e.name);
+        const r = rel ? `${rel}/${e.name}` : e.name;
+        if (e.isDirectory()) { walk(abs, r); continue; }
+        try {
+          const st = fs.statSync(abs);
+          files.push({ path: r, size: st.size, modified: st.mtimeMs / 1000 });
+        } catch { /* vanished mid-walk */ }
+        if (files.length >= 200) return;
+      }
+    };
+    walk(path.join(base, job), '');
+    return { job, files };
+  });
+}
+
+/**
+ * One file's text, or a reason it cannot be shown.
+ *
+ * The path is resolved and then checked to still be INSIDE the job's folder,
+ * which is what stops `../../.ssh/id_rsa` — a request arriving over the network
+ * must not reach a file the user never put in the workspace.
+ */
+export function readJobFile(job, rel, root) {
+  const base = path.resolve(path.join(workspaceRoot(root), SCRIPTS_DIR, safeSlug(job)));
+  const target = path.resolve(path.join(base, rel));
+  if (target !== base && !target.startsWith(base + path.sep)) {
+    return { ok: false, error: "That file is outside this job's folder." };
+  }
+  try {
+    if (fs.statSync(target).size > MAX_VIEW_BYTES) {
+      return { ok: false, error: 'That file is too large to show here.' };
+    }
+    return { ok: true, text: fs.readFileSync(target, 'utf8') };
+  } catch {
+    return { ok: false, error: 'That file could not be read.' };
+  }
+}
+
+/**
+ * Recent runs, read from the logs this computer wrote.
+ *
+ * The machine that ran them is the only place they exist — nothing is reported
+ * to a server — so this is the source of truth, not a cache of one. Parsed from
+ * the filename (when, and how it ended) and the log's own second line (how
+ * long), which is why the writer stamps both.
+ */
+export function listRuns(root, limit = 50) {
+  const base = path.join(workspaceRoot(root), SCRIPTS_DIR);
+  const runs = [];
+  let jobs = [];
+  try {
+    jobs = fs.readdirSync(base, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch { return runs; }
+  for (const job of jobs) {
+    let files = [];
+    try {
+      files = fs.readdirSync(path.join(base, job, 'runs')).filter((f) => f.endsWith('.log')).sort().reverse();
+    } catch { continue; }
+    for (const f of files.slice(0, limit)) {
+      const stem = f.replace(/\.log$/, '');
+      const parts = stem.split('-');
+      if (parts.length < 3) continue;
+      const status = parts.slice(2).join('-');
+      const [d, t] = parts;
+      const started = Date.parse(
+        `${d.slice(0, 4)}-${d.slice(4, 6)}-${d.slice(6, 8)}T${t.slice(0, 2)}:${t.slice(2, 4)}:${t.slice(4, 6)}`,
+      ) / 1000;
+      let name = job;
+      let took = null;
+      try {
+        const [first, second] = fs.readFileSync(path.join(base, job, 'runs', f), 'utf8').split('\n');
+        const bits = (first || '').split('  ');
+        if (bits.length >= 3) name = bits[2];
+        if ((second || '').startsWith('took ')) took = parseFloat(second.slice(5));
+      } catch { /* unreadable: the filename still tells the story */ }
+      runs.push({ job, name, status, started_at: Number.isFinite(started) ? started : 0, duration_s: took, log: f });
+    }
+  }
+  runs.sort((a, b) => b.started_at - a.started_at);
+  return runs.slice(0, limit);
+}