mindvest-atlas 0.55.0 → 0.56.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.55.0';
+export const VERSION = '0.56.0';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/remote-control.js

@@ -1615,6 +1615,48 @@ const STARTER_TRADES = JSON.stringify({
  * project. Nothing here is ever overwritten — only what is MISSING is written,
  * because everything in this list is the agent's to change once it exists.
  */
+/**
+ * WHAT A SHARED COPY DOES NOT CARRY. A starter like the rest: written when
+ * absent, never touched afterwards, so a project that predates it gets one and
+ * an author who has edited theirs keeps every word.
+ *
+ * The three defaults are the author's OWN output, not the project - the
+ * runner's logs, the trades this job recorded, and the numbers on their
+ * dashboard. Sharing those hands somebody else's record to whoever imports it,
+ * and reads on their Performance page as if it were theirs. Nothing breaks by
+ * holding them back: ensureProjectFiles writes a fresh trades.json and
+ * dashboard.json into the imported copy before its first run.
+ *
+ * They are held back VISIBLY - the share dialog shows them unticked with the
+ * reason - so an author who does mean to publish their record can say so.
+ */
+const STARTER_SHAREIGNORE = `# What this project keeps to itself
+
+Anything listed here is held back when the project is shared. One rule per line.
+A \`#\` is a comment, a list marker is fine, and a plain name matches that file or
+anything under it. A trailing slash means a folder: \`runs/\` holds back
+everything inside it, however deep. A \`*\` is a glob, matched against the whole
+path and against the file's own name, so \`*.csv\` catches one three folders down.
+
+These three are here from the start because they are YOURS, not the project's:
+your logs and your numbers. Delete a line to share it anyway.
+
+- runs/            every past run, and what the runner wrote while working
+- trades.json      the trades this job recorded. Your record, not theirs
+- dashboard.json   what your last run put on the dashboard
+
+Add to it as you build - a downloaded file, a scratch folder, an export somebody
+handed you:
+
+# - add/
+# - data/*.csv
+# - scratch.py
+
+It can only ever hold things BACK. Nothing written here makes a \`.env\`
+shareable: secrets never travel whatever this file says, so this is for what is
+merely private, not for what is dangerous.
+`;
+
 export function starterFiles(slug) {
   return [
     ['README.md', STARTER_README(slug)],
@@ -1626,6 +1668,7 @@ export function starterFiles(slug) {
     ['dashboard.json', STARTER_DASHBOARD_JSON(slug)],
     ['atlas.json', STARTER_MANIFEST],
     ['trades.json', STARTER_TRADES],
+    ['shareignore.md', STARTER_SHAREIGNORE],
     ['.env', '# KEY=value - one per line. Values stay on this computer.\n'],
   ];
 }

package/src/sharing.js

@@ -115,6 +115,93 @@ export function writeExclude(dir, paths) {
 const heldBack = (rel, exclude) =>
   (exclude || []).some((item) => rel === item || rel.startsWith(`${item}/`));
 
+/** The file a project uses to say what it keeps to itself. */
+export const SHAREIGNORE = 'shareignore.md';
+
+/**
+ * Patterns this project holds back on its own account. Mirror of
+ * `sharing.read_shareignore` — the same file is read by whichever CLI happens
+ * to publish, and a project that held something back under one and shipped it
+ * under the other is the worst kind of difference.
+ *
+ * A MARKDOWN FILE WITH PROSE IN IT, because that is what it is called and what
+ * an agent writes. So the reader has to tell a rule from a sentence, and the
+ * test is that A RULE IS A PATH: no spaces in it. Everything else on the line
+ * is a description.
+ *
+ *   - runs/            every past run     ->  runs
+ *   trades.json                           ->  trades.json
+ *   `my report.csv`                       ->  my report.csv
+ *   Anything listed here is held back.    ->  prose, not a rule
+ */
+export function readShareignore(dir) {
+  let raw = '';
+  try { raw = fs.readFileSync(path.join(dir, SHAREIGNORE), 'utf8'); } catch { return []; }
+  const out = new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    let item = line.trim();
+    // A heading or a commented-out rule. Both are the author talking, not
+    // asking for something.
+    if (!item || item.startsWith('#')) continue;
+    if (/^[-*+] /.test(item)) item = item.slice(2).trim();
+    // A description follows the rule after a COLUMN of space (or a tab, or a
+    // `#`), never after the single space that holds a sentence together.
+    item = item.split(/\s{2,}|\t|\s+#/)[0].trim();
+    const quoted = item.startsWith('`') && item.replace(/[.,]+$/, '').endsWith('`');
+    item = item.replace(/^`+|`+$/g, '').trim().replace(/\/+$/, '').trim();
+    if (!item) continue;
+    // THE TEST THAT KEEPS PROSE OUT. A sentence has spaces in it and a path
+    // does not, so anything still carrying one is a line the author wrote to be
+    // read, unless they said otherwise with backticks.
+    if (item.includes(' ') && !quoted) continue;
+    out.add(item);
+  }
+  return [...out].sort();
+}
+
+/**
+ * Does this project's own shareignore hold this file back?
+ *
+ * A plain path matches itself and anything under it; anything with a `*` in it
+ * is matched as a glob, against the whole path AND against the file's own name,
+ * so `*.csv` catches one three folders down without anybody having to write
+ * `**\/*.csv`.
+ */
+export function ignoredHere(rel, patterns) {
+  const name = rel.split('/').pop();
+  for (const item of patterns || []) {
+    if (/[*?[]/.test(item)) {
+      // The three glob characters, and nothing else treated as special: a
+      // pattern is a file name, so a dot or a dash in it means itself.
+      const rx = new RegExp(`^${item.replace(/[.+^${}()|\\]/g, '\\$&')
+        .replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')
+        .replace(/\[([^\]]+)\]/g, '[$1]')}$`);
+      if (rx.test(rel) || rx.test(name)) return true;
+    } else if (rel === item || rel.startsWith(`${item}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * What this project's own shareignore is holding back, as real paths, so the
+ * share dialog can show them ALREADY UNTICKED with the reason. A file simply
+ * missing from the list looks like a file Atlas lost; one shown as auto-ignored
+ * is a decision somebody can see and disagree with.
+ */
+export function heldBackHere(dir) {
+  const patterns = readShareignore(dir);
+  if (!patterns.length) return [];
+  // packableFiles already applies the relay filter and the secret rule; asking
+  // it for everything the author has NOT hand-excluded and then keeping what
+  // this file catches means the two lists can never disagree about what a file
+  // even is.
+  return packableFiles(dir, [], { applyIgnore: false })
+    .filter((rel) => ignoredHere(rel, patterns))
+    .sort();
+}
+
 /**
  * Every file that may leave the machine, as POSIX relative paths.
  *
@@ -122,8 +209,17 @@ const heldBack = (rel, exclude) =>
  * ever SUBTRACTS. Nothing a person can tick makes a `.env` shareable: the two
  * are different kinds of rule and are kept apart on purpose.
  */
-export function packableFiles(dir, exclude) {
+export function packableFiles(dir, exclude, { applyIgnore = true } = {}) {
   const held = exclude === undefined ? readExclude(dir) : (exclude || []);
+  // WHAT THE PROJECT ITSELF HOLDS BACK, on top of the author's own choice. Read
+  // here rather than passed in, because it is the project's rule and not a
+  // caller's: every path that packs a folder gets it without asking.
+  //
+  // `applyIgnore: false` is for the ONE caller that needs the list as it would
+  // be without this file, so it can say what the file caught. It walks the same
+  // folder the same way rather than a second walk that could disagree about
+  // what a file even is.
+  const ignored = applyIgnore ? readShareignore(dir) : [];
   const out = [];
   const walk = (at, prefix) => {
     let items = [];
@@ -136,6 +232,7 @@ export function packableFiles(dir, exclude) {
       if (!item.isFile() || isSecret(item.name)) continue;
       if (parts.length === 1 && HELPERS.has(item.name)) continue;
       if (heldBack(rel, held)) continue;
+      if (ignoredHere(rel, ignored)) continue;
       out.push(rel);
     }
   };
@@ -327,11 +424,21 @@ export async function unpublish(job, root) {
 export function shareState(job, root) {
   const dir = projectDir(job, root);
   const exclude = readExclude(dir);
-  const shareable = packableFiles(dir, []);
+  const packing = packableFiles(dir, []);
+  // SHOWN, THOUGH THEY ARE NOT GOING. A file the project's own shareignore
+  // holds back is already out of `packing`, and a file that simply is not in
+  // the list looks like one Atlas lost. So they are put back into what the
+  // dialog SEES, and named separately as the reason — a decision somebody can
+  // read and disagree with, rather than an absence.
+  const auto = heldBackHere(dir);
+  const shareable = [...new Set([...packing, ...auto])].sort();
   const base = {
     ok: true,
     shared: false,
     mine: true,
+    // Held back by the project itself, not by a tick. The way to change one is
+    // to edit shareignore.md, which is the single place that says so.
+    auto_ignored: auto,
     // Every file that COULD go, whether or not it is going. NOT `files`: that
     // word already means "what is in a package" on the peek side, and one name
     // with two meanings is a bug waiting for a careless reader.