mindvest-atlas 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -15,8 +15,8 @@ import { requestJson } from '../api/client.js';
 import { runStream } from '../util/stream-loop.js';
 import { color, eprintln } from '../util/ui.js';
 import {
-  DEFAULT_TIMEOUT_MS, computerName, jobEnv, listJobFiles, listRuns, machineId, osLabel,
-  readJobFile, staleness, summarize, tail, workspace, workspaceRoot,
+  DEFAULT_TIMEOUT_MS, claimRun, computerName, jobEnv, listJobFiles, listRuns, machineId,
+  osLabel, readJobFile, releaseRun, staleness, summarize, tail, workspace, workspaceRoot,
 } from '../remote-control.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -121,6 +121,13 @@ async function runJob(job, root, timeoutMs) {
     return report(job, 'not_built', started, Date.now());
   }
 
+  // ONE RUN PER PROJECT. A schedule firing again mid-run would race two copies
+  // of the same script over one folder, one .env and one broker account.
+  if (!claimRun(dir, name)) {
+    eprintln(color.yellow(`· ${name} — already running, left alone`));
+    return undefined;
+  }
+
   eprintln(color.dim(`▶ ${name}`));
   const env = {
     ...process.env,
@@ -137,17 +144,20 @@ async function runJob(job, root, timeoutMs) {
     eprintln(color.red(`✗ ${name} — timed out`));
     writeLog(dir, job, 'failed', started, finished,
       `Stopped after ${Math.round(timeoutMs / 1000)}s. The script did not finish.\n${tail(r.out) || ''}`);
+    releaseRun(dir);
     return report(job, 'failed', started, finished);
   }
   if (r.error) {
     eprintln(color.red(`✗ ${name} — ${r.error}`));
     writeLog(dir, job, 'failed', started, finished, `${r.error}\n${tail(r.out) || ''}`);
+    releaseRun(dir);
     return report(job, 'failed', started, finished);
   }
   const ok = r.code === 0;
   eprintln((ok ? color.green('✓ ') : color.red('✗ ')) + name
     + color.dim(` (${((finished - started) / 1000).toFixed(1)}s)`));
   writeLog(dir, job, ok ? 'completed' : 'failed', started, finished, tail(r.out));
+  releaseRun(dir);
   return report(job, ok ? 'completed' : 'failed', started, finished);
 }
 

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.6.0';
+export const VERSION = '0.6.2';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/remote-control.js

@@ -223,6 +223,15 @@ export function summarize(output, ok) {
  *  a few KB, and anything past it is a data file the viewer would choke on. */
 export const MAX_VIEW_BYTES = 256 * 1024;
 const SKIP_DIRS = new Set(['.venv', 'node_modules', '__pycache__']);
+/**
+ * Never leaves this computer, for any caller.
+ *
+ * A .env holds the values the user typed — API keys, tokens — and the entire
+ * point of asking them to type those HERE is that they go no further. It is not
+ * listed and it cannot be read: the web has no business seeing even that it
+ * exists at a given size, and neither does a model.
+ */
+const isSecret = (name) => name === '.env' || name.startsWith('.env.');
 
 /**
  * Every job folder and what is in it, as plain metadata.
@@ -249,6 +258,7 @@ export function listJobFiles(root) {
         const abs = path.join(dir, e.name);
         const r = rel ? `${rel}/${e.name}` : e.name;
         if (e.isDirectory()) { walk(abs, r); continue; }
+        if (isSecret(e.name)) continue;
         try {
           const st = fs.statSync(abs);
           files.push({ path: r, size: st.size, modified: st.mtimeMs / 1000 });
@@ -274,6 +284,11 @@ export function readJobFile(job, rel, root) {
   if (target !== base && !target.startsWith(base + path.sep)) {
     return { ok: false, error: "That file is outside this job's folder." };
   }
+  // Refused by NAME, before the file is touched. The values in here were typed
+  // on this computer precisely so they would stay on it.
+  if (isSecret(path.basename(target))) {
+    return { ok: false, error: 'Secrets stay on this computer.' };
+  }
   try {
     if (fs.statSync(target).size > MAX_VIEW_BYTES) {
       return { ok: false, error: 'That file is too large to show here.' };
@@ -292,6 +307,43 @@ export function readJobFile(job, rel, root) {
  * the filename (when, and how it ended) and the log's own second line (how
  * long), which is why the writer stamps both.
  */
+export const RUNNING_MARKER = '.running';
+
+export const runningMarker = (dir) => path.join(dir, 'runs', RUNNING_MARKER);
+
+/**
+ * Take a project's single run slot, or say who already has it.
+ *
+ * ONE RUN PER PROJECT. A job that fires again while its last run is still going
+ * would have two copies of the same script racing over the same folder, the
+ * same .env and the same broker — so the second one does not start. The marker
+ * is a file rather than memory so it survives the runner restarting mid-job and
+ * is visible to anyone looking at the folder.
+ */
+export function claimRun(dir, name) {
+  const m = runningMarker(dir);
+  try {
+    fs.mkdirSync(path.dirname(m), { recursive: true });
+    // Exclusive create: two runners on one folder cannot both win.
+    fs.writeFileSync(m, `${Date.now() / 1000}\n${name || ''}\n`, { flag: 'wx' });
+    return true;
+  } catch (err) {
+    if (err.code !== 'EEXIST') return true; // cannot write a marker: better to run than never
+    let started = 0;
+    try { started = parseFloat(fs.readFileSync(m, 'utf8').split('\n')[0]) || 0; } catch { started = 0; }
+    // A marker left behind by a crash must not wedge a project forever.
+    if (started && Date.now() / 1000 - started > 24 * 3600) {
+      releaseRun(dir);
+      return claimRun(dir, name);
+    }
+    return false;
+  }
+}
+
+export function releaseRun(dir) {
+  try { fs.unlinkSync(runningMarker(dir)); } catch { /* already gone */ }
+}
+
 export function listRuns(root, limit = 50) {
   const base = path.join(workspaceRoot(root), SCRIPTS_DIR);
   const runs = [];
@@ -300,6 +352,19 @@ export function listRuns(root, limit = 50) {
     jobs = fs.readdirSync(base, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch { return runs; }
   for (const job of jobs) {
+    // A project running right now has no log yet — it is the most important row
+    // on the page and would otherwise be invisible until it finished.
+    const m = runningMarker(path.join(base, job));
+    if (fs.existsSync(m)) {
+      let started = Date.now() / 1000;
+      let nm = job;
+      try {
+        const [a, b] = fs.readFileSync(m, 'utf8').split('\n');
+        started = parseFloat(a) || started;
+        if (b) nm = b;
+      } catch { /* mid-write */ }
+      runs.push({ job, name: nm, status: 'running', started_at: started, duration_s: null, log: '' });
+    }
     let files = [];
     try {
       files = fs.readdirSync(path.join(base, job, 'runs')).filter((f) => f.endsWith('.log')).sort().reverse();