mindvest-atlas 0.6.2 → 0.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -17,6 +17,7 @@ import { color, eprintln } from '../util/ui.js';
 import {
   DEFAULT_TIMEOUT_MS, claimRun, computerName, jobEnv, listJobFiles, listRuns, machineId,
   osLabel, readJobFile, releaseRun, staleness, summarize, tail, workspace, workspaceRoot,
+  writeHelpers,
 } from '../remote-control.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -128,6 +129,10 @@ async function runJob(job, root, timeoutMs) {
     return undefined;
   }
 
+  // Refreshed every run, so a job always has the supported way to reach a
+  // secret and never a reason to open .env itself.
+  writeHelpers(dir);
+
   eprintln(color.dim(`▶ ${name}`));
   const env = {
     ...process.env,

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.6.2';
+export const VERSION = '0.6.3';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/remote-control.js

@@ -168,6 +168,70 @@ export function readEnvFile(file) {
  * Shared first so a key is typed once; the job's own last so a job that wants
  * its own value gets it. Neither is required.
  */
+/**
+ * Written into every job folder before it runs, in both languages.
+ *
+ * The job imports this instead of opening .env — so the script the model writes
+ * has no reason to touch the file, and a model debugging that script has nothing
+ * to learn by trying. Regenerated on every run, so editing or deleting it
+ * changes nothing.
+ */
+export function writeHelpers(dir) {
+  const py = `"""Secrets for this job. Written by Atlas — edits are overwritten.
+
+Values come from the environment Atlas set up before starting this script. Do
+NOT open .env: this module is the supported way to reach a secret, and the file
+itself is not something a script or a model needs to read.
+"""
+import os
+import sys
+
+
+def secret(name, default=None):
+    """The value of one secret, for USE — never for printing or logging."""
+    return os.environ.get(name, default)
+
+
+def has_secret(name):
+    """Whether a secret has been filled in. True/False only, never the value."""
+    return bool(os.environ.get(name))
+
+
+def require(*names):
+    """Stop cleanly when a secret has not been filled in yet."""
+    missing = [n for n in names if not os.environ.get(n)]
+    if missing:
+        print("Missing: %s. Add the value in Atlas Remote Control, then run again."
+              % ", ".join(missing))
+        sys.exit(2)
+`;
+  const js = `// Secrets for this job. Written by Atlas — edits are overwritten.
+//
+// Values come from the environment Atlas set up before starting this script. Do
+// NOT open .env: this module is the supported way to reach a secret, and the
+// file itself is not something a script or a model needs to read.
+
+/** The value of one secret, for USE — never for printing or logging. */
+export const secret = (name, fallback) => process.env[name] ?? fallback;
+
+/** Whether a secret has been filled in. True/false only, never the value. */
+export const hasSecret = (name) => Boolean(process.env[name]);
+
+/** Stop cleanly when a secret has not been filled in yet. */
+export function require_(...names) {
+  const missing = names.filter((n) => !process.env[n]);
+  if (missing.length) {
+    console.log(\`Missing: \${missing.join(", ")}. Add the value in Atlas Remote Control, then run again.\`);
+    process.exit(2);
+  }
+}
+`;
+  try {
+    fs.writeFileSync(path.join(dir, 'atlas_env.py'), py);
+    fs.writeFileSync(path.join(dir, 'atlas_env.js'), js);
+  } catch { /* a helper is a courtesy, never a failure */ }
+}
+
 export function jobEnv(dir, root) {
   return { ...readEnvFile(path.join(workspaceRoot(root), '.env')), ...readEnvFile(path.join(dir, '.env')) };
 }