mindvest-atlas 0.96.1 → 0.97.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.96.1",
+  "version": "0.97.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -21,7 +21,7 @@ import {
   takeActionCommands, writeActionReply, actionArgv, runAction, actionHandler, claimAsk, REPLIES_DIR, COMMANDS_DIR,
   writeCommand,
   beatRunner,
-  setPaused, writeHelpers, askModel, listModels, chatModel, answerPermission,
+  setPaused, writeHelpers, askModel, listModels, chatModel, answerPermission, stopChat, chatState,
   createProject, ensureProjectFiles, listChats, readChat, deleteChat, appendChat,
   computerUseAllowed, listComputerSessions, readComputerActions, listComputerVideo, readComputerVideoPart,
   sessionReplay, venvPython, ambientPython,
@@ -431,7 +431,7 @@ async function handleAsk(ask, root) {
     };
     const modelUsed = ask.model || '';
     if (job && chatId) appendChat(job, chatId, 'user', ask.prompt || '', root, undefined, modelUsed);
-    void chatModel(ask.prompt || '', send, { job, model: ask.model || '', chatId })
+    void chatModel(ask.prompt || '', send, { job, model: ask.model || '', chatId, instead: ask.instead === true })
       .catch((err) => send({ kind: 'error', message: String(err?.message || err) }))
       .finally(async () => {
         if (job && chatId) appendChat(job, chatId, 'assistant', said.join(''), root, undefined, modelUsed);
@@ -442,6 +442,17 @@ async function handleAsk(ask, root) {
       });
     return undefined;
   }
+  if (ask.op === 'chat_stop') {
+    // Stop, pressed on the web or said to the voice there: its own ask, like
+    // an answer to a question, because the chat stream is one-way.
+    void stopChat(ask.job || '', ask.chat_id || '', { computer: ask.computer === true, ahead: ask.ahead === true }).then((r) => answer(ask.request_id, r));
+    return undefined;
+  }
+  if (ask.op === 'chat_state') {
+    // Is a run going in that conversation: asked by a page that did not start it.
+    void chatState(ask.job || '', ask.chat_id || '').then((r) => answer(ask.request_id, r));
+    return undefined;
+  }
   if (ask.op === 'permission') {
     // The person's answer to a question the model asked mid-turn. Its own ask,
     // not part of the chat stream: the stream is one-way. `permission_id` is

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.96.1';
+export const VERSION = '0.97.0';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/helpers/atlas_env.js

@@ -2,16 +2,93 @@
 import fs from "node:fs";
 import path from "node:path";
 import url_ from "node:url";
+import os_ from "node:os";
+import childProcess_ from "node:child_process";
 //
 // Values come from the environment Atlas set up before starting this script. Do
 // NOT open .env: this module is the supported way to reach a secret, and the
 // file itself is not something a script or a model needs to read.
 
-/** The value of one secret, for USE — never for printing or logging. */
-export const secret = (name, fallback) => process.env[name] ?? fallback;
+/**
+ * What this project's own .env, and the shared one above it, say NOW.
+ *
+ * A script Atlas starts has every key in its environment already. Two cases
+ * did not, and both were told a key "is not filled in" while it sat in the
+ * file: a listener that had been running since before the key was typed in,
+ * and a script run by hand, by its owner or by a model working in the project.
+ * The file is read HERE, in the one module that is the supported way to reach
+ * a secret. Nothing is printed and nothing is kept.
+ */
+function fileSecrets() {
+  const out = {};
+  const here = path.dirname(url_.fileURLToPath(import.meta.url));
+  let root = process.env.ATLAS_LIBRARY_DIR || process.env.ATLAS_LOCAL_DIR || path.dirname(path.dirname(here));
+  if (root.startsWith("~")) root = path.join(os_.homedir(), root.slice(1));
+  // The shared file first, then the project's own on top: the runner's order.
+  for (const file of [path.join(root, ".env"), path.join(here, ".env")]) {
+    let text;
+    try { text = fs.readFileSync(file, "utf8"); } catch { continue; }
+    for (const raw of text.split("\n")) {
+      const line = raw.trim();
+      if (!line || line.startsWith("#") || !line.includes("=")) continue;
+      const at = line.indexOf("=");
+      const k = line.slice(0, at).trim();
+      let v = line.slice(at + 1).trim();
+      if (v.length >= 2 && v[0] === v[v.length - 1] && (v[0] === String.fromCharCode(34) || v[0] === String.fromCharCode(39))) v = v.slice(1, -1);
+      if (k) out[k] = v;
+    }
+  }
+  return out;
+}
+
+/** The value of one secret, for USE — never for printing or logging. From the
+ *  environment Atlas started this script with; when it is not there, from the
+ *  project's .env as it stands now. */
+export const secret = (name, fallback) => process.env[name] || fileSecrets()[name] || fallback;
 
 /** Whether a secret has been filled in. True/false only, never the value. */
-export const hasSecret = (name) => Boolean(process.env[name]);
+export const hasSecret = (name) => Boolean(secret(name));
+
+/** This computer's own Atlas sign-in, as the atlas CLI keeps it. */
+function signedIn() {
+  const dir = process.env.ATLAS_CONFIG_DIR
+    || (process.env.XDG_CONFIG_HOME ? path.join(process.env.XDG_CONFIG_HOME, "atlas") : path.join(os_.homedir(), ".config", "atlas"));
+  try {
+    const found = JSON.parse(fs.readFileSync(path.join(dir, "credentials.json"), "utf8"));
+    return found && typeof found === "object" ? found : {};
+  } catch { return {}; }
+}
+
+/**
+ * The bearer this script calls Atlas with. Never print it or pass it on.
+ *
+ * Started by Atlas, a script is handed it in its environment. RUN BY HAND (by
+ * its owner in a terminal, or by a model working in the project) it had none,
+ * and every call failed with "no Atlas token" although the person was signed
+ * in on this very computer. It now uses that sign-in: the file the atlas CLI
+ * itself keeps, readable only by this computer's own user, which is the same
+ * person a script started by Atlas acts as.
+ *
+ * What this does NOT do, on purpose: no token is written into the project,
+ * none is printed, none is copied anywhere. Somebody on another computer, or
+ * another user of this one, has no such file and is refused as before. A
+ * sign-in that has run out is renewed by the CLI itself (its output thrown
+ * away), never here.
+ */
+function atlasToken() {
+  if (process.env.ATLAS_TOKEN) return process.env.ATLAS_TOKEN;
+  const usable = (found) => (found.access_token && (!found.expires_at || Date.now() < Number(found.expires_at) - 60000)
+    ? String(found.access_token) : "");
+  const token = usable(signedIn());
+  if (token) return token;
+  try {
+    childProcess_.execFileSync("atlas", ["whoami"], { stdio: "ignore", timeout: 30000, shell: process.platform === "win32" });
+  } catch { /* not signed in, or no atlas on this computer */ }
+  return usable(signedIn());
+}
+
+const NO_TOKEN = "This job has no Atlas token. Is Local Mode signed in? "
+  + "(Run by hand, a script uses the sign-in on this computer: run `atlas login` once.)";
 
 /**
  * Call an Atlas tool over the REST API. Returns the parsed JSON.
@@ -28,8 +105,8 @@ export const hasSecret = (name) => Boolean(process.env[name]);
  */
 export async function atlas(tool, params = {}) {
   const base = (process.env.ATLAS_BASE_URL || "https://atlasmcp.finmanagerai.com").replace(/\/+$/, "");
-  const token = process.env.ATLAS_TOKEN;
-  if (!token) throw new Error("This job has no Atlas token. Is Local Mode signed in?");
+  const token = atlasToken();
+  if (!token) throw new Error(NO_TOKEN);
   const res = await fetch(`${base}/api/v1/tools/${tool}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -232,8 +309,8 @@ function alertMatches(event, match) {
  */
 export async function* alerts({ match = null, timeoutMs = null, reconnect = true } = {}) {
   const base = (process.env.ATLAS_BASE_URL || "https://atlasmcp.finmanagerai.com").replace(/\/+$/, "");
-  const token = process.env.ATLAS_TOKEN;
-  if (!token) throw new Error("This job has no Atlas token. Is Local Mode signed in?");
+  const token = atlasToken();
+  if (!token) throw new Error(NO_TOKEN);
   const deadline = timeoutMs == null ? null : Date.now() + Number(timeoutMs);
   let attempt = 0;
   while (deadline == null || Date.now() < deadline) {

package/src/helpers/atlas_env.py

@@ -8,14 +8,123 @@ import os
 import sys
 
 
+def _file_secrets():
+    """What this project's own .env, and the shared one above it, say NOW.
+
+    A script Atlas starts has every key in its environment already. Two cases
+    did not, and both were told a key "is not filled in" while it sat in the
+    file: a listener that had been running since before the key was typed in
+    (its environment is the one it started with), and a script run by hand, by
+    its owner or by a model working in the project. So one script could say yes
+    and another no about the same key at the same moment.
+
+    The file is read HERE, in the one module that is the supported way to reach
+    a secret. Nothing is printed, nothing is kept, and a script or a model
+    still has no reason to open .env itself.
+    """
+    out = {}
+    here = os.path.dirname(os.path.abspath(__file__))
+    root = (os.environ.get("ATLAS_LIBRARY_DIR") or os.environ.get("ATLAS_LOCAL_DIR")
+            or os.path.dirname(os.path.dirname(here)))
+    quotes = chr(34) + chr(39)
+    # The shared file first, then the project's own on top: the runner's order.
+    for path in (os.path.join(os.path.expanduser(root), ".env"), os.path.join(here, ".env")):
+        try:
+            with open(path, encoding="utf-8") as f:
+                text = f.read()
+        except Exception:
+            continue
+        for raw in text.split("\n"):
+            line = raw.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            k, v = line.split("=", 1)
+            k, v = k.strip(), v.strip()
+            if len(v) >= 2 and v[0] == v[-1] and v[0] in quotes:
+                v = v[1:-1]
+            if k:
+                out[k] = v
+    return out
+
+
 def secret(name, default=None):
-    """The value of one secret, for USE — never for printing or logging."""
-    return os.environ.get(name, default)
+    """The value of one secret, for USE — never for printing or logging.
+
+    From the environment Atlas started this script with; when it is not there,
+    from the project's .env as it stands now (see _file_secrets).
+    """
+    v = os.environ.get(name)
+    if v:
+        return v
+    v = _file_secrets().get(name)
+    return v if v else default
 
 
 def has_secret(name):
     """Whether a secret has been filled in. True/False only, never the value."""
-    return bool(os.environ.get(name))
+    return bool(secret(name))
+
+
+def _signed_in():
+    """This computer's own Atlas sign-in, as the atlas CLI keeps it."""
+    import json as _json
+    base = os.environ.get("ATLAS_CONFIG_DIR") or (
+        os.path.join(os.environ["XDG_CONFIG_HOME"], "atlas") if os.environ.get("XDG_CONFIG_HOME")
+        else os.path.join(os.path.expanduser("~"), ".config", "atlas"))
+    try:
+        with open(os.path.join(base, "credentials.json"), encoding="utf-8") as f:
+            found = _json.load(f)
+        return found if isinstance(found, dict) else {}
+    except Exception:
+        return {}
+
+
+def _atlas_token():
+    """The bearer this script calls Atlas with. Never print it or pass it on.
+
+    Started by Atlas, a script is handed it in its environment. RUN BY HAND
+    (by its owner in a terminal, or by a model working in the project) it had
+    none, and every call failed with "no Atlas token" although the person was
+    signed in on this very computer. It now uses that sign-in: the file the
+    atlas CLI itself keeps, readable only by this computer's own user, which is
+    the same person a script started by Atlas acts as.
+
+    What this does NOT do, on purpose: no token is written into the project,
+    none is printed, none is copied anywhere. Somebody on another computer, or
+    another user of this one, has no such file and is refused as before. A
+    sign-in that has run out is renewed by the CLI itself (its output thrown
+    away), never here.
+    """
+    token = os.environ.get("ATLAS_TOKEN", "")
+    if token:
+        return token
+    import time as _time
+
+    def usable(found):
+        got = found.get("access_token") or ""
+        ends = found.get("expires_at")
+        try:
+            still = (not ends) or _time.time() * 1000 < float(ends) - 60000
+        except Exception:
+            still = False
+        return str(got) if got and still else ""
+
+    token = usable(_signed_in())
+    if token:
+        return token
+    try:
+        import shutil as _shutil
+        import subprocess as _sp
+        cli = _shutil.which("atlas")
+        if cli:
+            _sp.run([cli, "whoami"], stdout=_sp.DEVNULL, stderr=_sp.DEVNULL, stdin=_sp.DEVNULL, timeout=30)
+    except Exception:
+        pass
+    return usable(_signed_in())
+
+
+_NO_TOKEN = ("This job has no Atlas token. Is Local Mode signed in? "
+             "(Run by hand, a script uses the sign-in on this computer: run `atlas login` once.)")
 
 
 #: Tools that read a lot of options flow: minutes on a busy name, not seconds.
@@ -50,9 +159,9 @@ def atlas(tool, **params):
     slug = slug[4:] if slug.startswith("get_") else slug
     wait = params.pop("_timeout", None) or (600 if slug in _SLOW_TOOLS else 120)
     base = os.environ.get("ATLAS_BASE_URL", "https://atlasmcp.finmanagerai.com").rstrip("/")
-    token = os.environ.get("ATLAS_TOKEN", "")
+    token = _atlas_token()
     if not token:
-        raise RuntimeError("This job has no Atlas token. Is Local Mode signed in?")
+        raise RuntimeError(_NO_TOKEN)
     req = urllib.request.Request(
         "%s/api/v1/tools/%s" % (base, tool),
         data=_json.dumps(params).encode("utf-8"),
@@ -370,9 +479,9 @@ def alerts(match=None, timeout=None, reconnect=True):
     import urllib.request
 
     base = os.environ.get("ATLAS_BASE_URL", "https://atlasmcp.finmanagerai.com").rstrip("/")
-    token = os.environ.get("ATLAS_TOKEN", "")
+    token = _atlas_token()
     if not token:
-        raise RuntimeError("This job has no Atlas token. Is Local Mode signed in?")
+        raise RuntimeError(_NO_TOKEN)
     deadline = None if timeout is None else _time.time() + float(timeout)
     attempt = 0
     while True:

package/src/remote-control.js

@@ -2101,7 +2101,7 @@ export async function studioVoice(name, args, allowed, root, opts = {}) {
  * running, an error — so the person watching on the web sees the build happen
  * rather than staring at nothing for two minutes and assuming it hung.
  */
-export async function chatModel(prompt, onEvent, { job = '', model = '', chatId = '', timeoutMs = 1800000 } = {}) {
+export async function chatModel(prompt, onEvent, { job = '', model = '', chatId = '', instead = false, timeoutMs = 1800000 } = {}) {
   const url = process.env.ATLAS_ASK_URL;
   const token = process.env.ATLAS_ASK_TOKEN;
   if (!url || !token) {
@@ -2117,7 +2117,10 @@ export async function chatModel(prompt, onEvent, { job = '', model = '', chatId
       // chat_id: which conversation this is, so Studio gives each web chat its
       // own model session and a Studio chat carried on here reaches the session
       // already open in the app (0.87.0).
-      body: JSON.stringify({ job, prompt: String(prompt), model, chat_id: chatId }),
+      // instead: said to a run that is working, to change what it is doing.
+      // Studio ends the turn in progress and this one takes its place (0.97.0).
+      // Left out unless asked for, so an ordinary message is what it always was.
+      body: JSON.stringify({ job, prompt: String(prompt), model, chat_id: chatId, ...(instead ? { instead: true } : {}) }),
       signal: AbortSignal.timeout(timeoutMs),
     });
     if (!res.ok || !res.body) {
@@ -2148,6 +2151,69 @@ export async function chatModel(prompt, onEvent, { job = '', model = '', chatId
   }
 }
 
+/**
+ * Stop the turn a conversation has in flight on THIS computer (0.97.0).
+ *
+ * Stop pressed on the web used to end only the browser's own stream: nothing
+ * told this computer, so the model carried on, mouse and keyboard included,
+ * and the next message waited behind it. A closed stream cannot mean stop (a
+ * shut laptop looks the same, and a build must outlive that), so Stop is its
+ * own ask, and this passes it to the bridge. `stopped` false when nothing of
+ * that conversation was running.
+ */
+export async function stopChat(job, chatId, { computer = false, ahead = false, timeoutMs = 15000 } = {}) {
+  const url = process.env.ATLAS_ASK_URL;
+  const token = process.env.ATLAS_ASK_TOKEN;
+  if (!url || !token) return { ok: false, error: 'No model is connected on this computer.' };
+  try {
+    const res = await fetch(url.replace('/ask', '/chat/stop'), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Atlas-Token': token },
+      // computer: let go of the mouse and keyboard too (Stop on the live picture).
+      // ahead: the page's own message is still waiting behind another run, and
+      // it is that run that is to end (the message then takes its turn).
+      body: JSON.stringify({ job: String(job || ''), chat_id: String(chatId || ''), ...(computer ? { computer: true } : {}), ...(ahead ? { ahead: true } : {}) }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const out = await res.json().catch(() => ({}));
+    // An Atlas Studio from before this existed answers the address as a chat
+    // with nothing said (400) or as not found: said plainly, so the web can
+    // tell the person the stop did not reach the model.
+    if (!res.ok || !out.ok) return { ok: false, error: 'Atlas Studio on this computer is out of date and cannot be stopped from here. Open it and let it update.' };
+    return { ok: true, stopped: out.stopped === true };
+  } catch (err) {
+    return { ok: false, error: String(err?.message || err) };
+  }
+}
+
+/**
+ * Is a run going in this conversation on THIS computer (0.97.0)?
+ *
+ * A web page that did not start the run (another tab, a phone, the app
+ * itself), or that started it and was then reloaded, had no way to know one
+ * was going, so it showed no Stop. It asks, and Atlas Studio answers yes or
+ * no, and whether the page's own message is still waiting behind it.
+ */
+export async function chatState(job, chatId, { timeoutMs = 8000 } = {}) {
+  const url = process.env.ATLAS_ASK_URL;
+  const token = process.env.ATLAS_ASK_TOKEN;
+  if (!url || !token) return { ok: false, error: 'No model is connected on this computer.' };
+  try {
+    const res = await fetch(url.replace('/ask', '/chat/state'), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Atlas-Token': token },
+      body: JSON.stringify({ job: String(job || ''), chat_id: String(chatId || '') }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const out = await res.json().catch(() => ({}));
+    // An Atlas Studio from before this existed cannot say.
+    if (!res.ok || !out.ok) return { ok: false, error: 'Atlas Studio on this computer is out of date and cannot say what is running. Open it and let it update.' };
+    return { ok: true, running: out.running === true, waiting: out.waiting === true };
+  } catch (err) {
+    return { ok: false, error: String(err?.message || err) };
+  }
+}
+
 /**
  * Hand the model the person's answer to a question it asked mid-turn.
  *