mindvest-atlas 0.96.1 → 0.98.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.96.1",
+  "version": "0.98.0",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/access.js

@@ -0,0 +1,113 @@
+// May this account use Atlas on this computer right now?
+//
+// OWNER, 2026-10-14: "every user must have at least pro plan. first time user
+// can use studio free for 1 week ... it does not matter if the user never used
+// atlas tool at all. we still have web control relay network etc." and, of the
+// command line: "not just command line, if they don't pay, they do not see",
+// "no runs ever runs and no new orders".
+//
+// The server decides (POST /api/computer/access): a paid plan, or the one free
+// week, which it starts the first time an account uses a computer and keeps
+// against the account (in its own settings), never here. This file only asks, keeps
+// the last answer, and lets a computer that cannot reach Atlas carry on until
+// the `good_until` the server gave it (two days after a paid plan was last
+// seen, the end of the free week otherwise).
+//
+// What it gates is decided by its callers: STARTING a run. Nothing here stops
+// a run already going, and nothing closes, cancels or watches less.
+import fs from 'node:fs';
+import path from 'node:path';
+import { configDir } from './config.js';
+import { requestJson, AuthError } from './api/client.js';
+
+export const ACCESS_PATH = '/api/computer/access';
+export const SUBSCRIBE_URL = 'https://mind-vest.io/atlas/subscribe';
+const FILE = 'access.json';
+// Asked at most this often while the answer is yes; a no is asked again sooner,
+// so somebody who has just paid is not kept waiting.
+export const FRESH_MS = 10 * 60_000;
+export const FRESH_NO_MS = 60_000;
+
+export const LOCKED_LINE =
+  `Your free week has ended. Pick a plan in your account to run things on this computer again: ${SUBSCRIBE_URL}`;
+
+function file() {
+  return path.join(configDir(), FILE);
+}
+
+export function readAccess() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(file(), 'utf8'));
+    return raw && typeof raw === 'object' ? raw : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeAccess(rec) {
+  try {
+    fs.mkdirSync(configDir(), { recursive: true });
+    fs.writeFileSync(file(), JSON.stringify(rec, null, 2));
+  } catch { /* the answer still holds for this process */ }
+}
+
+/** The server's answer, reduced to the fields this file trusts. */
+export function fromServer(data, now = Date.now()) {
+  const d = data && typeof data === 'object' ? data : {};
+  const state = ['paid', 'trial', 'ended'].includes(d.state) ? d.state : 'unknown';
+  const good = Date.parse(d.good_until || '');
+  return {
+    allowed: d.allowed === true,
+    state,
+    trial_ends_at: typeof d.trial_ends_at === 'string' ? d.trial_ends_at : null,
+    days_left: Number.isFinite(d.days_left) ? d.days_left : null,
+    good_until: Number.isFinite(good) ? new Date(good).toISOString() : null,
+    checked_at: new Date(now).toISOString(),
+  };
+}
+
+/**
+ * Pure: what a kept answer means at `now`. A yes holds until its good_until;
+ * past that it is a no until the server is asked again. Nothing kept is a no,
+ * with its own sentence: the first answer needs the internet.
+ */
+export function verdict(rec, now = Date.now()) {
+  if (!rec) {
+    return { allowed: false, state: 'unknown',
+      message: 'Connect this computer to the internet once so Atlas can check your plan.' };
+  }
+  const until = Date.parse(rec.good_until || '');
+  const allowed = rec.allowed === true && Number.isFinite(until) && now < until;
+  return { ...rec, allowed, message: allowed ? null : LOCKED_LINE };
+}
+
+function fresh(rec, now) {
+  const at = Date.parse(rec?.checked_at || '');
+  if (!Number.isFinite(at)) return false;
+  return now - at < (rec.allowed ? FRESH_MS : FRESH_NO_MS);
+}
+
+/**
+ * Ask (or reuse a recent answer). `ask` is for tests.
+ *
+ * A server that does not know the question (404: this CLI is newer than the
+ * server) is a yes: a release must never lock everybody out before the server
+ * that decides has gone live. Any other failure falls back to the kept answer.
+ */
+export async function computerAccess({ now = Date.now(), ask = requestJson, force = false } = {}) {
+  const kept = readAccess();
+  if (!force && kept && fresh(kept, now)) return verdict(kept, now);
+  try {
+    // Nothing about this computer is sent: only who is asking (the sign-in).
+    const data = await ask(ACCESS_PATH, { method: 'POST', body: {} });
+    const rec = fromServer(data, now);
+    writeAccess(rec);
+    return verdict(rec, now);
+  } catch (err) {
+    if (err && err.status === 404) return { allowed: true, state: 'unknown', message: null };
+    if (err instanceof AuthError && !verdict(kept, now).allowed) {
+      return { allowed: false, state: 'unknown', message: 'Sign in first: atlas login' };
+    }
+    return verdict(kept, now);
+  }
+}

package/src/cli.js

@@ -18,6 +18,8 @@ import { remoteControlCommand } from './commands/remote-control.js';
 import { updateCliCommand } from './commands/update-cli.js';
 import { screenshotCommand } from './commands/screenshot.js';
 import { runCommand } from './commands/run.js';
+import { computerAccess } from './access.js';
+import { installCommand } from './commands/install.js';
 import { computerUseCommand } from './commands/computer-use.js';
 import { dashboardCommand } from './commands/dashboard.js';
 import { chatSearchCommand } from './commands/chat-search.js';
@@ -119,8 +121,20 @@ export async function main(rawArgs) {
       // RUN SOMETHING INSIDE A PROJECT, which had no entry point at all: an
       // agent that had correctly worked out atlas_env only exists in project
       // code then had nowhere to try it (owner, 2026-09-05).
-      case 'run':
+      // LIBRARIES FOR THIS COMPUTER'S PROJECTS (owner, 2026-10-14), one shared
+      // environment under the Atlas folder; Studio's Libraries tab uses it too.
+      case 'install':
+        return await installCommand(withoutCommand(args));
+      case 'run': {
+        // A run on this computer needs a plan (or the free week): asked
+        // before anything starts, never in the middle of one.
+        const access = await computerAccess();
+        if (!access.allowed) {
+          eprintln(color.yellow(access.message));
+          return 1;
+        }
         return runCommand(withoutCommand(args));
+      }
       // SEEING AND USING THIS COMPUTER, from a shell. It existed only in the
       // Python package, and Atlas Studio bundles THIS one, so the app
       // answered "Unknown command or tool: computer-use" on the very machine

package/src/commands/install.js

@@ -0,0 +1,147 @@
+// `atlas install`: Python libraries for this computer's projects, installed on
+// request (owner, 2026-10-14: "let there be local atlas cli (install - this)
+// which downloads, but users can also install this too").
+//
+// One shared environment under the Atlas folder (`.libraries`), which every
+// project without its own venv runs with (remote-control.js venvPython). It is
+// made the first time something is installed. `uv` is used when it is on this
+// computer (much faster), pip otherwise. Atlas Studio's Libraries tab drives
+// this same command with --json, so there is one way to install.
+//
+//   atlas install <name>[==version] ...   install (or bring up to date)
+//   atlas install --update <name> ...     the newest version
+//   atlas install --remove <name> ...     take it out
+//   atlas install --list [--latest]       what is installed (and what is newer)
+//   --json                                one JSON line, for a program
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import { color, println, eprintln } from '../util/ui.js';
+import { ambientPython, envPython, librariesVenv, whichSync } from '../remote-control.js';
+
+/** A package as pip spells it, with nothing that could be read as an option. */
+export const PACKAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*(\[[A-Za-z0-9,._-]+\])?((==|>=|<=|~=)[A-Za-z0-9.*+!_-]+)?$/;
+
+export function packageName(spec) {
+  return String(spec).replace(/\[.*$/, '').replace(/(==|>=|<=|~=).*$/, '').toLowerCase().replace(/_/g, '-');
+}
+
+const MINUTES = 60_000;
+
+function run(cmd, args, timeoutMs) {
+  const out = spawnSync(cmd, args, { encoding: 'utf8', timeout: timeoutMs, windowsHide: true, maxBuffer: 32 * 1024 * 1024 });
+  return { code: out.status ?? 1, stdout: out.stdout || '', stderr: out.stderr || '', error: out.error };
+}
+
+/** The shared environment, made if it is not there yet. */
+export function ensureEnv(root) {
+  const dir = librariesVenv(root);
+  const py = envPython(dir);
+  if (fs.existsSync(py)) return { ok: true, python: py, dir, made: false };
+  const uv = whichSync('uv');
+  const made = uv
+    ? run(uv, ['venv', dir], 5 * MINUTES)
+    : run(ambientPython()[0], [...ambientPython().slice(1), '-m', 'venv', dir], 5 * MINUTES);
+  if (made.code !== 0 || !fs.existsSync(py)) {
+    return { ok: false, error: `Could not make the libraries folder: ${(made.stderr || made.error?.message || '').trim().split('\n').pop() || 'Python is not on this computer.'}` };
+  }
+  return { ok: true, python: py, dir, made: true };
+}
+
+function pipArgs(py, verb, extra) {
+  const uv = whichSync('uv');
+  if (uv) return [uv, ['pip', verb, '--python', py, ...extra]];
+  if (verb === 'uninstall') extra = ['-y', ...extra];
+  return [py, ['-m', 'pip', verb, '--disable-pip-version-check', ...extra]];
+}
+
+/** What is installed: [{name, version}]. */
+export function installed(root) {
+  const py = envPython(librariesVenv(root));
+  if (!fs.existsSync(py)) return [];
+  const [cmd, args] = pipArgs(py, 'list', ['--format', 'json']);
+  const out = run(cmd, args, 2 * MINUTES);
+  try {
+    const rows = JSON.parse(out.stdout || '[]');
+    return rows.map((r) => ({ name: String(r.name), version: String(r.version) }));
+  } catch {
+    return [];
+  }
+}
+
+/** The newest version and one line about a package, from PyPI (null when unknown). */
+export async function latest(name, fetchImpl = fetch) {
+  try {
+    const r = await fetchImpl(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, { signal: AbortSignal.timeout(15_000) });
+    if (!r.ok) return null;
+    const d = await r.json();
+    return { version: String(d?.info?.version || ''), summary: String(d?.info?.summary || '').slice(0, 200) };
+  } catch {
+    return null;
+  }
+}
+
+export async function installCommand(args) {
+  // A switch followed by a name takes the name as its value (`--remove pandas`):
+  // the switch is on, and the name is one of the names.
+  const flags = { ...(args.flags || {}) };
+  const names = (args.positional || args._ || []).map(String).filter(Boolean);
+  for (const k of ['remove', 'update', 'list', 'latest', 'json']) {
+    const v = flags[k];
+    for (const one of Array.isArray(v) ? v : [v]) if (typeof one === 'string' && one) names.push(one);
+    if (v !== undefined && v !== false) flags[k] = true;
+  }
+  const json = !!flags.json;
+  const say = (obj, human) => {
+    if (json) println(JSON.stringify(obj));
+    else human();
+    return obj.ok ? 0 : 1;
+  };
+
+  if (flags.list) {
+    const list = installed();
+    if (flags.latest) {
+      for (const p of list) {
+        const l = await latest(p.name);
+        if (l?.version) p.latest = l.version;
+      }
+    }
+    return say({ ok: true, installed: list }, () => {
+      if (!list.length) return println(color.dim('Nothing installed yet. `atlas install <name>`'));
+      for (const p of list) {
+        const newer = p.latest && p.latest !== p.version ? color.yellow(`  ${p.latest} is out`) : '';
+        println(`${p.name} ${color.dim(p.version)}${newer}`);
+      }
+    });
+  }
+
+  if (!names.length) {
+    eprintln(color.red('Which library? `atlas install pandas`'));
+    eprintln(color.dim('  --update <name>   the newest version'));
+    eprintln(color.dim('  --remove <name>   take it out'));
+    eprintln(color.dim('  --list            what is installed'));
+    return 1;
+  }
+  const bad = names.find((n) => !PACKAGE_RE.test(n));
+  if (bad) return say({ ok: false, error: `"${bad}" is not a library name.` }, () => eprintln(color.red(`"${bad}" is not a library name.`)));
+
+  const env = ensureEnv();
+  if (!env.ok) return say(env, () => eprintln(color.red(env.error)));
+
+  const verb = flags.remove ? 'uninstall' : 'install';
+  const extra = flags.remove ? names : [...(flags.update ? ['--upgrade'] : []), ...names];
+  if (!json) eprintln(color.dim(`● ${flags.remove ? 'Removing' : 'Installing'} ${names.join(', ')}…`));
+  const [cmd, cmdArgs] = pipArgs(env.python, verb, extra);
+  const out = run(cmd, cmdArgs, 20 * MINUTES);
+  if (out.code !== 0) {
+    const why = (out.stderr || out.stdout || out.error?.message || '').trim().split('\n').filter(Boolean).pop() || 'it did not finish';
+    return say({ ok: false, error: `Could not ${flags.remove ? 'remove' : 'install'} ${names.join(', ')}: ${why}` },
+      () => eprintln(color.red(`✗ ${why}`)));
+  }
+  const now = installed();
+  const wanted = new Set(names.map(packageName));
+  const these = now.filter((p) => wanted.has(packageName(p.name)));
+  return say({ ok: true, installed: these, removed: flags.remove ? names.map(packageName) : undefined }, () => {
+    if (flags.remove) println(color.green(`✓ removed ${names.join(', ')}`));
+    else for (const p of these) println(color.green(`✓ ${p.name} ${p.version}`));
+  });
+}