@azure-id/orc 1.4.2 → 1.5.0

package/bin/webui/i18n/en/test.json

@@ -0,0 +1,141 @@
+{
+  "test.title": "Test",
+  "test.sub": "The lane that runs the test. This page renders what the CLI measured. It never sends a request.",
+  "test.none": "No test run here yet",
+  "test.noneHint": "A test run starts with a target you freeze yourself. Nothing here has a default it could guess.",
+  "test.initCmd": "Start one in your terminal:",
+  "test.pick": "Run",
+  "test.pickHint": "Pick a run. The tabs below show what that run measured.",
+
+  "test.strip.state": "State",
+  "test.strip.cases": "Cases",
+  "test.strip.runs": "Runs",
+  "test.strip.findings": "Findings",
+  "test.strip.security": "Security tier",
+  "test.strip.observed": "observed",
+
+  "test.tab.targets": "Targets",
+  "test.tab.surface": "Surface",
+  "test.tab.cases": "Cases",
+  "test.tab.runs": "Runs",
+  "test.tab.findings": "Findings",
+
+  "test.free": "A free action gets a button. An action that costs model tokens gets a command you copy.",
+  "test.paidWhy": "This page runs no lane and dispatches no agent. Copy the command and run it in your terminal.",
+  "test.trafficWhy": "This page never sends a request to the system under test. `orc test run` does, so it is a command you copy and never a button here.",
+
+  "test.target.title": "The frozen target",
+  "test.target.kind": "Kind",
+  "test.target.env": "Environment",
+  "test.target.baseUrl": "Base URL",
+  "test.target.origin": "Origin fence",
+  "test.target.frozen": "The target is frozen at init. This lane does not decide it again.",
+  "test.target.authorized": "Authorized by",
+  "test.target.authorizedNote": "Recorded word for word. ORC never checked it.",
+  "test.target.authorizedEmpty": "Nobody filled this in.",
+  "test.target.destructive": "Destructive writes",
+  "test.target.destructiveReason": "Reason given",
+  "test.target.identities": "Identities",
+  "test.target.oneIdentity": "Fewer than two identities. API1 and API5 cannot be measured. They keep their slot and never become a pass.",
+  "test.target.remoteNote": "This target is remote. ORC starts nothing and stops nothing on a host you do not own.",
+  "test.target.unreadable": "This run's ledger did not parse. It is shown as a row so it is not lost.",
+
+  "test.env.title": "The environment",
+  "test.env.check": "Check the environment",
+  "test.env.checkWhy": "Asks the target whether it is up. It starts nothing, stops nothing and fixes nothing.",
+  "test.env.notStored": "A health state is not stored. It is measured when you ask for it.",
+  "test.env.detected": "Start command found",
+  "test.env.lookedFor": "Files looked at",
+  "test.env.health": "Health paths tried",
+  "test.env.process": "Process",
+  "test.env.logs": "Last log lines",
+  "test.env.vars": "Environment values missing",
+  "test.env.varsNote": "ORC names the missing keys and writes no value for one. Only you know the right value.",
+  "test.env.handBack": "ORC does not repair the system it is testing. Fix it yourself, then check again.",
+
+  "test.surface.title": "The surface",
+  "test.surface.take": "Take the surface",
+  "test.surface.takeWhy": "Reads this repository and the target's own spec document. It costs no model tokens.",
+  "test.surface.none": "The surface has not been taken yet",
+  "test.surface.specDisk": "Spec file here",
+  "test.surface.specTarget": "Spec at the target",
+  "test.surface.frameworks": "Frameworks found",
+  "test.surface.files": "Files read",
+  "test.surface.routes": "Routes",
+  "test.surface.mounts": "Mounted at",
+  "test.surface.mountsNote": "A mounted prefix is listed, never folded into a child route. The child lives in another file and may be mounted twice.",
+  "test.surface.unresolved": "Not worked out",
+  "test.surface.unresolvedNote": "ORC does not guess a route. These need a person to look.",
+  "test.surface.diff": "Code against live",
+  "test.surface.codeOnly": "In the code, not live",
+  "test.surface.liveOnly": "Live, not in the code",
+  "test.surface.notMeasured": "Not measured",
+  "test.surface.inCode": "in the code",
+  "test.surface.notInCode": "not in the code",
+  "test.surface.notLive": "not live",
+  "test.surface.liveYes": "live",
+  "test.surface.liveUnknown": "live state not measured",
+
+  "test.cases.title": "The case matrix",
+  "test.cases.none": "No case has been derived yet",
+  "test.cases.derived": "Derived for free from the surface. Zero model tokens.",
+  "test.cases.budget": "Case budget",
+  "test.cases.budgetReached": "The budget was reached. This is a planned stop, not an interruption.",
+  "test.cases.unfinished": "Not expanded",
+  "test.cases.gap": "gap",
+  "test.cases.gapNote": "A gap is what a schema could not answer. Filling one costs model tokens.",
+  "test.cases.notRun": "not run",
+  "test.cases.identity": "as",
+  "test.cases.mutates": "writes",
+  "test.cases.evidence": "Evidence",
+
+  "test.security.title": "OWASP API Top 10 (2023)",
+  "test.security.closed": "The set is closed. A probe that is not in this table is not a probe this lane runs.",
+  "test.security.detect": "It detects and never exploits. Every probe shows the condition and stops there.",
+  "test.security.tier": "Tier",
+  "test.security.tierDerived": "The cases were derived at this tier. A setting that moved since is named here, not applied.",
+  "test.security.uncheckedNote": "A row it could not measure keeps its slot, never becomes a pass, and never raises the exit code.",
+  "test.security.needs": "Needs",
+  "test.security.probe": "Probe",
+  "test.security.severityWho": "This severity is ORC's. The model's own wording is kept beside it and never used.",
+  "test.security.claimed": "The interpreter said",
+  "test.security.statics": "Read from the code only. Nothing was called.",
+
+  "test.runs.title": "Runs",
+  "test.runs.none": "Nothing has been run yet",
+  "test.runs.cmd": "Run it from your terminal:",
+  "test.runs.stopped": "The ladder stopped at this tier",
+  "test.runs.stoppedWhy": "A red happy path makes the later tiers meaningless, so the run stops and hands back. Fix it and run again for free.",
+  "test.runs.dir": "Written to",
+  "test.runs.flakes": "Flakes",
+  "test.runs.flakesNote": "A flake is recorded, never retried away. The instability is the finding.",
+  "test.runs.was": "was",
+  "test.runs.now": "now",
+
+  "test.findings.title": "Findings",
+  "test.findings.none": "No finding has been recorded",
+  "test.findings.observed": "observed",
+  "test.findings.notObserved": "not observed",
+  "test.findings.notObservedNote": "This was not watched happening. It is a candidate, not a finding, and it gets no CVSS score.",
+  "test.findings.evidenceNote": "Every finding names evidence on disk. One that cannot is dropped by name and counted.",
+  "test.findings.impact": "Impact",
+  "test.findings.fix": "Suggested fix",
+  "test.findings.target": "Target",
+  "test.findings.case": "Case",
+  "test.findings.report": "Render the report",
+  "test.findings.reportWhy": "Writes REPORT.md from the ledger. It works nothing out of its own.",
+  "test.findings.reportAt": "Report",
+  "test.findings.reportMissing": "REPORT.md has not been written yet.",
+  "test.findings.neverStaged": "This folder holds real response bodies from a real system. It is never staged, and ORC does not edit your .gitignore.",
+
+  "test.ui.title": "The front-end driver",
+  "test.ui.version": "Version",
+  "test.ui.minVersion": "Lowest version this lane accepts",
+  "test.ui.binary": "Program",
+  "test.ui.from": "Found in",
+  "test.ui.browsers": "Browser builds",
+  "test.ui.installNote": "ORC names this command and never runs it. It does not install into your project.",
+  "test.ui.noAlternative": "There is no way to drive a real browser without a browser build.",
+  "test.ui.off": "The front-end half is off. That is a setting, not a missing program.",
+  "test.ui.fresh": "Worked out fresh on every read, and never stored."
+}

package/bin/webui/i18n/id/common.json

@@ -64,6 +64,7 @@
   "setting.resetTo": "kembalikan ke {value}",
   "common.open": "Buka",
   "common.writeFail": "Gagal dijalankan",
+  "common.runInTerminal": "Jalankan ini di terminal Anda",
   "common.runInClaude": "Jalankan ini di Claude Code",
   "shortcuts.panelsLetters": "Janji, Batas, Ubah Sendiri, Extra, Contoh Penggunaan Skill",
   "common.confirm": "Konfirmasi"

package/bin/webui/i18n/id/nav.json

@@ -17,6 +17,7 @@
   "nav.challenge": "Challenge",
   "nav.extra": "Extra",
   "nav.wait": "Tunggu",
+  "nav.test": "Test",
   "nav.docs": "Dokumen",
   "nav.hookui": "Antarmuka CLI Hook"
 }

package/bin/webui/i18n/id/overview.json

@@ -78,6 +78,10 @@
   "overview.item.pactBroken.cta": "Buka Janji",
   "overview.item.boundaryRefuse.cta": "Buka Batas",
   "overview.item.docDrifted.cta": "Buka Dokumen",
+  "overview.item.testEnvUnhealthy.cta": "Buka Test",
+  "overview.item.testRunRed.cta": "Buka Test",
+  "overview.item.testUncheckedOwasp.cta": "Buka Test",
+  "overview.item.testEvidenceUnstaged.cta": "Buka Test",
   "overview.item.wikiDebt.cta": "Buka Pengetahuan",
   "overview.item.extraFindings.cta": "Buka Extra",
   "overview.item.legacyGlobalPackage.cta": "Buka Pemeliharaan",

package/bin/webui/i18n/id/test.json

@@ -0,0 +1,141 @@
+{
+  "test.title": "Test",
+  "test.sub": "Jalur yang menjalankan tes. Halaman ini menampilkan apa yang diukur CLI. Halaman ini tidak pernah mengirim permintaan.",
+  "test.none": "Belum ada test run di sini",
+  "test.noneHint": "Sebuah test run dimulai dari target yang Anda bekukan sendiri. Tidak ada nilai baku yang bisa ditebak di sini.",
+  "test.initCmd": "Mulai satu di terminal Anda:",
+  "test.pick": "Run",
+  "test.pickHint": "Pilih satu run. Tab di bawah menampilkan apa yang diukur run itu.",
+
+  "test.strip.state": "Status",
+  "test.strip.cases": "Kasus",
+  "test.strip.runs": "Run",
+  "test.strip.findings": "Temuan",
+  "test.strip.security": "Tingkat keamanan",
+  "test.strip.observed": "teramati",
+
+  "test.tab.targets": "Target",
+  "test.tab.surface": "Permukaan",
+  "test.tab.cases": "Kasus",
+  "test.tab.runs": "Run",
+  "test.tab.findings": "Temuan",
+
+  "test.free": "Tindakan gratis mendapat tombol. Tindakan yang memakai token model mendapat perintah yang Anda salin.",
+  "test.paidWhy": "Halaman ini tidak menjalankan lane dan tidak mengirim agent. Salin perintahnya dan jalankan di terminal Anda.",
+  "test.trafficWhy": "Halaman ini tidak pernah mengirim permintaan ke sistem yang diuji. `orc test run` mengirimnya, jadi itu perintah yang Anda salin dan bukan tombol di sini.",
+
+  "test.target.title": "Target yang dibekukan",
+  "test.target.kind": "Jenis",
+  "test.target.env": "Lingkungan",
+  "test.target.baseUrl": "Base URL",
+  "test.target.origin": "Pagar origin",
+  "test.target.frozen": "Target dibekukan saat init. Jalur ini tidak memutuskannya lagi.",
+  "test.target.authorized": "Diizinkan oleh",
+  "test.target.authorizedNote": "Dicatat kata demi kata. ORC tidak pernah memeriksanya.",
+  "test.target.authorizedEmpty": "Tidak ada yang mengisi ini.",
+  "test.target.destructive": "Penulisan destruktif",
+  "test.target.destructiveReason": "Alasan yang diberikan",
+  "test.target.identities": "Identitas",
+  "test.target.oneIdentity": "Kurang dari dua identitas. API1 dan API5 tidak dapat diukur. Keduanya tetap punya baris dan tidak pernah menjadi lulus.",
+  "test.target.remoteNote": "Target ini remote. ORC tidak menjalankan dan tidak menghentikan apa pun di host yang bukan milik Anda.",
+  "test.target.unreadable": "Buku besar run ini tidak terbaca. Ia tetap ditampilkan sebagai baris agar tidak hilang.",
+
+  "test.env.title": "Lingkungan",
+  "test.env.check": "Periksa lingkungan",
+  "test.env.checkWhy": "Menanyakan ke target apakah ia hidup. Tidak menjalankan, tidak menghentikan, dan tidak memperbaiki apa pun.",
+  "test.env.notStored": "Status kesehatan tidak disimpan. Ia diukur saat Anda memintanya.",
+  "test.env.detected": "Perintah start yang ditemukan",
+  "test.env.lookedFor": "Berkas yang dilihat",
+  "test.env.health": "Jalur health yang dicoba",
+  "test.env.process": "Proses",
+  "test.env.logs": "Baris log terakhir",
+  "test.env.vars": "Nilai lingkungan yang hilang",
+  "test.env.varsNote": "ORC menyebut kunci yang hilang dan tidak menulis nilai untuk satu pun. Hanya Anda yang tahu nilai yang benar.",
+  "test.env.handBack": "ORC tidak memperbaiki sistem yang sedang diujinya. Perbaiki sendiri, lalu periksa lagi.",
+
+  "test.surface.title": "Permukaan",
+  "test.surface.take": "Ambil permukaan",
+  "test.surface.takeWhy": "Membaca repositori ini dan dokumen spesifikasi milik target. Tidak memakai token model.",
+  "test.surface.none": "Permukaan belum diambil",
+  "test.surface.specDisk": "Berkas spesifikasi di sini",
+  "test.surface.specTarget": "Spesifikasi di target",
+  "test.surface.frameworks": "Framework yang ditemukan",
+  "test.surface.files": "Berkas yang dibaca",
+  "test.surface.routes": "Rute",
+  "test.surface.mounts": "Dipasang di",
+  "test.surface.mountsNote": "Awalan yang dipasang hanya didaftar, tidak pernah dilipat ke rute anak. Anak itu ada di berkas lain dan bisa dipasang dua kali.",
+  "test.surface.unresolved": "Belum terpecahkan",
+  "test.surface.unresolvedNote": "ORC tidak menebak rute. Bagian ini perlu dilihat orang.",
+  "test.surface.diff": "Kode dibanding live",
+  "test.surface.codeOnly": "Ada di kode, tidak live",
+  "test.surface.liveOnly": "Live, tidak ada di kode",
+  "test.surface.notMeasured": "Tidak diukur",
+  "test.surface.inCode": "ada di kode",
+  "test.surface.notInCode": "tidak ada di kode",
+  "test.surface.notLive": "tidak live",
+  "test.surface.liveYes": "live",
+  "test.surface.liveUnknown": "status live tidak diukur",
+
+  "test.cases.title": "Matriks kasus",
+  "test.cases.none": "Belum ada kasus yang diturunkan",
+  "test.cases.derived": "Diturunkan gratis dari permukaan. Nol token model.",
+  "test.cases.budget": "Anggaran kasus",
+  "test.cases.budgetReached": "Anggaran tercapai. Ini berhenti terencana, bukan gangguan.",
+  "test.cases.unfinished": "Tidak diperluas",
+  "test.cases.gap": "celah",
+  "test.cases.gapNote": "Celah adalah hal yang tidak bisa dijawab sebuah skema. Mengisinya memakai token model.",
+  "test.cases.notRun": "belum dijalankan",
+  "test.cases.identity": "sebagai",
+  "test.cases.mutates": "menulis",
+  "test.cases.evidence": "Bukti",
+
+  "test.security.title": "OWASP API Top 10 (2023)",
+  "test.security.closed": "Kumpulan ini tertutup. Uji yang tidak ada di tabel ini bukan uji yang dijalankan jalur ini.",
+  "test.security.detect": "Ia mendeteksi dan tidak pernah mengeksploitasi. Setiap uji menunjukkan kondisinya lalu berhenti di situ.",
+  "test.security.tier": "Tingkat",
+  "test.security.tierDerived": "Kasus diturunkan pada tingkat ini. Pengaturan yang berubah sejak itu disebut di sini, bukan diterapkan.",
+  "test.security.uncheckedNote": "Baris yang tidak dapat diukur tetap punya tempat, tidak pernah menjadi lulus, dan tidak pernah menaikkan kode keluar.",
+  "test.security.needs": "Perlu",
+  "test.security.probe": "Uji",
+  "test.security.severityWho": "Tingkat bahaya ini milik ORC. Kata model sendiri disimpan di sebelahnya dan tidak dipakai.",
+  "test.security.claimed": "Penafsir menyebut",
+  "test.security.statics": "Dibaca dari kode saja. Tidak ada yang dipanggil.",
+
+  "test.runs.title": "Run",
+  "test.runs.none": "Belum ada yang dijalankan",
+  "test.runs.cmd": "Jalankan dari terminal Anda:",
+  "test.runs.stopped": "Tangga berhenti di tingkat ini",
+  "test.runs.stoppedWhy": "Jalur bahagia yang merah membuat tingkat berikutnya tidak berarti, jadi run berhenti dan menyerahkan kembali. Perbaiki lalu jalankan lagi secara gratis.",
+  "test.runs.dir": "Ditulis ke",
+  "test.runs.flakes": "Hasil goyah",
+  "test.runs.flakesNote": "Hasil goyah dicatat, tidak pernah diulang sampai hilang. Ketidakstabilan itulah temuannya.",
+  "test.runs.was": "dulu",
+  "test.runs.now": "sekarang",
+
+  "test.findings.title": "Temuan",
+  "test.findings.none": "Belum ada temuan yang dicatat",
+  "test.findings.observed": "teramati",
+  "test.findings.notObserved": "tidak teramati",
+  "test.findings.notObservedNote": "Ini tidak disaksikan terjadi. Ini calon, bukan temuan, dan tidak mendapat skor CVSS.",
+  "test.findings.evidenceNote": "Setiap temuan menyebut bukti di disk. Yang tidak bisa akan digugurkan dengan nama dan dihitung.",
+  "test.findings.impact": "Dampak",
+  "test.findings.fix": "Usulan perbaikan",
+  "test.findings.target": "Target",
+  "test.findings.case": "Kasus",
+  "test.findings.report": "Buat laporan",
+  "test.findings.reportWhy": "Menulis REPORT.md dari buku besar. Ia tidak menghitung apa pun sendiri.",
+  "test.findings.reportAt": "Laporan",
+  "test.findings.reportMissing": "REPORT.md belum ditulis.",
+  "test.findings.neverStaged": "Folder ini menyimpan badan respons asli dari sistem asli. Folder ini tidak pernah di-stage, dan ORC tidak menyunting .gitignore Anda.",
+
+  "test.ui.title": "Penggerak front-end",
+  "test.ui.version": "Versi",
+  "test.ui.minVersion": "Versi terendah yang diterima jalur ini",
+  "test.ui.binary": "Program",
+  "test.ui.from": "Ditemukan di",
+  "test.ui.browsers": "Build peramban",
+  "test.ui.installNote": "ORC menyebut perintah ini dan tidak pernah menjalankannya. Ia tidak memasang apa pun ke proyek Anda.",
+  "test.ui.noAlternative": "Tidak ada cara menggerakkan peramban asli tanpa build peramban.",
+  "test.ui.off": "Bagian front-end mati. Itu pengaturan, bukan program yang hilang.",
+  "test.ui.fresh": "Dihitung baru pada setiap pembacaan, dan tidak pernah disimpan."
+}

package/bin/webui/js/01-i18n.js

@@ -62,6 +62,7 @@ const NAMESPACES = [
   "handoff",
   "challenge",
   "docs",
+  "test",
   "extra",
   "experiment",
   "tour",

package/bin/webui/js/panels/challenge.js

@@ -747,10 +747,15 @@ function challengeOpportunityCard(s, slug, body) {
 }
 
 /* A paid action is a COMMAND, never a button. This renders one, with the reason
-   it is not a button — making the boundary visible rather than hiding it. */
-function laneCommand(cmd, why) {
+   it is not a button — making the boundary visible rather than hiding it.
+
+   `head` is optional and defaults to the Claude Code line every existing caller
+   wants. /orc-test needs the other one: `orc test run` and a Playwright install
+   are TERMINAL commands, and telling somebody to paste a shell command into
+   Claude Code is an instruction that does not work. */
+function laneCommand(cmd, why, head) {
   const box = el("div", "lane-cmd");
-  box.append(el("div", "lane-cmd-head", t("common.runInClaude")));
+  box.append(el("div", "lane-cmd-head", head || t("common.runInClaude")));
   const row = el("div", "row-actions");
   row.append(el("pre", "cmd", cmd));
   const b = el("button", "btn btn-ghost btn-sm", t("common.copy"));

package/bin/webui/js/panels/overview.js

@@ -71,6 +71,16 @@ const FINDING_ROUTE = {
   "statusline-layout-orphaned": { panel: "hookui", cta: "overview.item.statuslineOrphaned.cta" },
   "statusline-layout-invalid": { panel: "hookui", cta: "overview.item.statuslineInvalid.cta" },
   "statusline-layout-unreadable": { panel: "hookui", cta: "overview.item.statuslineUnreadable.cta" },
+  // v1.5.0. The rule again, and all four the same way: every command that
+  // clears one of these — `orc test env`, `orc test report`, `orc test
+  // security` — is on the TEST panel, beside the run it is about.
+  // `test-evidence-unstaged` goes there too even though the fix is a line in
+  // .gitignore that ORC will not write: Test is where the sentence explaining
+  // WHY that folder must never be staged already lives.
+  "test-env-unhealthy": { panel: "test", cta: "overview.item.testEnvUnhealthy.cta" },
+  "test-run-red": { panel: "test", cta: "overview.item.testRunRed.cta" },
+  "test-unchecked-owasp": { panel: "test", cta: "overview.item.testUncheckedOwasp.cta" },
+  "test-evidence-unstaged": { panel: "test", cta: "overview.item.testEvidenceUnstaged.cta" },
 };
 const DEFAULT_FINDING_ROUTE = { panel: "maintenance", cta: "overview.item.doctor.cta" };
 const findingRoute = (id) => FINDING_ROUTE[id] || DEFAULT_FINDING_ROUTE;