@cortad/connector 0.6.6 → 0.6.8

package/lib/origins.mjs

@@ -16,6 +16,9 @@ const NEAR = /origin|cors|allow|client|frontend|web_?url|site_?url|app_?url|publ
 const ENV_ORIGIN = /ORIGIN|CORS|FRONTEND|CLIENT_URL|DOMAIN_CLIENT|WEB_URL|SITE_URL|APP_URL|PUBLIC_URL/;
 const ENV_KEY = /^(?:X_)?API_KEY$|^APP_API_KEY$|^INTERNAL_API_KEY$|^(?:X_)?ADMIN_KEY$|^API_TOKEN$|^AUTH_TOKEN$|^SERVICE_KEY$|^SERVER_KEY$|^ACCESS_CODE$/;
 const ENV_FILES = [".env", ".env.local", ".env.development", ".env.development.local"];
+// The port the server's own code listens on when nothing overrides it (`PORT ?? '3100'`,
+// `.listen(3100`): its own address is never its client, even when this session moved it elsewhere.
+const OWN_PORT = /\bPORT\b['"\]]*\s*(?:\?\?|\|\|)\s*['"]?(\d{2,5})|\.listen\(\s*(\d{2,5})\b/g;
 const FILE_CAP = 512_000;
 
 export const envOf = (root) => {
@@ -33,8 +36,7 @@ export function clientOriginOf(root, { port = null, limit = 4000 } = {}) {
   const scores = new Map();
   const count = (url, by) => scores.set(url, (scores.get(url) ?? 0) + by);
   let seen = 0;
-  const own = port ? Number(port) : null;
-  const portOf = (m) => Number(m[1] ?? (m[0].startsWith("https") ? 443 : 80));
+  const own = new Set(port ? [Number(port)] : []);
   const walk = (dir, depth) => {
     if (depth > 6 || seen > limit) return;
     let entries;
@@ -46,19 +48,21 @@ export function clientOriginOf(root, { port = null, limit = 4000 } = {}) {
       const file = join(dir, e.name);
       let text;
       try { if (statSync(file).size > FILE_CAP) continue; text = readFileSync(file, "utf8"); } catch { continue; }
+      for (const m of text.matchAll(OWN_PORT)) own.add(Number(m[1] ?? m[2]));
       for (const m of text.matchAll(LOCAL)) {
-        if (own && portOf(m) === own) continue;
         const around = text.slice(Math.max(0, m.index - 100), m.index);
         count(m[0], NEAR.test(around) ? 3 : 1);
       }
     }
   };
   walk(root, 0);
-  for (const [name, value] of Object.entries(envOf(root))) {
+  const env = envOf(root);
+  if (/^\d{2,5}$/.test(String(env["PORT"] ?? ""))) own.add(Number(env["PORT"]));
+  for (const [name, value] of Object.entries(env)) {
     if (!ENV_ORIGIN.test(name)) continue;
-    for (const m of String(value).matchAll(LOCAL)) if (!own || portOf(m) !== own) count(m[0], 4);
+    for (const m of String(value).matchAll(LOCAL)) count(m[0], 4);
   }
-  const best = [...scores].sort((a, b) => b[1] - a[1])[0];
+  const best = [...scores].filter(([url]) => !own.has(Number(new URL(url).port || (url.startsWith("https") ? 443 : 80)))).sort((a, b) => b[1] - a[1])[0];
   return best ? best[0] : null;
 }
 

package/local.mjs

@@ -1064,7 +1064,7 @@ const head = (() => {
 const firstStart = startApp();
 firstStart.catch(() => { /* appLife reads the failure */ });
 const archive = join(work, "tree.tgz");
-step("connecting");
+step("connecting to your Cortad account");
 // COPYFILE_DISABLE: a Mac's tar adds no "._name" entries.
 await exec("tar", ["-czf", archive, "-C", root, "-T", list], { env: { ...process.env, COPYFILE_DISABLE: "1" } });
 const bytes = readFileSync(archive);
@@ -1078,7 +1078,7 @@ const parts = Math.max(1, Math.ceil(bytes.length / PART));
 async function sendTree() {
   for (let off = 0; off < bytes.length; off += PART) {
     const last = off + PART >= bytes.length;
-    step(parts > 1 ? `connecting, ${Math.floor(off / PART) + 1} of ${parts}` : "connecting");
+    step(parts > 1 ? `connecting to your Cortad account, ${Math.floor(off / PART) + 1} of ${parts}` : "connecting to your Cortad account");
     // The last part asks for this machine's key when none is stored yet: minted once the repository
     // row exists, kept in ~/.cortad for the runs a coding agent asks for on later days. A connect by a
     // code asks too, since the code may be another account's: the key kept from the account before
@@ -1121,7 +1121,9 @@ async function sendHistory() {
   }
 }
 // Unchanged code has already been read: coming back says so instead of claiming a second read.
-stepDone(moved ? "connected: your change is in, and what Cortad read before still stands" : resumed ? "connected: nothing changed since last time" : "connected");
+// Said of the account, never of the app: a bare "connected" here, above an app that could not take its
+// port, was read as the app being up (2026-11-12).
+stepDone(moved ? "connected to your Cortad account: your change is in, and what Cortad read before still stands" : resumed ? "connected to your Cortad account: your code has not changed since last time" : "connected to your Cortad account");
 if (head) void sendHistory().catch((err) => { if (verbose) say(`commit history not sent: ${err?.message ?? err}`); });
 // The coding agents on this machine learn about Cortad now, once: an MCP entry and a skill in each
 // one's own home folder. A run started by an agent later comes back through lib/cli.mjs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortad/connector",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them.",
   "bin": {
     "cortad": "local.mjs"

package/skill/SKILL.md

@@ -17,7 +17,7 @@ Seven tools:
 - `connect`: connect the live app, the same steps as `npx -y {{cortad}} intelligence`.
 - `tell`: a note to the Cortad team; that a problem's question reads this app wrong (`findingId` and `why`); what counts as a good ending; behavioral questions to propose; an address for incidents.
 
-Where the tools are missing, every command is `npx {{cortad}} <command>` in a shell with the same output, for example `npx {{cortad}} behavior --against previous` or `npx {{cortad}} run_status`. The person's own instructions come before this skill.
+The tools load with the coding agent's next session after the first connect. Until then, and wherever they are missing, every command is `npx {{cortad}} <command>` in a shell with the same output, the normal way to work in that session and nothing to mention to the person, for example `npx {{cortad}} behavior --against previous` or `npx {{cortad}} run_status`. The person's own instructions come before this skill.
 
 ## Talking to the person