@instafy/cli 0.5.0 → 0.5.1

package/dist/bind/src/check.mjs

@@ -4,8 +4,8 @@
 // every string in its data files (data.json, data/**/*.json, records included). Items come from --expect and from
 // an "expect" array in data.json. Text that only says an item is unavailable ("Not found yet: Tokyo", a data file's
 // "missing" list) does not count as showing it: builders are told to say on the page what they could not add, and
-// that line must not pass the check. On a page of options it also checks the values (below). Pure helpers are
-// exported for the tests.
+// that line must not pass the check. On a page of options it also checks the values and where each row comes from
+// (below). Pure helpers are exported for the tests.
 // SPDX-License-Identifier: AGPL-3.0-only
 import fs from "node:fs";
 import path from "node:path";
@@ -162,7 +162,9 @@ export function checkSite(dir, expect = []) {
 // Each value on such a page names the page it was read on and the day ("checked 27 Oct on maker.com"), and a value
 // nobody found says so with why; a dash or "n/a" is not a value. A filter from a stated limit ("under €600") counts
 // only values the page shows: the starters' site.byFilter lists a row whose value is unknown apart ("Price
-// unknown"), never as within the limit. These rules read the data the same way site.js draws it.
+// unknown"), never as within the limit. A row of a comparison is a candidate a page read names (a value's or a
+// "sources" page), or only a search result ("found": its site, drawn "Not checked"). These rules read the data the
+// same way site.js and the compare starter draw it.
 
 /** A value that only says nothing is known: blank, dashes, "?", "n/a", "unknown", "TBD" (site.js: no value). */
 export const NO_VALUE = /^(?:[\s\-\u2010-\u2015?.\u00b7\u2026/]*|n\s*\/\s*a|unknown|tb[ad])$/i;
@@ -269,7 +271,38 @@ function liveValue(records, key) {
   return NO_VALUE.test(String(newest.value).trim()) ? null : numberIn(String(newest.value));
 }
 
-/** The values of a site's page of options: problems to fix before the card, and notes for the reply. */
+/** A page a row cites: a value with its source and https page, or a "sources" entry with an https page. */
+const citesPage = (fact) => !!(fact && typeof fact === "object" && !fact.est && fact.src && httpsUrl(fact.url));
+
+/** A site as a search result names it ("reviews.example.net"): a host name, not a word or an address. */
+const SITE_NAME = /^(?=.{1,253}$)(?:[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?\.)+\p{L}[\p{L}\p{N}-]*$/u;
+
+/** The rows of a comparison (the compare starter's data: "columns" and "items") that say nowhere where they come from:
+ *  no value or "sources" entry cites a page that was read, and no "found" names the site of the search result that
+ *  alone names them. Such a row is a guess or a placeholder ("Model 1"): [{item, problem}]. Judged by the data's
+ *  shape, never by the row's words. A list of names the same turn writes (`--expect`, data.json's "expect") only says
+ *  what the page must show; it never vouches for a row. */
+export function uncitedRows(data) {
+  if (!isOptionsData(data) || !Array.isArray(data.columns)) return [];
+  const out = [];
+  for (const item of data.items) {
+    if (!item || typeof item !== "object") continue;
+    const name = String(item.name ?? item.ref ?? "");
+    const facts = [...Object.values(item.facts && typeof item.facts === "object" ? item.facts : {}), ...(Array.isArray(item.more) ? item.more.map((m) => m?.fact) : [])];
+    const sources = Array.isArray(item.sources) ? item.sources : [];
+    if (facts.some(citesPage) || sources.some((s) => s && typeof s === "object" && s.name && httpsUrl(s.url))) continue;
+    if (typeof item.found === "string" && SITE_NAME.test(item.found.trim())) continue;
+    const label = name || "a row";
+    out.push({
+      item: label,
+      problem: `${label}: nothing says where this row comes from. Cite the page you read that names it (a value's "src" and "url", or "sources": [{"name", "url"}]). When only a search result names it, put that result's site in "found" ("found": "example.com"): the page then says it is not checked. Naming it in --expect or "expect" does not count. A row nothing named (a guess, "Model 1") does not belong on the page.`,
+    });
+  }
+  return out;
+}
+
+/** The values of a site's page of options, and where its rows come from: problems to fix before the card, and notes
+ *  for the reply. */
 export function checkValues(dir) {
   const root = path.resolve(dir);
   const problems = [];
@@ -294,6 +327,7 @@ export function checkValues(dir) {
     const list = lacks.length > 1 ? `${lacks.slice(0, -1).join(", ")} or ${lacks[lacks.length - 1]}` : lacks[0];
     if (lacks.length) problems.push(`${where}: "${valueOf(fact)}" has no ${list}: add where you read it and when ("checked 27 Oct on maker.com"), or leave the value out.${fact.src ? "" : " Without a source the page shows it as not checked."}`);
   }
+  for (const row of uncitedRows(data)) problems.push(row.problem);
 
   const filter = data.filter;
   if (filter && typeof filter === "object") {

package/dist/bind/src/starters/compare/app.js

@@ -14,10 +14,13 @@
  *                          unknown?: "Price unknown"}. Only a value the page shows counts: a row whose value is
  *                          unknown is never listed as under $160; it is listed apart, under "Price unknown".
  *   items: [{ref: "option:a", name, why (one short line), badge?: "Previous model", note?, facts: {key: fact},
- *            store: {name, url, readable}, more?: [{label, fact}], sources?: [{name, url}]}]
+ *            store: {name, url, readable}, more?: [{label, fact}], sources?: [{name, url}], found?: "example.com"}]
  *                          every candidate a page you read named, also one nothing could be read for: its cells say
  *                          "Unknown" (a table of unknowns). Empty only when no page named any: it reads "No options yet".
- *   unchecked: ["what was not checked", …]     listed once in the footer
+ *                          A row cites a page you read that names it (a value's or a "sources" page). When only a
+ *                          search result names it, "found" is that result's site instead, and the row says "Not
+ *                          checked". `instafy bind check` fails a row with neither: a guess or a placeholder.
+ *   unchecked: ["what was not checked", …]     listed once in the footer, on an empty page too
  *   fact: {"v": "$145", "src": "Example Store", "url": "https://…", "date": "2026-10-17", "asof"?: "2026-08-05", "est": false}
  *   Each value cites its page and day ("checked 17 Oct on maker.com ↗"), and no cell is blank: a source you read that
  *   does not give the value is the fact without "v" ({"src", "url", "date"}): "Not listed · checked 17 Oct on
@@ -126,7 +129,9 @@
     }
     return site.trust(valueOf(item, col), { shared: isShared(src.cols, item, col) || ownRow(src.rows, item, col), label: label, unknown: "Unknown" });
   }
-  function hasMore(item) { return !!(item.note || (item.more && item.more.length) || (item.sources && item.sources.length)); }
+  function hasMore(item) { return !!(item.note || found(item) || (item.more && item.more.length) || (item.sources && item.sources.length)); }
+  /** The site of the search result that alone names this row ("found"), or "". */
+  function found(item) { return typeof item.found === "string" ? item.found.trim().slice(0, 100) : ""; }
 
   /** The "Sort by" select shows (and rows are sorted) only with 5 or more options and more than one way to sort. */
   function sortShown(data) { return (data.sort || []).length > 1 && (data.items || []).length >= 5; }
@@ -235,8 +240,8 @@
     sources = sources.filter(function (s) {
       return !named.some(function (f) { return f.src === s.name || (site.host(f.url) && site.host(f.url) === site.host(s.url)); });
     });
-    // the footer belongs to a list: an empty page has nothing to confirm
-    site.notes(items.length ? data.unchecked : [], items.length ? sources : []);
+    // what was not checked is said on an empty page too: it is why the page is empty
+    site.notes(data.unchecked, sources);
   }
 
   /** "2 without a price are listed last." when the sort key is missing for some rows. */
@@ -275,7 +280,8 @@
 
   function nameBlock(item) {
     return [
-      h("div", { "class": "name-line" }, h("span", { "class": "name", text: item.name }), item.badge ? h("span", { "class": "badge", text: item.badge }) : null),
+      h("div", { "class": "name-line" }, h("span", { "class": "name", text: item.name }), item.badge ? h("span", { "class": "badge", text: item.badge }) : null,
+        found(item) ? h("span", { "class": "badge", text: "Not checked" }) : null),
       item.why ? h("p", { "class": "cap", text: item.why }) : null
     ];
   }
@@ -296,6 +302,7 @@
     var sources = (item.sources || []).filter(function (s) { return s && !linked[s.url]; });
     return h("div", { "class": "more" },
       item.note ? h("p", { text: item.note }) : null,
+      found(item) ? h("p", { "class": "cap", text: "Named in a search result on " + found(item) + "." }) : null,
       facts.length ? h("dl", { "class": "facts" }, facts.map(function (f) {
         return h("div", null, h("dt", { text: f.label }), h("dd", null, site.trust(f.fact)));
       })) : null,

package/dist/cli.js

@@ -1330,6 +1330,8 @@ var require_redaction = __commonJS({
       const opaqueCandidatePattern = /[A-Za-z0-9][A-Za-z0-9_\-+/=~]{18,}[A-Za-z0-9=]/g;
       const digitCodePattern = /(?<![\d.,][ \u00a0]?)(?:\d{6,8}|\d{3}[ \u00a0]\d{3}|\d{4}[ \u00a0]\d{4})(?![\d]|[.,]\d)/g;
       const codeWordPattern = /(?<![\p{L}])(?:codes?|kode|otp|passcode|pin|tan|2fa|mfa|(?:best(?:ä|ae)tigungs|sicherheits|verifizierungs|verifikations|zugangs|anmelde|freigabe|authentifizierungs|wiederherstellungs|einmal)code)(?![\p{L}])/iu;
+      const DIGIT_CODE_SOURCE = digitCodePattern.source;
+      const CODE_WORD_SOURCE = codeWordPattern.source;
       const NEARBY_CHARACTERS = 120;
       const CODE_NEARBY_CHARACTERS = 32;
       const HEX_NEARBY_CHARACTERS = 32;
@@ -1556,6 +1558,9 @@ var require_redaction = __commonJS({
         CREDENTIAL_CONTEXT_SOURCE,
         PLACEHOLDER_SOURCE,
         MASKED_TEXT_SOURCE,
+        DIGIT_CODE_SOURCE,
+        CODE_WORD_SOURCE,
+        CODE_NEARBY_CHARACTERS,
         SECRET_SCREEN_MESSAGE,
         hasCredentialWord: hasCredentialWord2,
         looksRandom: looksRandom3,
@@ -9811,7 +9816,9 @@ async function runSiteCheck(opts) {
   const port = parsePreviewPort(opts.port, env);
   const sitePath = parseCheckPath(opts.path);
   const timeoutMs = opts.timeoutMs ?? 3e4;
-  const viewports = VIEWPORTS.filter((v) => !opts.phone || v.name === "phone");
+  const viewports = VIEWPORTS.filter(
+    (v) => !opts.phone && !opts.desktop ? true : opts.phone && v.name === "phone" || opts.desktop && v.name === "desktop"
+  );
   let outDir = null;
   if (opts.outDir !== void 0) {
     outDir = path12.resolve(opts.outDir);
@@ -9925,12 +9932,14 @@ async function runPreviewCheckCli(opts, io = { out: console.log, err: console.er
     const port = parsePreviewPort(opts.port, env);
     const sitePath = parseCheckPath(opts.path);
     const wantsThumbnail = Boolean(io.uploadThumbnail && io.hasOpenPreview?.(port, sitePath));
+    const takenAt = Date.now();
     const result = await runSiteCheck({
       port,
       path: opts.path,
       thumbnail: wantsThumbnail,
       proxyServer: io.proxyServer,
       phone: opts.phone,
+      desktop: opts.desktop,
       framed: opts.framed,
       workspacePlaywright: opts.workspacePlaywright,
       outDir: opts.out,
@@ -9945,7 +9954,9 @@ async function runPreviewCheckCli(opts, io = { out: console.log, err: console.er
     }
     if (wantsThumbnail && result.thumbnail && io.uploadThumbnail) {
       const shot = result.thumbnail;
-      const outcome = "skipped" in shot ? { status: "skipped", reason: shot.skipped } : await io.uploadThumbnail({ port, path: sitePath, image: shot.image, description: shot.description }).catch((error) => ({ status: "failed", reason: firstLine(error) }));
+      if ("skipped" in shot) await io.pictureTried?.({ port, path: sitePath, takenAt }).catch(() => {
+      });
+      const outcome = "skipped" in shot ? { status: "skipped", reason: shot.skipped } : await io.uploadThumbnail({ port, path: sitePath, image: shot.image, description: shot.description, takenAt }).catch((error) => ({ status: "failed", reason: firstLine(error) }));
       if (outcome) {
         result.report.thumbnail = outcome.status;
         if (outcome.reason) result.report.thumbnailReason = outcome.reason;
@@ -9965,7 +9976,7 @@ async function runPreviewCheckCli(opts, io = { out: console.log, err: console.er
 function registerPreviewCheckCommand(preview, card = {}) {
   return preview.command("check").description(
     "Load a local site in a headless browser and report its title, errors, failed requests and a blank page; writes desktop and phone screenshots, and refreshes the picture on the card of a preview open on that port (exit 1: problems, 2: nothing answering, 3: port not allowed, 4: no browser, 64: bad options, 70: the check itself failed)"
-  ).option("--port <port>", "Local port the site listens on (1024-65535)").option("--path <path>", "Path to load (default /); a ?query and #hash are fine").option("--phone", "Only the phone size (390\xD7844); default: desktop 1280\xD7800 and phone").option("--framed", "Load the site inside a frame on another origin, and report a site that refuses to be framed").option("--workspace-playwright", "Also look for Playwright in this project's node_modules (runs the project's own copy)").option("--out <dir>", "Folder for desktop.png and phone.png (default: a new private folder under the temp folder each run; the report names it)").option("--timeout <ms>", "Page load timeout in ms (default 30000)").option("--wait <ms>", "Extra settle time after load in ms (default 600)").option("--json", "Output JSON").action(async (opts) => {
+  ).option("--port <port>", "Local port the site listens on (1024-65535)").option("--path <path>", "Path to load (default /); a ?query and #hash are fine").option("--phone", "Only the phone size (390\xD7844); default: desktop 1280\xD7800 and phone").option("--desktop", "Only the desktop size (1280\xD7800), the one the card's picture is taken from").option("--framed", "Load the site inside a frame on another origin, and report a site that refuses to be framed").option("--workspace-playwright", "Also look for Playwright in this project's node_modules (runs the project's own copy)").option("--out <dir>", "Folder for desktop.png and phone.png (default: a new private folder under the temp folder each run; the report names it)").option("--timeout <ms>", "Page load timeout in ms (default 30000)").option("--wait <ms>", "Extra settle time after load in ms (default 600)").option("--json", "Output JSON").action(async (opts) => {
     process.exitCode = await runPreviewCheckCli(opts, { out: console.log, err: console.error, ...card });
   });
 }
@@ -10395,10 +10406,10 @@ function lockHolderIsGone(lockFile) {
     return false;
   }
 }
-async function withStateLock(fn) {
+async function withStateLock(fn, waitMs = STATE_LOCK_WAIT_MS) {
   const lockFile = previewStateLockFile();
   fs12.mkdirSync(instafyDir(), { recursive: true });
-  const deadline = Date.now() + STATE_LOCK_WAIT_MS;
+  const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
       const fd = fs12.openSync(lockFile, "wx", 384);
@@ -11135,7 +11146,11 @@ ${started.logTail}` : "";
     ...binary ? { binary } : {},
     ...hostSuffix ? { hostSuffix } : {},
     ...studioOrigin ? { studioOrigin } : {},
-    ...siteRecord
+    ...siteRecord,
+    ...serve ? { siteDir: serve.cwd } : {},
+    // The same preview opened again keeps its picture until a new one is uploaded.
+    ...current?.pictureAt ? { pictureAt: current.pictureAt } : {},
+    ...opts.thumbnail === false ? { noThumbnail: true } : {}
   };
   upsertPreviewState(entry);
   return { grant, previewId, entry, current };
@@ -11241,8 +11256,10 @@ async function previewOpen(opts) {
     thumbnail = { status: "skipped", reason: "the site is not live through the preview yet" };
   } else {
     if (!opts.thumbnailFile) log("Taking a picture of the site for its card\u2026");
+    const takenAt = Date.now();
     const attempt2 = opts.thumbnailFile ? readThumbnailFile(opts.thumbnailFile) : await captureSiteThumbnail({ port, path: sitePath, host: "127.0.0.1" });
     thumbnail = "thumbnail" in attempt2 ? await uploadPreviewThumbnail({ controllerUrl, auth, projectId: projectId2, previewId, thumbnail: attempt2.thumbnail, retryCommand }) : { status: attempt2.status, reason: attempt2.reason };
+    if (thumbnail.status === "uploaded" || !opts.thumbnailFile) await recordPictured(previewId, takenAt);
   }
   return {
     previewId,
@@ -11286,12 +11303,30 @@ async function uploadPreviewThumbnail(params) {
     return { status: "failed", reason: message.slice(0, 300) };
   }
 }
+var PICTURE_RECORD_LOCK_WAIT_MS = 5e3;
+async function recordPictured(previewId, takenAt) {
+  try {
+    await withStateLock(async () => {
+      const state = readStateFile2();
+      const entry = state.previews.find((preview) => preview.previewId === previewId);
+      if (!entry || (entry.pictureAt ?? 0) >= takenAt) return;
+      entry.pictureAt = takenAt;
+      writeStateFile2(state);
+    }, PICTURE_RECORD_LOCK_WAIT_MS);
+  } catch {
+  }
+}
 function openPreviewFor(port, sitePath) {
-  return readStateFile2().previews.find((entry) => entry.localPort === port && entry.path === sitePath && entry.pid > 0) ?? null;
+  const entry = readStateFile2().previews.find((preview) => preview.localPort === port && preview.path === sitePath && preview.pid > 0);
+  return entry && !entry.noThumbnail ? entry : null;
 }
 function hasOpenPreviewFor(port, sitePath) {
   return openPreviewFor(port, sitePath) !== null;
 }
+async function recordCheckPictureTried(input3) {
+  const entry = openPreviewFor(input3.port, input3.path);
+  if (entry) await recordPictured(entry.previewId, input3.takenAt);
+}
 async function uploadCheckThumbnail(input3) {
   const entry = openPreviewFor(input3.port, input3.path);
   if (!entry) return null;
@@ -11306,9 +11341,13 @@ async function uploadCheckThumbnail(input3) {
   if (cleanUrl(controllerUrl) !== cleanUrl(entry.controllerUrl)) {
     return { status: "skipped", reason: "the preview was opened on another server" };
   }
+  const takenAt = input3.takenAt ?? Date.now();
   const facts = sniffImage(input3.image);
-  if (!facts) return { status: "skipped", reason: "the picture is not a JPEG" };
-  return uploadPreviewThumbnail({
+  if (!facts) {
+    await recordPictured(entry.previewId, takenAt);
+    return { status: "skipped", reason: "the picture is not a JPEG" };
+  }
+  const outcome = await uploadPreviewThumbnail({
     controllerUrl,
     auth,
     projectId: entry.projectId,
@@ -11316,6 +11355,8 @@ async function uploadCheckThumbnail(input3) {
     thumbnail: { image: input3.image, ...facts, source: "capture", description: input3.description },
     retryCommand
   });
+  await recordPictured(entry.previewId, takenAt);
+  return outcome;
 }
 function toPreviewSummary(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -13458,7 +13499,7 @@ function liveTurn(env, now) {
 }
 function keyless(chain) {
   const find = chain === DEFAULT_CHAIN ? 'find official sites with `instafy web search "<name>" --chain reference-search` (no key) and read them' : "read the official sites you know of";
-  return `Go on without it: ${find}, and the pages of publishers you know cover this, with \`instafy web read\`. Then answer or build the page with what you read, each missing fact marked unknown with why. The person may send more pages with Send page to Octo.`;
+  return `Go on without it: ${find}, and for reviews a reviewer's home page and the pages it links, with \`instafy web read\`. Then answer or build the page with what you read, each missing fact marked unknown with why. The person may send more pages with Send page to Octo.`;
 }
 function tellFor(status, chain) {
   switch (status) {
@@ -18916,7 +18957,11 @@ function exitWithPreviewError(error) {
 }
 var previewCommand = program.command("preview").description("Look at sites running in this space, and show them in Studio as a private preview card");
 failWithGroupHelp(previewCommand);
-registerPreviewCheckCommand(previewCommand, { hasOpenPreview: hasOpenPreviewFor, uploadThumbnail: uploadCheckThumbnail });
+registerPreviewCheckCommand(previewCommand, {
+  hasOpenPreview: hasOpenPreviewFor,
+  uploadThumbnail: uploadCheckThumbnail,
+  pictureTried: recordCheckPictureTried
+});
 var webCommand = registerWebSearchCommand(registerWebLinkCommand(registerWebCommand(program)));
 failWithGroupHelp(webCommand);
 var webSettingsCommand = webCommand.command("settings").description("Inspect or change the space's shared research budget for new tasks");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instafy/cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "AGPL-3.0-only",
   "description": "Run Instafy spaces locally, link folders to Studio, and share previews/webhooks via tunnels.",
   "private": false,