@mjasnikovs/pi-task 0.37.0 → 0.37.1

package/dist/task/deep-render-check.d.ts

@@ -49,14 +49,40 @@ export declare function findLoginCredentials(vars: Record<string, string>): Logi
  * FREE — the caller checks freeness and falls back to a reserved port otherwise.
  */
 export declare function pinnedLocalPort(vars: Record<string, string>): number | null;
+/**
+ * One same-origin request the session issued, as the wire saw it. This is the whole
+ * evidence base: `authRequest`, `postAuthDataAttempted` and `postAuthData2xx` below
+ * are DERIVED from this list (deriveLegacyFacts), never recorded separately.
+ *
+ * `mimeType` is here because status alone cannot see a misrouted GET: an SPA
+ * catch-all answers every unmatched GET with index.html at 200, so a dead API call
+ * looks healthy to any status rule and only the content type gives it away.
+ */
+export interface SessionRequest {
+    method: string;
+    path: string;
+    status: number | null;
+    mimeType: string | null;
+    failed: boolean;
+    /** CDP resource type, collapsed: what ISSUED this request. */
+    initiator: 'xhr' | 'document' | 'other';
+    /** Relative to the sign-in request: before it, it, or after it. */
+    phase: 'pre' | 'auth' | 'post';
+}
 export interface DeepSessionFacts {
+    /** Every same-origin request of the whole session, in order. Optional only so
+     *  that a hand-written or pre-existing recorded session stays valid: absent
+     *  means "not recorded", and the request-log rules simply do not fire. The live
+     *  driver always populates it. */
+    sessionRequests?: SessionRequest[];
     /** The landing page presented a sign-in wall (a visible password input). */
     landingHadAuthWall: boolean;
     /** A credential pair was declared by the project. */
     credentialsFound: boolean;
     /** The form could be filled and submitted. */
     submitted: boolean;
-    /** The sign-in request the SUBMIT issued, when one was issued at all. */
+    /** The sign-in request the SUBMIT issued, when one was issued at all.
+     *  Derived: the `sessionRequests` entry in phase 'auth'. */
     authRequest: {
         method: string;
         path: string;
@@ -64,7 +90,7 @@ export interface DeepSessionFacts {
         failed: boolean;
     } | null;
     /** Same-origin XHR/fetch requests issued AFTER the sign-in response, excluding
-     *  the sign-in request itself. */
+     *  the sign-in request itself. Derived: `sessionRequests` in phase 'post'. */
     postAuthDataAttempted: number;
     postAuthData2xx: number;
     /** Origins the client called that are not the app's own, whose requests failed
@@ -78,6 +104,14 @@ export interface DeepSessionFacts {
     postAuthDomOk: boolean;
     postAuthDomDetail: string;
 }
+/**
+ * The three request-shaped facts, computed from the log and from nothing else. The
+ * driver records `sessionRequests` and calls this; the values are exactly what the
+ * pre-log driver computed by filtering the same map (the sign-in request is the
+ * first same-origin non-GET after submit; the data requests are the same-origin
+ * XHR/fetch issued at or after it, itself excluded).
+ */
+export declare function deriveLegacyFacts(log: SessionRequest[]): Pick<DeepSessionFacts, 'authRequest' | 'postAuthDataAttempted' | 'postAuthData2xx'>;
 /**
  * Judge a recorded session. The ONE thing that may FAIL is a session the SERVER
  * authenticated (2xx on the sign-in request) whose client then could not use it:
@@ -109,4 +143,7 @@ export declare function runDeepRenderCheck(url: string, cwd: string, opts?: {
     credentials?: LoginCredentials | null;
     timeoutMs?: number;
     env?: NodeJS.ProcessEnv;
+    /** Recorder hook: receives the facts the verdict was made on. Used by the
+     *  corpus builder; the gate itself never passes it. */
+    onFacts?: (f: DeepSessionFacts) => void;
 }): Promise<DeepRenderOutcome>;

package/dist/task/deep-render-check.js

@@ -194,6 +194,27 @@ export function pinnedLocalPort(vars) {
     }
     return ports.length > 0 ? Math.min(...ports) : null;
 }
+/**
+ * The three request-shaped facts, computed from the log and from nothing else. The
+ * driver records `sessionRequests` and calls this; the values are exactly what the
+ * pre-log driver computed by filtering the same map (the sign-in request is the
+ * first same-origin non-GET after submit; the data requests are the same-origin
+ * XHR/fetch issued at or after it, itself excluded).
+ */
+export function deriveLegacyFacts(log) {
+    const auth = log.find(r => r.phase === 'auth') ?? null;
+    const data = log.filter(r => r.phase === 'post' && r.initiator === 'xhr');
+    return {
+        authRequest: auth === null ? null : ({ method: auth.method, path: auth.path, status: auth.status, failed: auth.failed }),
+        postAuthDataAttempted: data.length,
+        postAuthData2xx: data.filter(r => r.status !== null && r.status >= 200 && r.status < 300)
+            .length
+    };
+}
+/** Statuses that mean "no handler is mounted here", as opposed to a handler that
+ *  answered No. 501 is included because a server that routes but implements
+ *  nothing is the same dead call from the client's side. */
+const MISSING_ROUTE_STATUS = new Set([404, 405, 501]);
 /**
  * Judge a recorded session. The ONE thing that may FAIL is a session the SERVER
  * authenticated (2xx on the sign-in request) whose client then could not use it:
@@ -241,6 +262,36 @@ export function judgeDeepSession(f) {
             note: `submitting the sign-in form issued no request to the app's own origin${pinned} — the authenticated half of the app was NOT observed`
         };
     }
+    // Rule A — a route the server does not have. The client addressed a path
+    // nothing is mounted on, so the request was never evaluated by any handler.
+    // Deliberately narrow: 400/401/403/419/422 are a handler ANSWERING (a rejected
+    // password, a missing permission — the app working), 5xx is the server failing,
+    // and both keep their existing behaviour. Only "no such route" is here.
+    const missingRoute = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr' && r.status !== null && MISSING_ROUTE_STATUS.has(r.status));
+    if (missingRoute) {
+        return {
+            outcome: 'fail',
+            detail: `\`${missingRoute.method} ${missingRoute.path}\` → ${String(missingRoute.status)}: `
+                + 'the client sent this to a path the server does not route. The credentials were '
+                + 'never evaluated. This is a dead client call — a base URL joined twice, a renamed '
+                + 'route, a wrong method. No type or mock can produce a route that is not mounted.'
+        };
+    }
+    // Rule B — the SPA catch-all answering an API call. Any server with a
+    // `GET /*` → index.html fallback returns 200 for a route it does not have, so
+    // the status is healthy and the body is the app shell. A document navigation
+    // answered with HTML is normal; an XHR asking for data and getting HTML is a
+    // call that reached nothing.
+    const swallowed = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr' && (r.mimeType ?? '').startsWith('text/html'));
+    if (swallowed) {
+        return {
+            outcome: 'fail',
+            detail: `\`${swallowed.method} ${swallowed.path}\` → ${String(swallowed.status)} `
+                + `${swallowed.mimeType ?? ''}: an XHR asked this server for data and got the SPA `
+                + 'shell. The route is not mounted and the catch-all answered instead, so the client '
+                + 'sees a 200 it cannot parse. No status check can see this.'
+        };
+    }
     const { method, path: p, status, failed } = f.authRequest;
     if (failed || status === null || status < 200 || status >= 300) {
         return {
@@ -293,6 +344,9 @@ const QUIET_MS = 1_200;
 /** Caps for the two settle windows (initial load, post-submit). */
 const SETTLE_CAP_MS = 8_000;
 const POST_SUBMIT_CAP_MS = 12_000;
+/** Cap for the one authenticated re-entry into the landing URL (see `drive`). Kept
+ *  small so the three settle windows together stay inside DEEP_RENDER_TIMEOUT_MS. */
+const RE_NAV_CAP_MS = 6_000;
 /** Minimal DevTools-protocol client: request/response ids over one socket, plus
  *  event fan-out. Everything the driver needs and nothing more. */
 class Cdp {
@@ -460,7 +514,7 @@ export async function runDeepRenderCheck(url, cwd, opts = {}) {
             child = c;
         }, s => {
             socket = s;
-        }), budget);
+        }, opts.onFacts), budget);
     }
     catch (e) {
         const why = e instanceof Error ? e.message : String(e);
@@ -486,8 +540,14 @@ function withTimeout(p, ms) {
         });
     });
 }
-async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket) {
+async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket, onFacts) {
     const origin = new URL(url).origin;
+    /** Every verdict goes through here, so a recorder sees the same facts the judge
+     *  does — the corpus is what the gate itself read, not a reconstruction. */
+    const judge = (f) => {
+        onFacts?.(f);
+        return judgeDeepSession(f);
+    };
     const child = spawn(bin, [
         '--headless',
         '--disable-gpu',
@@ -531,6 +591,7 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket)
             method: String(req?.method ?? 'GET'),
             type: String(p.type ?? ''),
             status: null,
+            mimeType: null,
             failed: false,
             at: Date.now()
         });
@@ -541,6 +602,9 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket)
         const res = p.response;
         if (r) {
             r.status = typeof res?.status === 'number' ? res.status : r.status;
+            if (typeof res?.mimeType === 'string' && res.mimeType.length > 0) {
+                r.mimeType = res.mimeType;
+            }
             if (p.type)
                 r.type = String(p.type);
         }
@@ -582,13 +646,36 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket)
         }
         return [...out];
     };
-    const facts = (over) => ({
+    const initiatorOf = (r) => isData(r) ? 'xhr'
+        : r.type === 'Document' ? 'document'
+            : 'other';
+    /** The same-origin request log, phased against the sign-in request. `authAt` is
+     *  Infinity before the submit, so every request so far is 'pre'. */
+    const sessionLog = (authId, authAt) => {
+        const out = [];
+        for (const [id, r] of requests) {
+            if (!sameOrigin(r))
+                continue;
+            out.push({
+                method: r.method,
+                path: pathOf(r.url),
+                status: r.status,
+                mimeType: r.mimeType,
+                failed: r.failed,
+                initiator: initiatorOf(r),
+                phase: id === authId ? 'auth'
+                    : r.at >= authAt ? 'post'
+                        : 'pre'
+            });
+        }
+        return out;
+    };
+    const facts = (log, over) => ({
+        sessionRequests: log,
+        ...deriveLegacyFacts(log),
         landingHadAuthWall: before.hasPassword,
         credentialsFound: credentials !== null,
         submitted: false,
-        authRequest: null,
-        postAuthDataAttempted: 0,
-        postAuthData2xx: 0,
         foreignOriginFailures: foreignOriginFailures(),
         leftAuthWall: false,
         urlBefore: before.url,
@@ -597,18 +684,19 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket)
         postAuthDomDetail: '',
         ...over
     });
+    const unsubmitted = (over) => facts(sessionLog(null, Number.POSITIVE_INFINITY), over);
     if (!before.hasPassword || credentials === null)
-        return judgeDeepSession(facts({}));
+        return judge(unsubmitted({}));
     const submitMark = Date.now();
     const filled = await evaluate(fillExpr(credentials.identifier, credentials.password));
     if (!filled?.ok)
-        return judgeDeepSession(facts({ submitted: false }));
+        return judge(unsubmitted({ submitted: false }));
     // Separate turn: the fill's input events schedule framework state updates that
     // the submit handler must already see.
     await sleep(300);
     const submitted = await evaluate(SUBMIT_EXPR);
     if (!submitted?.ok)
-        return judgeDeepSession(facts({ submitted: false }));
+        return judge(unsubmitted({ submitted: false }));
     lastActivity = Date.now();
     await settle(() => lastActivity, POST_SUBMIT_CAP_MS);
     // The sign-in request: the first same-origin non-GET issued by the submit. Its
@@ -625,25 +713,30 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket)
     }
     const authReq = authId !== null ? after.get(authId) : null;
     const authAt = authReq?.at ?? submitMark;
-    const postAuthData = [...after]
-        .filter(([id, r]) => id !== authId && sameOrigin(r) && isData(r) && r.at >= authAt)
-        .map(([, r]) => r);
     const now = await evaluate(INSPECT_EXPR);
     const domJudgment = judgeRenderedDom(now?.html ?? '');
-    return judgeDeepSession(facts({
+    const leftAuthWall = !(now?.hasPassword ?? false) || (now?.pathname ?? '') !== before.pathname;
+    // Exercise the authenticated app once. A sign-in page that ends on a success
+    // card — mx5's does — issues NOTHING after the login POST, so the authenticated
+    // data path is never observed at all and every request-shaped fact below is a
+    // fact about the login form. Re-entering the landing URL with the session cookie
+    // is the cheapest way to make the app fetch its own data. Deliberately gated on
+    // an accepted sign-in that left the wall: every session that SKIPs or FAILs
+    // without it takes exactly the path it took before, request logs included.
+    const authAccepted = authReq !== null
+        && !authReq.failed
+        && authReq.status !== null
+        && authReq.status >= 200
+        && authReq.status < 300;
+    if (authAccepted && leftAuthWall) {
+        await cdp.send('Page.navigate', { url }, sessionId);
+        lastActivity = Date.now();
+        await settle(() => lastActivity, RE_NAV_CAP_MS);
+    }
+    return judge(facts(sessionLog(authId, authAt), {
         submitted: true,
-        authRequest: authReq ?
-            {
-                method: authReq.method,
-                path: pathOf(authReq.url),
-                status: authReq.status,
-                failed: authReq.failed
-            }
-            : null,
-        postAuthDataAttempted: postAuthData.length,
-        postAuthData2xx: postAuthData.filter(r => r.status !== null && r.status >= 200 && r.status < 300).length,
         foreignOriginFailures: foreignOriginFailures(),
-        leftAuthWall: !(now?.hasPassword ?? false) || (now?.pathname ?? '') !== before.pathname,
+        leftAuthWall,
         urlAfter: now?.url ?? before.url,
         postAuthDomOk: domJudgment.ok,
         postAuthDomDetail: domJudgment.detail

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.37.0",
+    "version": "0.37.1",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",