cortad 0.1.10 → 0.1.12

package/lib/identities.mjs

@@ -26,7 +26,7 @@ const SOURCE = /^(?:env:[A-Z_][A-Z0-9_]*(?:\|[A-Z_][A-Z0-9_]*)*|gen:(?:username|
 // before the program saw it. Still no quote, angle bracket, `$`, backtick or semicolon.
 const WHERE = /^[\w./:@()[\] -]{1,300}$/;
 const BASE = /^http:\/\/(?:127\.0\.0\.1|\[::1\]|localhost):\d{2,5}$/;
-const KINDS = new Set(["header", "login", "jwt", "upstream", "firebase"]);
+const KINDS = new Set(["header", "login", "jwt", "upstream", "firebase", "authjs", "supabase"]);
 const STATUSES = new Set(["minted", "sealed", "absent", "refused", "unreachable", "upstream"]);
 
 const slug = (role) => role.replace(/[^a-z0-9-]/g, "-");
@@ -245,6 +245,13 @@ def b64url(raw):
     return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
 
 
+def hs256(secret, claims):
+    head = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode("utf-8"))
+    body = b64url(json.dumps(claims, separators=(",", ":")).encode("utf-8"))
+    sig = b64url(hmac.new(secret.encode("utf-8"), ("%s.%s" % (head, body)).encode("ascii"), hashlib.sha256).digest())
+    return "%s.%s.%s" % (head, body, sig)
+
+
 def jwt(recipe, env):
     secret = source("env:" + "|".join(recipe["env"]), env, None, None)
     if not secret:
@@ -257,10 +264,163 @@ def jwt(recipe, env):
     claim = recipe.get("claim") or "sub"
     if claim not in claims:
         claims[claim] = TEST
-    head = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode("utf-8"))
-    body = b64url(json.dumps(claims, separators=(",", ":")).encode("utf-8"))
-    sig = b64url(hmac.new(secret.encode("utf-8"), ("%s.%s" % (head, body)).encode("ascii"), hashlib.sha256).digest())
-    return minted("authorization", "%s.%s.%s" % (head, body, sig))
+    return minted("authorization", hs256(secret, claims))
+
+
+# GoTrue signs its access token HS256 with the project's JWT secret; RLS reads sub as auth.uid()
+# and role as auth.role(). The id is a well-formed uuid that belongs to nobody, never a real row.
+SUPA_UID = "00000000-0000-4000-8000-000000009001"
+
+
+def supabase(recipe, env):
+    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
+    if not secret:
+        return {"status": "absent", "note": " or ".join(recipe["env"])}
+    now = int(time.time())
+    claims = {"sub": SUPA_UID, "aud": "authenticated", "role": "authenticated", "iat": now, "exp": now + TTL, "is_anonymous": False}
+    return minted("authorization", hs256(secret, claims))
+
+
+# Auth.js v5 (and next-auth v5) seals its session as a JWE, not a signed JWT: dir key management,
+# A256CBC-HS512 content encryption, the key derived from the secret with HKDF over the cookie name.
+# Verified against the @auth/core jwt.ts encode path. next-auth v4 (A256GCM) is not minted here.
+def hkdf_sha256(secret, salt, info, length):
+    salt = salt or bytes(hashlib.sha256().digest_size)
+    prk = hmac.new(salt, secret, hashlib.sha256).digest()
+    out, block, i = b"", b"", 1
+    while len(out) < length:
+        block = hmac.new(prk, block + info + bytes([i]), hashlib.sha256).digest()
+        out += block
+        i += 1
+    return out[:length]
+
+
+AES_SBOX = bytes.fromhex(
+    "637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0"
+    "b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b275"
+    "09832c1a1b6e5aa0523bd6b329e32f8453d100ed20fcb15b6acbbe394a4c58cf"
+    "d0efaafb434d338545f9027f503c9fa851a3408f929d38f5bcb6da2110fff3d2"
+    "cd0c13ec5f974417c4a77e3d645d197360814fdc222a908846eeb814de5e0bdb"
+    "e0323a0a4906245cc2d3ac629195e479e7c8376d8dd54ea96c56f4ea657aae08"
+    "ba78252e1ca6b4c6e8dd741f4bbd8b8a703eb5664803f60e613557b986c11d9e"
+    "e1f8981169d98e949b1e87e9ce5528df8ca1890dbfe6426841992d0fb054bb16")
+AES_RCON = (0, 1, 2, 4, 8, 16, 32, 64)
+
+
+def _aes_mul(a, b):
+    r = 0
+    for _ in range(8):
+        if b & 1:
+            r ^= a
+        hi = a & 0x80
+        a = (a << 1) & 0xFF
+        if hi:
+            a ^= 0x1B
+        b >>= 1
+    return r
+
+
+def _aes_expand(key):
+    w = [list(key[i:i + 4]) for i in range(0, 32, 4)]
+    for i in range(8, 60):
+        t = list(w[i - 1])
+        if i % 8 == 0:
+            t = [AES_SBOX[b] for b in t[1:] + t[:1]]
+            t[0] ^= AES_RCON[i // 8]
+        elif i % 8 == 4:
+            t = [AES_SBOX[b] for b in t]
+        w.append([w[i - 8][j] ^ t[j] for j in range(4)])
+    return [b for word in w for b in word]
+
+
+def _aes_shift_rows(s):
+    o = list(s)
+    for r in range(1, 4):
+        vals = [s[c * 4 + r] for c in range(4)]
+        vals = vals[r:] + vals[:r]
+        for c in range(4):
+            o[c * 4 + r] = vals[c]
+    return o
+
+
+def _aes_encrypt_block(block, rk):
+    s = list(block)
+
+    def add(rnd):
+        for i in range(16):
+            s[i] ^= rk[rnd * 16 + i]
+
+    add(0)
+    for rnd in range(1, 14):
+        s = [AES_SBOX[b] for b in s]
+        s = _aes_shift_rows(s)
+        mixed = []
+        for c in range(4):
+            a, b, d, e = s[c * 4:c * 4 + 4]
+            mixed += [
+                _aes_mul(a, 2) ^ _aes_mul(b, 3) ^ d ^ e,
+                a ^ _aes_mul(b, 2) ^ _aes_mul(d, 3) ^ e,
+                a ^ b ^ _aes_mul(d, 2) ^ _aes_mul(e, 3),
+                _aes_mul(a, 3) ^ b ^ d ^ _aes_mul(e, 2),
+            ]
+        s = mixed
+        add(rnd)
+    s = _aes_shift_rows([AES_SBOX[b] for b in s])
+    add(14)
+    return bytes(s)
+
+
+def _aes_cbc(key, iv, data):
+    rk = _aes_expand(key)
+    out, prev = b"", iv
+    for i in range(0, len(data), 16):
+        block = bytes(x ^ y for x, y in zip(data[i:i + 16], prev))
+        prev = _aes_encrypt_block(block, rk)
+        out += prev
+    return out
+
+
+def _authjs_cookie(env_path):
+    root = os.path.dirname(os.path.abspath(env_path))
+    for _ in range(5):
+        nm = os.path.join(root, "node_modules")
+        if os.path.isdir(os.path.join(nm, "@auth", "core")):
+            return "authjs.session-token"
+        try:
+            with open(os.path.join(nm, "next-auth", "package.json"), encoding="utf-8") as f:
+                major = json.load(f).get("version", "").lstrip("^~").split(".")[0]
+            return "authjs.session-token" if major.isdigit() and int(major) >= 5 else None
+        except OSError:
+            pass
+        parent = os.path.dirname(root)
+        if parent == root:
+            break
+        root = parent
+    # The dependency was detected upstream but the tree is not on disk: v5 is the current default.
+    return "authjs.session-token"
+
+
+def authjs(recipe, env):
+    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
+    if not secret:
+        return {"status": "absent", "note": " or ".join(recipe["env"])}
+    cookie = _authjs_cookie(PLAN["envPath"])
+    if not cookie:
+        return {"status": "upstream", "note": "Auth.js v4"}
+    key = hkdf_sha256(secret.encode("utf-8"), cookie.encode("utf-8"), ("Auth.js Generated Encryption Key (%s)" % cookie).encode("utf-8"), 64)
+    mac_key, enc_key = key[:32], key[32:]
+    now = int(time.time())
+    claims = {"sub": TEST, "name": "Cortad test", "email": "cortad@example.invalid", "iat": now, "exp": now + TTL, "jti": secrets.token_hex(16)}
+    header = b64url(json.dumps({"alg": "dir", "enc": "A256CBC-HS512"}, separators=(",", ":")).encode("utf-8"))
+    plaintext = json.dumps(claims, separators=(",", ":")).encode("utf-8")
+    pad = 16 - (len(plaintext) % 16)
+    iv = secrets.token_bytes(16)
+    ct = _aes_cbc(enc_key, iv, plaintext + bytes([pad]) * pad)
+    aad = header.encode("ascii")
+    al = (len(aad) * 8).to_bytes(8, "big")
+    tag = hmac.new(mac_key, aad + iv + ct + al, hashlib.sha512).digest()[:32]
+    jwe = "%s..%s.%s.%s" % (header, b64url(iv), b64url(ct), b64url(tag))
+    return minted("cookie", "%s=%s" % (cookie, jwe))
 
 
 # The Auth emulator the boot raised in place of their Firebase project: it signs any address up
@@ -341,6 +501,10 @@ def main():
                     got = sealed(recipe, env)
                 elif recipe["kind"] == "jwt":
                     got = jwt(recipe, env)
+                elif recipe["kind"] == "supabase":
+                    got = supabase(recipe, env)
+                elif recipe["kind"] == "authjs":
+                    got = authjs(recipe, env)
                 elif recipe["kind"] == "login":
                     got = login(recipe, role, role_value, env)
                 elif recipe["kind"] == "firebase":

package/lib/service.mjs

@@ -0,0 +1,71 @@
+// Some apps keep their sign-in on a different service than the one that serves the AI: databuddy
+// serves chat from apps/api and mounts better-auth in apps/dashboard, and the command starts only
+// apps/api. A recipe that names such a service (src/setup/road-identities.ts) is minted against
+// that service instead, so nobody is asked to send a message by hand. Cookies set on localhost
+// apply to every port, which is what makes the session work on the AI service after.
+import { relative, join } from "node:path";
+import { startPlan } from "./start.mjs";
+
+export const serviceBase = (port) => `http://127.0.0.1:${port}`;
+
+// The recipes to mint against a service other than the running app, grouped by that service's
+// workspace, each with how it starts itself. A recipe whose service is the app's own dir stays with
+// the app and is not returned here.
+export function servicesFor({ recipes, root, appDir, onPath }) {
+  const here = relative(root, appDir) || ".";
+  const byDir = new Map();
+  for (const recipe of Array.isArray(recipes) ? recipes : []) {
+    const dir = typeof recipe?.service === "string" ? recipe.service.replace(/^\.\//, "").replace(/\/+$/, "") : "";
+    if (!dir || dir === here) continue;
+    if (!byDir.has(dir)) byDir.set(dir, []);
+    byDir.get(dir).push(recipe);
+  }
+  return [...byDir].map(([dir, group]) => ({
+    dir,
+    cwd: join(root, dir),
+    plan: startPlan({ root: join(root, dir), onPath }),
+    recipes: group,
+  }));
+}
+
+// One sign-in per port: recipes whose sign-in is mounted in another workspace are minted against
+// that workspace, the rest against the app, and the rows come back as one list. A repository whose
+// sign-in is where the app is mints once, against the app, as it always did.
+export async function mintAcross({ recipes, root, appDir, onPath, appPort, portFor, mint, originFor = () => undefined }) {
+  const groups = servicesFor({ recipes, root, appDir, onPath });
+  if (!groups.length) return mint(recipes, appPort);
+  const elsewhere = new Set(groups.flatMap((g) => g.recipes));
+  const rows = [];
+  for (const group of groups) {
+    const port = (await portFor(group)) ?? appPort;
+    rows.push(...((await mint(group.recipes, port, originFor(port)))?.identities ?? []));
+  }
+  const rest = (Array.isArray(recipes) ? recipes : []).filter((r) => !elsewhere.has(r));
+  if (rest.length) rows.push(...((await mint(rest, appPort))?.identities ?? []));
+  return { identities: rows };
+}
+
+// Wait for a service to answer on its port, bounded so a service that never comes up cannot hold
+// the whole raise. Any HTTP reply means the port is up; a connection refused means keep waiting.
+export async function waitForPort(port, deadlineMs = 90_000) {
+  const until = Date.now() + deadlineMs;
+  while (Date.now() < until) {
+    try {
+      await fetch(serviceBase(port) + "/", { method: "GET", signal: AbortSignal.timeout(2500), redirect: "manual" });
+      return true;
+    } catch (e) {
+      if (!/aborted|timeout|ECONNREFUSED|ECONNRESET|fetch failed|other side closed/i.test(String(e?.cause?.code ?? e?.message ?? e))) return false;
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+  return false;
+}
+
+// The page a sign-in believes it is being asked from. Nearly every auth library refuses a request
+// whose Origin it does not trust: better-auth answered databuddy's own sign-up with 403
+// INVALID_ORIGIN because the ask went to 127.0.0.1 with no page behind it. Their own settings name
+// the page; where they do not, it is that port on localhost, which is what their own browser sends.
+export function originFor(port, origins = []) {
+  const named = origins.find((o) => { try { return new URL(o).port === String(port); } catch { return false; } });
+  return named ?? `http://localhost:${port}`;
+}

package/lib/start.mjs

@@ -1,7 +1,7 @@
 // How their app is started, and from which folder, worked out from the repository itself so nobody
 // is asked. A monorepo root has no app of its own: the app is the workspace that serves the AI.
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import { dirname, join, relative } from "node:path";
 
 const read = (file) => { try { return readFileSync(file, "utf8"); } catch { return ""; } };
 const json = (file) => { try { return JSON.parse(read(file)); } catch { return null; } };
@@ -23,6 +23,18 @@ const SERVES = /uvicorn\.run|FastAPI\(|Flask\(|Starlette\(|Litestar\(|Quart\(|ap
 // The same question of a package script: does this command put something on a port, or run a task
 // and exit. `crewai run` and `python main.py` are tasks; `next dev` and `nodemon server.js` serve.
 const SERVES_JS = /\b(?:next|nuxt|vite|nest|remix|astro|sveltekit|serve|nodemon|ts-node-dev|uvicorn|gunicorn|rails|strapi)\b/;
+// Where this workspace's install lives: the nearest folder at or above it holding a lockfile, never
+// past the repository the customer ran the command in.
+const LOCKS = ["pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock", "package-lock.json"];
+export function lockRoot(dir, root) {
+  const inside = (d) => d === root || d.startsWith(root.endsWith("/") ? root : `${root}/`);
+  for (let at = dir; inside(at); at = dirname(at)) {
+    if (LOCKS.some((l) => existsSync(join(at, l)))) return at;
+    if (at === dirname(at)) break;
+  }
+  return dir;
+}
+
 // The manager this repository was installed with, named by its lockfile.
 const manager = (dir) => (existsSync(join(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync(join(dir, "yarn.lock")) ? "yarn" : existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")) ? "bun" : "npm");
 
@@ -121,13 +133,18 @@ export const missingDependency = (said) => MISSING.exec(String(said ?? ""))?.sli
 // One install, with the manager the project locked. Never a global one: a Python project without an
 // interpreter of its own gets a virtual environment beside its code, so nothing installed here
 // reaches the rest of the machine.
-export function installPlan(dir, onPath) {
+export function installPlan(dir, onPath, root = dir) {
   if (json(join(dir, "package.json"))) {
+    // A workspace member holds no lockfile of its own: the manager, and the install, belong to the
+    // repository that owns it. novel's apps/web installed with npm here, and npm cannot read the
+    // `workspace:^` ranges its own packages are pinned with: "Unsupported URL Type".
+    const at = lockRoot(dir, root);
     // The manager the repository locked, fetched for the job when this machine has not got it: npm
     // refuses vercel's ai-chatbot outright over a peer range pnpm resolves without a word.
-    const locked = manager(dir);
-    if (locked !== "npm") return onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`;
-    return existsSync(join(dir, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps";
+    const locked = manager(at);
+    const where = at === dir ? "" : `cd ${JSON.stringify(at)} && `;
+    if (locked !== "npm") return `${where}${onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`}`;
+    return `${where}${existsSync(join(at, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps"}`;
   }
   if (existsSync(join(dir, "uv.lock")) && onPath("uv")) return "uv sync";
   if (existsSync(join(dir, "poetry.lock")) && onPath("poetry")) return "poetry install";

package/lib/switches.mjs

@@ -0,0 +1,47 @@
+// Switches an app reads to decide who it lets in, set for the app this command started and for
+// nothing else. The customer's files are never written, and every name is printed before the app
+// starts. A lockout, an attempt counter and a password rule are never touched.
+import { readFileSync, statSync } from "node:fs";
+
+const GUARDED = /(AUTH|LOGIN|PASSWORD|BREAKER|LOCKOUT|ATTEMPT|FAIL|BAN|BLOCK)/;
+const ENV_READ = /(?:process\.env(?:\.|\[\s*['"])|os\.(?:environ\.get|getenv)\(\s*['"]|os\.environ\[\s*['"]|\benv\(\s*['"]|Deno\.env\.get\(\s*['"])([A-Z][A-Z0-9_]*)/g;
+
+// A switch their own app reads to decide whether a caller has to be signed in at all. morphic's
+// chat answers 401 to everyone until ENABLE_GUEST_CHAT is true; open-webui, librechat and a dozen
+// others carry the same idea under their own name. Set for the app this command started and for
+// nothing else: their files are not touched, and the name is printed before anything starts.
+// A lockout, an attempt counter and a password rule carry the same words and are never touched.
+const OPENS_AUTH = /^(?:ENABLE|REQUIRE)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_(?:ENABLED|REQUIRED)$|^(?:REQUIRE|ENABLE)_(?:LOGIN|SIGN_?IN)$/;
+const CLOSES_AUTH = /^(?:DISABLE|SKIP|NO)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_DISABLED$/;
+const OPENS_GUEST = /^(?:ENABLE|ALLOW)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT|ENABLED|LOGIN)$/;
+const CLOSES_GUEST = /^(?:DISABLE|BLOCK)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT)_DISABLED$/;
+const BOOLEAN = /^(?:true|false|1|0|yes|no|on|off)$/i;
+export function openSwitches(envFiles, sources = []) {
+  const out = {};
+  const open = (name) => {
+    if (GUARDED.test(name) && !OPENS_AUTH.test(name) && !CLOSES_AUTH.test(name)) return null;
+    if (OPENS_AUTH.test(name) || CLOSES_GUEST.test(name)) return "false";
+    if (CLOSES_AUTH.test(name) || OPENS_GUEST.test(name)) return "true";
+    return null;
+  };
+  for (const file of envFiles) {
+    let text = "";
+    try { text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (!m) continue;
+      const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      const to = open(m[1]);
+      // Only a switch: a name of this shape holding a URL or a key is something else entirely.
+      if (to && (value === "" || BOOLEAN.test(value))) out[m[1]] = to;
+    }
+  }
+  for (const file of sources) {
+    if (!/\.(?:[cm]?[jt]sx?|py|go|rb|php|rs)$/.test(file)) continue;
+    let text = "";
+    try { if (statSync(file).size > 512_000) continue; text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const m of text.matchAll(ENV_READ)) { const to = open(m[1]); if (to && !(m[1] in out)) out[m[1]] = to; }
+  }
+  return out;
+}
+

package/local.mjs

@@ -23,8 +23,10 @@ import { lockHolds, makeLock } from "./lib/lock.mjs";
 import { AS_HEADER, makeIdentities } from "./lib/mint.mjs";
 import { CAPTURED, makeCapture } from "./lib/replay.mjs";
 import { sampleHere } from "./lib/sample.mjs";
+import { mintAcross, originFor, waitForPort } from "./lib/service.mjs";
 import { listingUrl } from "./lib/listing.mjs";
 import { installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
+import { openSwitches } from "./lib/switches.mjs";
 
 const argv = process.argv.slice(2);
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : undefined; };
@@ -395,7 +397,11 @@ async function verb(job) {
     }
     case "changes": return door.changes();
     case "diff": return door.diff(String(b.path ?? ""));
-    case "mint": return identities ? JSON.parse(mask(JSON.stringify(await identities.mint(b, app?.port)))) : { identities: [] };
+    case "mint": return identities ? JSON.parse(mask(JSON.stringify(await mintAcross({
+      recipes: b.recipes, root, appDir, onPath, appPort: app?.port, portFor: serviceUp,
+      mint: (recipes, port, origin) => identities.mint({ ...b, recipes, headers: { ...(b.headers ?? {}), ...(origin ? { origin, referer: `${origin}/` } : {}) } }, port),
+      originFor: (port) => originFor(port, envOrigins(envFiles)),
+    })))) : { identities: [] };
     case "restore": return door.restore(String(b.checkpoint ?? ""));
     case "keep": return door.keep(typeof b.checkpoint === "string" && b.checkpoint ? b.checkpoint : undefined);
     case "restart": return restartApp();
@@ -423,6 +429,57 @@ const answers = async (port) => {
 const onPath = (bin) => (process.env.PATH ?? "").split(":").some((dir) => dir && existsSync(join(dir, bin)));
 // Where their app lives inside this repository, and how it starts. Worked out in lib/start.mjs.
 let appDir = root;
+
+// ---- a sign-in mounted in another workspace
+// databuddy serves its AI from apps/api and mounts sign-in in apps/dashboard: a test account can
+// only be made where the sign-in is, and posting a sign-up at the AI's own port is a 404.
+const PORT_IN_SCRIPT = /(?:^|\s)(?:PORT=|-p[ =]|--port[ =])(\d{2,5})\b/;
+// The port a framework serves on when nobody names one. sveltekit and astro before vite: both bring
+// vite with them and neither uses its port.
+const FRAMEWORK_PORT = [["next", 3000], ["nuxt", 3000], ["@remix-run/serve", 3000], ["@remix-run/dev", 3000], ["@sveltejs/kit", 5173], ["astro", 4321], ["vite", 5173]];
+// No scan of the usual ports: whatever answers on 3000 or 8080 on this machine is very often not
+// this workspace, and a test account made against somebody else's service is the worst kind of
+// wrong. Only the port this workspace itself names, and if nothing is there, it is started.
+
+// What that workspace serves on: its own script says so, or the framework it is written in does.
+function servicePort(cwd) {
+  let pkg = null;
+  try { pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8")); } catch { /* not a Node workspace */ }
+  const script = ["dev", "develop", "start:dev", "serve", "start"].map((s) => pkg?.scripts?.[s]).find(Boolean) ?? "";
+  const named = Number(PORT_IN_SCRIPT.exec(script)?.[1]);
+  if (named) return named;
+  const deps = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+  const framework = FRAMEWORK_PORT.find(([dep]) => deps.includes(dep))?.[1];
+  if (framework) return framework;
+  if (existsSync(join(cwd, "manage.py"))) return 8000;
+  if (existsSync(join(cwd, "Gemfile"))) return 3000;
+  const py = ["requirements.txt", "pyproject.toml"].map((f) => { try { return readFileSync(join(cwd, f), "utf8"); } catch { return ""; } }).join("\n");
+  return /\bdjango\b/i.test(py) ? 8000 : /\bflask\b/i.test(py) ? 5000 : null;
+}
+
+const toldService = new Set();
+const signedInAt = (dir, port) => { if (!toldService.has(dir)) { toldService.add(dir); say(`your sign-in lives in ${dir}, so I signed in there`); } return port; };
+// Everything else this command started, stopped with it.
+const sidecars = [];
+// The port that workspace's sign-in answers on. One it is already serving on comes first: starting
+// a second copy of a dashboard that is already up costs a minute and takes its port.
+async function serviceUp(group) {
+  const named = servicePort(group.cwd);
+  if (named && named !== app?.port && (await answers(named))) return signedInAt(group.dir, named);
+  // Its own port taken by the app leaves nothing to wait on: whatever answers there is the app.
+  if (!named || named === app?.port || !group.plan?.cmd) return null;
+  const kid = spawn("/bin/sh", ["-c", group.plan.cmd], {
+    cwd: group.plan.cwd,
+    env: { ...process.env, ...(capture ? capture.env(process.env) : {}), FORCE_COLOR: "0", ...(pinned.bin ? { PATH: `${pinned.bin}:${process.env.PATH ?? ""}` } : {}) },
+    stdio: ["ignore", "pipe", "pipe"], detached: true,
+  });
+  sidecars.push(kid);
+  const keep = (d) => appendFileSync(bootLog, d.toString());
+  kid.stdout.on("data", keep);
+  kid.stderr.on("data", keep);
+  return (await waitForPort(named, 90_000)) ? signedInAt(group.dir, named) : null;
+}
+
 async function ask(question) {
   if (!process.stdin.isTTY) return null;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -454,15 +511,23 @@ async function startApp() {
   appDir = plan?.cwd ?? root;
   pinned = pinnedNode();
   if (plan?.within) say(`your app is in ${plan.within}, started there with: ${cmd}`);
-  const lifted = liftedLimits(envFiles, files.map((f) => join(root, f)));
-  if (Object.keys(lifted).length) say(`higher request limits for this session: ${Object.keys(lifted).join(", ")}`);
+  const sourceFiles = files.map((f) => join(root, f));
+  const lifted = { ...liftedLimits(envFiles, sourceFiles), ...openSwitches(envFiles, sourceFiles) };
+  const raised = Object.keys(liftedLimits(envFiles, sourceFiles));
+  const opened = Object.keys(openSwitches(envFiles, sourceFiles));
+  if (raised.length) say(`higher request limits for this session: ${raised.join(", ")}`);
+  // Said out loud, because it changes who their app lets in for as long as this command runs.
+  if (opened.length) say(`your app's own sign-in switch, for this session only: ${opened.map((n) => `${n}=${lifted[n]}`).join(", ")}`);
   launched = { cmd, lifted };
   step(`starting your app: ${cmd}`);
   const up = await launch(180_000);
   if (up.port) return { port: up.port, cmd: launched.cmd, lifted: Object.keys(lifted) };
   // Already running: a second start dies on the port the first one holds. The one that is running
   // is the app, so it is used as it stands rather than treated as a failure.
-  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)/i.test(up.tail)) {
+  // "Another next dev server is already running" is the same fact in a framework's own words: their
+  // app is up, started from the terminal they were already working in, and the port it holds is not
+  // always the one we asked for. Their running app is the app.
+  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)|another .{0,20}(?:dev )?server is already running|already running (?:on|at) (?:http|port)/i.test(up.tail)) {
     const ports = [...up.tail.matchAll(/(?::|port\s*[:=]?\s*)(\d{4,5})\b/gi)].map((m) => Number(m[1]));
     for (const port of new Set(ports)) {
       if (await answers(port)) {
@@ -565,7 +630,7 @@ let installSaid = "";
 async function installOnce(said) {
   if (installed) return false;
   const name = missingDependency(said);
-  const cmd = name && installPlan(appDir, onPath);
+  const cmd = name && installPlan(appDir, onPath, root);
   if (!cmd) return false;
   installed = true;
   stepDone(`your app needs ${name}, which is not installed here`);
@@ -871,6 +936,7 @@ async function close(code = 0) {
   closing = true;
   await call("DELETE", `/local/${box}`).catch(() => {});
   if (child?.pid) await stopApp(child.pid);
+  for (const kid of sidecars) if (kid.pid) await stopApp(kid.pid);
   const pending = door?.pending() ?? 0;
   if (pending) say(`${pending} agent edit${pending === 1 ? " is" : "s are"} waiting for you to keep or undo. Run the command again to review ${pending === 1 ? "it" : "them"} in the browser.`);
   await exec("rm", ["-rf", work]).catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Connects the AI app on your machine to Cortad for test conversations. No dependencies.",
   "bin": {
     "cortad": "local.mjs"
@@ -16,7 +16,9 @@
     "lib/pyhook/sitecustomize.py",
     "lib/replay.mjs",
     "lib/sample.mjs",
+    "lib/service.mjs",
     "lib/start.mjs",
+    "lib/switches.mjs",
     "lib/trace.cjs",
     "local.mjs"
   ],