cortad 0.1.11 → 0.1.12

package/lib/start.mjs

@@ -1,7 +1,7 @@
 // How their app is started, and from which folder, worked out from the repository itself so nobody
 // is asked. A monorepo root has no app of its own: the app is the workspace that serves the AI.
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import { dirname, join, relative } from "node:path";
 
 const read = (file) => { try { return readFileSync(file, "utf8"); } catch { return ""; } };
 const json = (file) => { try { return JSON.parse(read(file)); } catch { return null; } };
@@ -23,6 +23,18 @@ const SERVES = /uvicorn\.run|FastAPI\(|Flask\(|Starlette\(|Litestar\(|Quart\(|ap
 // The same question of a package script: does this command put something on a port, or run a task
 // and exit. `crewai run` and `python main.py` are tasks; `next dev` and `nodemon server.js` serve.
 const SERVES_JS = /\b(?:next|nuxt|vite|nest|remix|astro|sveltekit|serve|nodemon|ts-node-dev|uvicorn|gunicorn|rails|strapi)\b/;
+// Where this workspace's install lives: the nearest folder at or above it holding a lockfile, never
+// past the repository the customer ran the command in.
+const LOCKS = ["pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock", "package-lock.json"];
+export function lockRoot(dir, root) {
+  const inside = (d) => d === root || d.startsWith(root.endsWith("/") ? root : `${root}/`);
+  for (let at = dir; inside(at); at = dirname(at)) {
+    if (LOCKS.some((l) => existsSync(join(at, l)))) return at;
+    if (at === dirname(at)) break;
+  }
+  return dir;
+}
+
 // The manager this repository was installed with, named by its lockfile.
 const manager = (dir) => (existsSync(join(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync(join(dir, "yarn.lock")) ? "yarn" : existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")) ? "bun" : "npm");
 
@@ -121,13 +133,18 @@ export const missingDependency = (said) => MISSING.exec(String(said ?? ""))?.sli
 // One install, with the manager the project locked. Never a global one: a Python project without an
 // interpreter of its own gets a virtual environment beside its code, so nothing installed here
 // reaches the rest of the machine.
-export function installPlan(dir, onPath) {
+export function installPlan(dir, onPath, root = dir) {
   if (json(join(dir, "package.json"))) {
+    // A workspace member holds no lockfile of its own: the manager, and the install, belong to the
+    // repository that owns it. novel's apps/web installed with npm here, and npm cannot read the
+    // `workspace:^` ranges its own packages are pinned with: "Unsupported URL Type".
+    const at = lockRoot(dir, root);
     // The manager the repository locked, fetched for the job when this machine has not got it: npm
     // refuses vercel's ai-chatbot outright over a peer range pnpm resolves without a word.
-    const locked = manager(dir);
-    if (locked !== "npm") return onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`;
-    return existsSync(join(dir, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps";
+    const locked = manager(at);
+    const where = at === dir ? "" : `cd ${JSON.stringify(at)} && `;
+    if (locked !== "npm") return `${where}${onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`}`;
+    return `${where}${existsSync(join(at, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps"}`;
   }
   if (existsSync(join(dir, "uv.lock")) && onPath("uv")) return "uv sync";
   if (existsSync(join(dir, "poetry.lock")) && onPath("poetry")) return "poetry install";

package/lib/switches.mjs

@@ -0,0 +1,47 @@
+// Switches an app reads to decide who it lets in, set for the app this command started and for
+// nothing else. The customer's files are never written, and every name is printed before the app
+// starts. A lockout, an attempt counter and a password rule are never touched.
+import { readFileSync, statSync } from "node:fs";
+
+const GUARDED = /(AUTH|LOGIN|PASSWORD|BREAKER|LOCKOUT|ATTEMPT|FAIL|BAN|BLOCK)/;
+const ENV_READ = /(?:process\.env(?:\.|\[\s*['"])|os\.(?:environ\.get|getenv)\(\s*['"]|os\.environ\[\s*['"]|\benv\(\s*['"]|Deno\.env\.get\(\s*['"])([A-Z][A-Z0-9_]*)/g;
+
+// A switch their own app reads to decide whether a caller has to be signed in at all. morphic's
+// chat answers 401 to everyone until ENABLE_GUEST_CHAT is true; open-webui, librechat and a dozen
+// others carry the same idea under their own name. Set for the app this command started and for
+// nothing else: their files are not touched, and the name is printed before anything starts.
+// A lockout, an attempt counter and a password rule carry the same words and are never touched.
+const OPENS_AUTH = /^(?:ENABLE|REQUIRE)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_(?:ENABLED|REQUIRED)$|^(?:REQUIRE|ENABLE)_(?:LOGIN|SIGN_?IN)$/;
+const CLOSES_AUTH = /^(?:DISABLE|SKIP|NO)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_DISABLED$/;
+const OPENS_GUEST = /^(?:ENABLE|ALLOW)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT|ENABLED|LOGIN)$/;
+const CLOSES_GUEST = /^(?:DISABLE|BLOCK)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT)_DISABLED$/;
+const BOOLEAN = /^(?:true|false|1|0|yes|no|on|off)$/i;
+export function openSwitches(envFiles, sources = []) {
+  const out = {};
+  const open = (name) => {
+    if (GUARDED.test(name) && !OPENS_AUTH.test(name) && !CLOSES_AUTH.test(name)) return null;
+    if (OPENS_AUTH.test(name) || CLOSES_GUEST.test(name)) return "false";
+    if (CLOSES_AUTH.test(name) || OPENS_GUEST.test(name)) return "true";
+    return null;
+  };
+  for (const file of envFiles) {
+    let text = "";
+    try { text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (!m) continue;
+      const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      const to = open(m[1]);
+      // Only a switch: a name of this shape holding a URL or a key is something else entirely.
+      if (to && (value === "" || BOOLEAN.test(value))) out[m[1]] = to;
+    }
+  }
+  for (const file of sources) {
+    if (!/\.(?:[cm]?[jt]sx?|py|go|rb|php|rs)$/.test(file)) continue;
+    let text = "";
+    try { if (statSync(file).size > 512_000) continue; text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const m of text.matchAll(ENV_READ)) { const to = open(m[1]); if (to && !(m[1] in out)) out[m[1]] = to; }
+  }
+  return out;
+}
+

package/local.mjs

@@ -26,6 +26,7 @@ import { sampleHere } from "./lib/sample.mjs";
 import { mintAcross, originFor, waitForPort } from "./lib/service.mjs";
 import { listingUrl } from "./lib/listing.mjs";
 import { installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
+import { openSwitches } from "./lib/switches.mjs";
 
 const argv = process.argv.slice(2);
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : undefined; };
@@ -510,15 +511,23 @@ async function startApp() {
   appDir = plan?.cwd ?? root;
   pinned = pinnedNode();
   if (plan?.within) say(`your app is in ${plan.within}, started there with: ${cmd}`);
-  const lifted = liftedLimits(envFiles, files.map((f) => join(root, f)));
-  if (Object.keys(lifted).length) say(`higher request limits for this session: ${Object.keys(lifted).join(", ")}`);
+  const sourceFiles = files.map((f) => join(root, f));
+  const lifted = { ...liftedLimits(envFiles, sourceFiles), ...openSwitches(envFiles, sourceFiles) };
+  const raised = Object.keys(liftedLimits(envFiles, sourceFiles));
+  const opened = Object.keys(openSwitches(envFiles, sourceFiles));
+  if (raised.length) say(`higher request limits for this session: ${raised.join(", ")}`);
+  // Said out loud, because it changes who their app lets in for as long as this command runs.
+  if (opened.length) say(`your app's own sign-in switch, for this session only: ${opened.map((n) => `${n}=${lifted[n]}`).join(", ")}`);
   launched = { cmd, lifted };
   step(`starting your app: ${cmd}`);
   const up = await launch(180_000);
   if (up.port) return { port: up.port, cmd: launched.cmd, lifted: Object.keys(lifted) };
   // Already running: a second start dies on the port the first one holds. The one that is running
   // is the app, so it is used as it stands rather than treated as a failure.
-  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)/i.test(up.tail)) {
+  // "Another next dev server is already running" is the same fact in a framework's own words: their
+  // app is up, started from the terminal they were already working in, and the port it holds is not
+  // always the one we asked for. Their running app is the app.
+  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)|another .{0,20}(?:dev )?server is already running|already running (?:on|at) (?:http|port)/i.test(up.tail)) {
     const ports = [...up.tail.matchAll(/(?::|port\s*[:=]?\s*)(\d{4,5})\b/gi)].map((m) => Number(m[1]));
     for (const port of new Set(ports)) {
       if (await answers(port)) {
@@ -621,7 +630,7 @@ let installSaid = "";
 async function installOnce(said) {
   if (installed) return false;
   const name = missingDependency(said);
-  const cmd = name && installPlan(appDir, onPath);
+  const cmd = name && installPlan(appDir, onPath, root);
   if (!cmd) return false;
   installed = true;
   stepDone(`your app needs ${name}, which is not installed here`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Connects the AI app on your machine to Cortad for test conversations. No dependencies.",
   "bin": {
     "cortad": "local.mjs"
@@ -18,6 +18,7 @@
     "lib/sample.mjs",
     "lib/service.mjs",
     "lib/start.mjs",
+    "lib/switches.mjs",
     "lib/trace.cjs",
     "local.mjs"
   ],