cortad 0.1.11 → 0.1.13

package/lib/keys.mjs

@@ -0,0 +1,38 @@
+// A file that carries a key stays on this machine, whatever git thinks of it: a catalogue that keeps
+// an AES key per video is tracked like code and is no more shareable than a .env.
+// The header alone is code that looks for keys; a key has its body after it.
+const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:\\n|\s)*[A-Za-z0-9+/=]{40,}/;
+const PROVIDER_TOKEN = /\b((?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}|xox[abprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{35}|[rs]k_live_[0-9A-Za-z]{24,}|glpat-[0-9A-Za-z_-]{20,}))\b/g;
+// A long literal under a key-like name. A name read from the environment is not a literal, so
+// `apiKey: process.env.KEY` never matches.
+const NAMED_LITERAL = /["']?[\w-]*(?:key|secret|token|passw(?:or)?d|aes|iv|salt)["']?\s*[:=]\s*["']([A-Fa-f0-9]{32,}|[A-Za-z0-9+/_-]{32,}={0,2})["']/gi;
+
+// A real key is random: digits and letters, many distinct characters. "sk-live-should-never-leak"
+// in a test is a name for a key, not one.
+const random = (s) => /\d/.test(s) && /[A-Za-z]/.test(s) && new Set(s).size >= 10;
+const any = (re, text) => [...text.matchAll(re)].some((m) => random(m[1]));
+
+export function holdsKeys(text, values = []) {
+  return PRIVATE_KEY.test(text) || any(PROVIDER_TOKEN, text) || any(NAMED_LITERAL, text) || values.some((v) => text.includes(v));
+}
+
+// The values worth looking for elsewhere: a variable whose name says it is a secret, from a real env
+// file. An example file's values are placeholders, and a bucket or model name is not a key.
+const SECRET_NAME = /KEY|SECRET|TOKEN|PASSW|PRIVATE|CREDENTIAL/i;
+const EXAMPLE = /\.(example|sample|template|dist)$/i;
+export function secretEnvValues(envFiles, read) {
+  const values = [];
+  for (const file of envFiles) {
+    if (EXAMPLE.test(file)) continue;
+    let text = "";
+    try { text = read(file); } catch { continue; }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (!m || !SECRET_NAME.test(m[1])) continue;
+      const v = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      // A value of few distinct characters is a placeholder or a published test key, not a secret.
+      if (v.length >= 12 && !/\s/.test(v) && new Set(v).size >= 8) values.push(v);
+    }
+  }
+  return values;
+}

package/lib/start.mjs

@@ -1,7 +1,7 @@
 // How their app is started, and from which folder, worked out from the repository itself so nobody
 // is asked. A monorepo root has no app of its own: the app is the workspace that serves the AI.
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import { dirname, join, relative } from "node:path";
 
 const read = (file) => { try { return readFileSync(file, "utf8"); } catch { return ""; } };
 const json = (file) => { try { return JSON.parse(read(file)); } catch { return null; } };
@@ -23,6 +23,18 @@ const SERVES = /uvicorn\.run|FastAPI\(|Flask\(|Starlette\(|Litestar\(|Quart\(|ap
 // The same question of a package script: does this command put something on a port, or run a task
 // and exit. `crewai run` and `python main.py` are tasks; `next dev` and `nodemon server.js` serve.
 const SERVES_JS = /\b(?:next|nuxt|vite|nest|remix|astro|sveltekit|serve|nodemon|ts-node-dev|uvicorn|gunicorn|rails|strapi)\b/;
+// Where this workspace's install lives: the nearest folder at or above it holding a lockfile, never
+// past the repository the customer ran the command in.
+const LOCKS = ["pnpm-lock.yaml", "yarn.lock", "bun.lockb", "bun.lock", "package-lock.json"];
+export function lockRoot(dir, root) {
+  const inside = (d) => d === root || d.startsWith(root.endsWith("/") ? root : `${root}/`);
+  for (let at = dir; inside(at); at = dirname(at)) {
+    if (LOCKS.some((l) => existsSync(join(at, l)))) return at;
+    if (at === dirname(at)) break;
+  }
+  return dir;
+}
+
 // The manager this repository was installed with, named by its lockfile.
 const manager = (dir) => (existsSync(join(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync(join(dir, "yarn.lock")) ? "yarn" : existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")) ? "bun" : "npm");
 
@@ -121,13 +133,18 @@ export const missingDependency = (said) => MISSING.exec(String(said ?? ""))?.sli
 // One install, with the manager the project locked. Never a global one: a Python project without an
 // interpreter of its own gets a virtual environment beside its code, so nothing installed here
 // reaches the rest of the machine.
-export function installPlan(dir, onPath) {
+export function installPlan(dir, onPath, root = dir) {
   if (json(join(dir, "package.json"))) {
+    // A workspace member holds no lockfile of its own: the manager, and the install, belong to the
+    // repository that owns it. novel's apps/web installed with npm here, and npm cannot read the
+    // `workspace:^` ranges its own packages are pinned with: "Unsupported URL Type".
+    const at = lockRoot(dir, root);
     // The manager the repository locked, fetched for the job when this machine has not got it: npm
     // refuses vercel's ai-chatbot outright over a peer range pnpm resolves without a word.
-    const locked = manager(dir);
-    if (locked !== "npm") return onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`;
-    return existsSync(join(dir, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps";
+    const locked = manager(at);
+    const where = at === dir ? "" : `cd ${JSON.stringify(at)} && `;
+    if (locked !== "npm") return `${where}${onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`}`;
+    return `${where}${existsSync(join(at, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps"}`;
   }
   if (existsSync(join(dir, "uv.lock")) && onPath("uv")) return "uv sync";
   if (existsSync(join(dir, "poetry.lock")) && onPath("poetry")) return "poetry install";

package/lib/switches.mjs

@@ -0,0 +1,47 @@
+// Switches an app reads to decide who it lets in, set for the app this command started and for
+// nothing else. The customer's files are never written, and every name is printed before the app
+// starts. A lockout, an attempt counter and a password rule are never touched.
+import { readFileSync, statSync } from "node:fs";
+
+const GUARDED = /(AUTH|LOGIN|PASSWORD|BREAKER|LOCKOUT|ATTEMPT|FAIL|BAN|BLOCK)/;
+const ENV_READ = /(?:process\.env(?:\.|\[\s*['"])|os\.(?:environ\.get|getenv)\(\s*['"]|os\.environ\[\s*['"]|\benv\(\s*['"]|Deno\.env\.get\(\s*['"])([A-Z][A-Z0-9_]*)/g;
+
+// A switch their own app reads to decide whether a caller has to be signed in at all. morphic's
+// chat answers 401 to everyone until ENABLE_GUEST_CHAT is true; open-webui, librechat and a dozen
+// others carry the same idea under their own name. Set for the app this command started and for
+// nothing else: their files are not touched, and the name is printed before anything starts.
+// A lockout, an attempt counter and a password rule carry the same words and are never touched.
+const OPENS_AUTH = /^(?:ENABLE|REQUIRE)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_(?:ENABLED|REQUIRED)$|^(?:REQUIRE|ENABLE)_(?:LOGIN|SIGN_?IN)$/;
+const CLOSES_AUTH = /^(?:DISABLE|SKIP|NO)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_DISABLED$/;
+const OPENS_GUEST = /^(?:ENABLE|ALLOW)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT|ENABLED|LOGIN)$/;
+const CLOSES_GUEST = /^(?:DISABLE|BLOCK)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT)_DISABLED$/;
+const BOOLEAN = /^(?:true|false|1|0|yes|no|on|off)$/i;
+export function openSwitches(envFiles, sources = []) {
+  const out = {};
+  const open = (name) => {
+    if (GUARDED.test(name) && !OPENS_AUTH.test(name) && !CLOSES_AUTH.test(name)) return null;
+    if (OPENS_AUTH.test(name) || CLOSES_GUEST.test(name)) return "false";
+    if (CLOSES_AUTH.test(name) || OPENS_GUEST.test(name)) return "true";
+    return null;
+  };
+  for (const file of envFiles) {
+    let text = "";
+    try { text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+      if (!m) continue;
+      const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+      const to = open(m[1]);
+      // Only a switch: a name of this shape holding a URL or a key is something else entirely.
+      if (to && (value === "" || BOOLEAN.test(value))) out[m[1]] = to;
+    }
+  }
+  for (const file of sources) {
+    if (!/\.(?:[cm]?[jt]sx?|py|go|rb|php|rs)$/.test(file)) continue;
+    let text = "";
+    try { if (statSync(file).size > 512_000) continue; text = readFileSync(file, "utf8"); } catch { continue; }
+    for (const m of text.matchAll(ENV_READ)) { const to = open(m[1]); if (to && !(m[1] in out)) out[m[1]] = to; }
+  }
+  return out;
+}
+

package/local.mjs

@@ -11,6 +11,7 @@
 // (lib/lock.mjs) and cannot write your code at all. Nothing here touches git. Your environment
 // never leaves this machine. Ctrl-C ends everything.
 
+import { holdsKeys, secretEnvValues } from "./lib/keys.mjs";
 import { spawn, execFile, execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, watch, writeFileSync } from "node:fs";
@@ -26,6 +27,7 @@ import { sampleHere } from "./lib/sample.mjs";
 import { mintAcross, originFor, waitForPort } from "./lib/service.mjs";
 import { listingUrl } from "./lib/listing.mjs";
 import { installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
+import { openSwitches } from "./lib/switches.mjs";
 
 const argv = process.argv.slice(2);
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : undefined; };
@@ -118,6 +120,11 @@ function shareable(rel) {
   try { execFileSync("git", ["-C", root, "check-ignore", "-q", rel], { stdio: "ignore" }); return false; } catch (e) { return e.status === 1; }
 }
 let listed = null;
+// Read the same way for the upload and for any read the engine asks for later.
+let envKeys = [];
+function carriesKey(rel) {
+  try { return holdsKeys(readFileSync(join(root, rel), "utf8"), envKeys); } catch { return false; }
+}
 
 // Values from your env files, read here and only here, so nothing a command prints can carry one.
 function secretValues(envFiles) {
@@ -279,7 +286,8 @@ const readable = (p) => {
   let landed; try { landed = realpathSync(r); } catch { return null; }
   const home = realpathSync(root);
   if (!landed.startsWith(home + sep) || ENV_FILE.test(basename(landed)) || SECRET_PATH.test(landed)) return null;
-  return shareable(relative(home, landed)) ? landed : null;
+  const rel = relative(home, landed);
+  return shareable(rel) && !carriesKey(rel) ? landed : null;
 };
 // A shell line runs with a plain environment: the app's own process reads its .env itself, and
 // nothing a world sends inherits this terminal's keys.
@@ -510,15 +518,23 @@ async function startApp() {
   appDir = plan?.cwd ?? root;
   pinned = pinnedNode();
   if (plan?.within) say(`your app is in ${plan.within}, started there with: ${cmd}`);
-  const lifted = liftedLimits(envFiles, files.map((f) => join(root, f)));
-  if (Object.keys(lifted).length) say(`higher request limits for this session: ${Object.keys(lifted).join(", ")}`);
+  const sourceFiles = files.map((f) => join(root, f));
+  const lifted = { ...liftedLimits(envFiles, sourceFiles), ...openSwitches(envFiles, sourceFiles) };
+  const raised = Object.keys(liftedLimits(envFiles, sourceFiles));
+  const opened = Object.keys(openSwitches(envFiles, sourceFiles));
+  if (raised.length) say(`higher request limits for this session: ${raised.join(", ")}`);
+  // Said out loud, because it changes who their app lets in for as long as this command runs.
+  if (opened.length) say(`your app's own sign-in switch, for this session only: ${opened.map((n) => `${n}=${lifted[n]}`).join(", ")}`);
   launched = { cmd, lifted };
   step(`starting your app: ${cmd}`);
   const up = await launch(180_000);
   if (up.port) return { port: up.port, cmd: launched.cmd, lifted: Object.keys(lifted) };
   // Already running: a second start dies on the port the first one holds. The one that is running
   // is the app, so it is used as it stands rather than treated as a failure.
-  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)/i.test(up.tail)) {
+  // "Another next dev server is already running" is the same fact in a framework's own words: their
+  // app is up, started from the terminal they were already working in, and the port it holds is not
+  // always the one we asked for. Their running app is the app.
+  if (up.exited !== null && /EADDRINUSE|address already in use|port.{0,40}(?:in use|already used|is taken|unavailable)|another .{0,20}(?:dev )?server is already running|already running (?:on|at) (?:http|port)/i.test(up.tail)) {
     const ports = [...up.tail.matchAll(/(?::|port\s*[:=]?\s*)(\d{4,5})\b/gi)].map((m) => Number(m[1]));
     for (const port of new Set(ports)) {
       if (await answers(port)) {
@@ -621,7 +637,7 @@ let installSaid = "";
 async function installOnce(said) {
   if (installed) return false;
   const name = missingDependency(said);
-  const cmd = name && installPlan(appDir, onPath);
+  const cmd = name && installPlan(appDir, onPath, root);
   if (!cmd) return false;
   installed = true;
   stepDone(`your app needs ${name}, which is not installed here`);
@@ -737,6 +753,10 @@ const envFiles = [];
 const files = [];
 listed = gitListed();
 walk(root, 0, files, envFiles, 0);
+secrets = secretValues(envFiles);
+envKeys = secretEnvValues(envFiles, (f) => readFileSync(f, "utf8"));
+const kept = [];
+for (let i = files.length - 1; i >= 0; i -= 1) if (carriesKey(files[i])) kept.unshift(...files.splice(i, 1));
 // --explain: what this would send and start, from this folder, and nothing else. No network, no
 // app started, nothing written. For the person (or the agent) who reads before running.
 if (explain) {
@@ -748,6 +768,7 @@ if (explain) {
     ``,
     `talks to        ${origin.origin}, localhost (your app's port only), and your own model providers, to ask each which models your key can use`,
     `would send      ${files.length} source files, ${Math.round(bytes / 1024)} KB, once${listed ? " (what git would commit)" : ""}`,
+    ...(kept.length ? [`kept here       ${kept.length} file${kept.length === 1 ? " that holds" : "s that hold"} keys: ${kept.slice(0, 6).join(", ")}${kept.length > 6 ? ", ..." : ""}`] : []),
     `not sent        anything git ignores, env files (${envFiles.length} here: ${envFiles.slice(0, 6).map(rel).join(", ") || "none"}), key files, data files, node_modules, .git`,
     `env files       values read here only: to hide them in replies, to sign in a test account, and to ask your providers what your keys reach. Variable names and whether a switch is on or off go up; no value does`,
     `would start     ${flag("--port") ? `nothing: uses your app on port ${flag("--port")}` : plan?.cmd ? `${plan.cmd}   (in ${rel(plan.cwd)})` : plan?.noServer ? "nothing: this repository has no server to run" : "asks you how your app starts"}`,
@@ -760,7 +781,7 @@ if (explain) {
   ].join("\n"));
   process.exit(0);
 }
-secrets = secretValues(envFiles);
+if (kept.length) say(`kept on this machine, ${kept.length === 1 ? "it holds" : "they hold"} keys: ${kept.join(", ")}`);
 const keepSecret = (v) => { if (v && v.length >= 12 && !secrets.includes(v)) secrets.push(v); };
 identities = makeIdentities({ root, work, envFiles, sourceFiles: () => files, say, keepSecret, appDir: () => appDir });
 // One message sent in their own app tells us the door for certain. The route and the body go up,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Connects the AI app on your machine to Cortad for test conversations. No dependencies.",
   "bin": {
     "cortad": "local.mjs"
@@ -11,6 +11,7 @@
     "lib/door.mjs",
     "lib/identities.mjs",
     "lib/listing.mjs",
+    "lib/keys.mjs",
     "lib/lock.mjs",
     "lib/mint.mjs",
     "lib/pyhook/sitecustomize.py",
@@ -18,6 +19,7 @@
     "lib/sample.mjs",
     "lib/service.mjs",
     "lib/start.mjs",
+    "lib/switches.mjs",
     "lib/trace.cjs",
     "local.mjs"
   ],