cortad 0.2.1 → 0.2.2

package/lib/cli.mjs

@@ -22,11 +22,11 @@ export async function main(argv, { root = process.cwd(), env = process.env, stdo
   if (!trusted) { stderr.write(`cortad  refusing: ${origin.host} is not Cortad.\n`); return 1; }
   const api = `${origin.origin}/api`;
   const project = projectOf(root);
-  const token = readToken(project);
   const [command, ...rest] = argv;
   const mcp = command === "mcp";
   const children = [];
-  const verbs = makeVerbs({ api, token, ensureRunner: () => ensureRunner({ root, project, env, keep: mcp, children, say: (line) => stderr.write(`cortad  ${line}\n`) }) });
+  // The key is read at every call: the MCP process outlives a connect that writes it after the process started.
+  const verbs = makeVerbs({ api, token: () => readToken(project), ensureRunner: () => ensureRunner({ root, project, env, keep: mcp, children, say: (line) => stderr.write(`cortad  ${line}\n`) }) });
 
   if (mcp) {
     const code = await serveMcp({ verbs, version: VERSION, log: (line) => stderr.write(`${line}\n`) });

package/lib/mcp.mjs

@@ -5,7 +5,7 @@
 export const PROTOCOL = "2025-06-18";
 
 export const INSTRUCTIONS = [
-  "Cortad is an independent behavior test lab for the AI app in this repository. It runs simulated users through the app on this machine and grades every reply with about 100 checks. It is already connected; never run `npx cortad <code>` again.",
+  "Cortad is an independent behavior test lab for the AI app in this repository. It runs simulated users through the app on this machine and grades every reply with about 100 checks. It is already connected; never run `npx cortad <code>` again. The first run starts by itself after a connect; the skill says what to tell the person then.",
   "The loop: status, then run only when the person asks (the first run is free; after that run returns a checkout link, show it in one sentence and wait), poll run_status every 30 seconds and stay quiet unless the count moved, findings, fix one finding at a time in the repo, verify <id>, read the move.",
   "Rules: a move inside the interval is not a fix. Never change or remove a case to move a number; never make the app recognise test traffic; if a check reads wrong, call dispute with why. Cases, checks, seeds and the holdout are not yours to edit, and Cortad refuses it anyway.",
 ].join("\n\n");

package/lib/verbs.mjs

@@ -6,12 +6,13 @@ const NOT_CONNECTED = "This project is not connected to Cortad yet. Ask the pers
 
 export function makeVerbs({ api, token, fetchImpl = fetch, ensureRunner = async () => ({ ok: true }) }) {
   const call = async (method, path, body) => {
-    if (!token) return { status: 0, ok: false, data: { error: NOT_CONNECTED } };
+    const key = typeof token === "function" ? token() : token;
+    if (!key) return { status: 0, ok: false, data: { error: NOT_CONNECTED } };
     let res;
     try {
       res = await fetchImpl(`${api}${path}`, {
         method,
-        headers: { authorization: `Bearer ${token}`, ...(body === undefined ? {} : { "content-type": "application/json" }) },
+        headers: { authorization: `Bearer ${key}`, ...(body === undefined ? {} : { "content-type": "application/json" }) },
         body: body === undefined ? undefined : JSON.stringify(body),
         signal: AbortSignal.timeout(60_000),
       });
@@ -108,6 +109,8 @@ export function runText(d) {
   const tail = [];
   if (d.finished && typeof d.score === "number") tail.push(`Score ${d.score} of 100.`);
   if (d.finished && typeof d.findings === "number") tail.push(d.findings ? `${plural(d.findings, "finding")}; call findings.` : "No findings stood out.");
+  if (d.stopped) tail.push(`Stopped after ${d.stopped.after} of ${d.of}: ${d.stopped.why}${d.stopped.side === "theirs" ? " (their side)" : d.stopped.side === "ours" ? " (Cortad's side)" : ""}. ${d.stopped.fix}`);
+  for (const f of d.faults ?? []) tail.push(`${f.what} ${f.fix}`);
   if (d.error) tail.push(`Error: ${d.error}`);
   if (d.verify) tail.push(verifyText(d.verify));
   if (!d.finished) tail.push("Poll again in 30 seconds.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"

package/skill/SKILL.md

@@ -6,9 +6,17 @@ Cortad is connected to this repository. Do not run `npx cortad <code>` again.
 
 If the `cortad` MCP tools are in your tool list, use them. Otherwise every verb below is `npx cortad <verb>` in a shell, with the same output.
 
+## Right after connect
+The first run starts by itself: never call `run` for it. As soon as the command says "Go back to the browser", tell the person, in your own words, all of this:
+- Cortad has started their app on this machine and is reading their code to write realistic users of it, with situations that move.
+- It will play those users through the app and grade every reply against about 100 checks: their own rules, and what a good reply is.
+- The report lands in the browser, with each finding at a file and line, and you can fix and verify from here.
+- They should go back to the browser now and finish the two onboarding questions while it plays; you will report when it is done.
+Then `status` every 30 seconds, quietly, until the latest run is finished. Report the score, the number of findings and the link.
+
 ## The loop
 1. `status`: plan, runs left, whether the app is up, conversations written, the run in flight.
-2. `run`: only when the person asks. The first run is free. After that it returns a checkout link; show it in one sentence and wait for the person.
+2. `run`: only when the person asks. The first run started by itself and was free. After that `run` returns a checkout link; show it in one sentence and wait for the person.
 3. `run_status <jobId>` every 30 seconds; say nothing unless the count moved. When it finishes, say the score, how many findings, and the link.
 4. `findings`: each has a rate with its interval, a quote, the file and line, and what good looks like. Start from the worst rate.
 5. Fix ONE finding: the smallest change in the file it names. Then `verify <findingId>`.