cortad 0.3.0-rc.11 → 0.3.0-rc.12

package/lib/identities.mjs

@@ -26,9 +26,18 @@ const SOURCE = /^(?:env:[A-Z_][A-Z0-9_]*(?:\|[A-Z_][A-Z0-9_]*)*|gen:(?:username|
 // before the program saw it. Still no quote, angle bracket, `$`, backtick or semicolon.
 const WHERE = /^[\w./:@()[\] -]{1,300}$/;
 const BASE = /^http:\/\/(?:127\.0\.0\.1|\[::1\]|localhost):\d{2,5}$/;
-const KINDS = new Set(["header", "login", "jwt", "upstream", "firebase", "authjs", "supabase"]);
+const KINDS = new Set(["header", "login", "jwt", "upstream", "firebase", "authjs", "supabase", "basic"]);
 const STATUSES = new Set(["minted", "sealed", "absent", "refused", "unreachable", "upstream"]);
 
+// A credential the app's own environment names for its own account: a user-side name and a
+// password-side name that share a prefix. The prefix is the name with its trailing token removed,
+// so USER_USERNAME pairs with USER_PASSWORD and TUDUDI_USER_EMAIL with TUDUDI_USER_PASSWORD.
+const USER_TOKEN = /_(?:USERNAME|USER|EMAIL|LOGIN)$/;
+const SECRET_TOKEN = /_(?:PASSWORD|PASS|SECRET)$/;
+const CRED_USER_FIELD = /^(?:e-?mail|user(?:_?name)?|login|account|identifier)$/i;
+const CRED_PASS_FIELD = /^(?:password|passcode|pass|pwd)$/i;
+const SIGN_IN_ROUTE = /(?:^|\/)(?:login|signin|sign-in|sign_in|session|token|authenticate)(?:\/|$)/i;
+
 const slug = (role) => role.replace(/[^a-z0-9-]/g, "-");
 export const identityHeaderFile = (role) => (ROLE.test(role) ? HEADER_FILE.replace("%s.%s", `${slug(role)}.header`) : null);
 // The curl argument a probe inside the box adds to speak as a role: the header line is read there,
@@ -450,6 +459,18 @@ def sealed(recipe, env):
     return {"status": "sealed", "header": recipe["header"], "line": "%s: %s" % (recipe["header"], bearer(recipe["header"], v)), "note": " or ".join(recipe["env"])}
 
 
+# HTTP Basic from the username and password the app's own environment names: env[0] is the user,
+# env[1] the password. The line carries the scheme verbatim, so it is not run through bearer().
+def basic(recipe, env):
+    names = recipe.get("env", [])
+    user = env.get(names[0]) if len(names) > 0 else None
+    pw = env.get(names[1]) if len(names) > 1 else None
+    if not user or not pw:
+        return {"status": "absent", "note": " and ".join(names)}
+    raw = base64.b64encode(("%s:%s" % (user, pw)).encode("utf-8")).decode("ascii")
+    return {"status": "minted", "header": recipe["header"], "line": "%s: Basic %s" % (recipe["header"], raw), "expires": int(time.time()) + TTL, "note": " and ".join(names)}
+
+
 def keep(path, line):
     fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
     with os.fdopen(fd, "w", encoding="utf-8") as f:
@@ -509,10 +530,15 @@ def main():
                     got = login(recipe, role, role_value, env)
                 elif recipe["kind"] == "firebase":
                     got = firebase(recipe, role, env)
+                elif recipe["kind"] == "basic":
+                    got = basic(recipe, env)
                 else:
                     got = {"status": "upstream", "note": " or ".join(recipe["env"]) or recipe["role"]}
             except Exception as err:
                 got = {"status": "unreachable", "note": type(err).__name__}
+            # A sign-in the environment named its own credential for records which names it used.
+            if recipe.get("envCred") and got.get("status") == "minted" and not got.get("note"):
+                got["note"] = " and ".join(recipe.get("env", []))
             line = got.pop("line", None)
             if line:
                 keep(FILE % (slug(role), "header" if got["status"] == "minted" else "sealed"), line)
@@ -551,12 +577,96 @@ export function parseIdentityReport(text) {
   return { identities };
 }
 
+// The credential pairs an environment names, by shared prefix. Names only, never values.
+export function credentialPairs(names) {
+  const list = (Array.isArray(names) ? names : []).filter((n) => typeof n === "string" && ENV_NAME.test(n));
+  const users = list.filter((n) => USER_TOKEN.test(n)).map((n) => ({ name: n, prefix: n.replace(USER_TOKEN, "") }));
+  const secrets = list.filter((n) => SECRET_TOKEN.test(n)).map((n) => ({ name: n, prefix: n.replace(SECRET_TOKEN, "") }));
+  const pairs = [];
+  const seen = new Set();
+  for (const u of users) {
+    const s = secrets.find((x) => x.prefix === u.prefix);
+    if (s && !seen.has(u.prefix)) { seen.add(u.prefix); pairs.push({ user: u.name, secret: s.name, prefix: u.prefix }); }
+  }
+  return pairs;
+}
+
+const routeRole = (route) => {
+  const seg = route.split("/").filter((s) => s && !/^(?:api|v\d+|auth)$/i.test(s)).pop() ?? "user";
+  const r = seg.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 20);
+  return /^[a-z]/.test(r) ? r : "user";
+};
+const uniqueRole = (base, used) => {
+  const stem = /^[a-z]/.test(base) ? base : "account";
+  let role = stem;
+  for (let n = 2; used.has(role); n += 1) role = `${stem}-${n}`;
+  used.add(role);
+  return role;
+};
+
+// When the app's own environment names a credential pair, the box can sign in with it. Each login
+// recipe whose sign-in form takes a username or email and a password is filled from the pair
+// instead of a generated account; each discovered sign-in route with no recipe becomes one; and an
+// HTTP Basic identity is minted for a door that answers 401 with a Basic challenge. Values are
+// opened by the mint program on the machine, never here: this only rewrites which env name a field
+// reads. A register step (one of several, not a sign-in) keeps its fresh account.
+export function envCredentialRecipes(recipes, names, loginRoutes = []) {
+  const list = Array.isArray(recipes) ? recipes : [];
+  const pairs = credentialPairs(names);
+  if (!pairs.length) return list;
+  const pair = pairs[0];
+  const userSrc = `env:${pair.user}`;
+  const passSrc = `env:${pair.secret}`;
+  const used = new Set(list.map((r) => r?.role).filter(Boolean));
+  const covered = new Set();
+  const out = list.map((r) => {
+    if (r?.kind !== "login" || !Array.isArray(r.steps)) return r;
+    let touched = false;
+    const steps = r.steps.map((s) => {
+      if (r.steps.length !== 1 && !SIGN_IN_ROUTE.test(s.route)) return s;
+      const body = { ...(s.body ?? {}) };
+      let hit = false;
+      for (const [f, v] of Object.entries(body)) {
+        if (typeof v !== "string" || !v.startsWith("gen:")) continue;
+        if (CRED_USER_FIELD.test(f)) { body[f] = userSrc; hit = true; }
+        else if (CRED_PASS_FIELD.test(f)) { body[f] = passSrc; hit = true; }
+      }
+      if (!hit) return s;
+      covered.add(s.route);
+      touched = true;
+      return { ...s, body };
+    });
+    return touched ? { ...r, steps, env: [...new Set([...(r.env ?? []), pair.user, pair.secret])], envCred: true } : r;
+  });
+  const known = new Set(out.flatMap((r) => (r?.steps ?? []).map((s) => s.route)));
+  const userField = /_EMAIL$/.test(pair.user) ? "email" : "username";
+  for (const route of (Array.isArray(loginRoutes) ? loginRoutes : []).slice(0, 6)) {
+    if (typeof route !== "string" || !route.startsWith("/") || known.has(route) || covered.has(route)) continue;
+    out.push({
+      kind: "login", role: uniqueRole(routeRole(route), used), header: "authorization", env: [pair.user, pair.secret],
+      steps: [{ route, body: { [userField]: userSrc, password: passSrc } }], opens: [], envCred: true,
+      where: `your environment (${pair.user} and ${pair.secret})`,
+    });
+  }
+  // A Basic identity for each pair as well: a door that wants a sign-in form ignores it, and a door
+  // behind HTTP Basic (which declares no route to fill) is reached by nothing else.
+  for (const p of pairs) {
+    out.push({
+      kind: "basic", role: uniqueRole(slug(p.prefix.toLowerCase()) || "account", used), header: "authorization",
+      env: [p.user, p.secret], opens: [], envCred: true, where: `your environment (${p.user} and ${p.secret})`,
+    });
+  }
+  return out;
+}
+
 // What each row means to the person whose app this is.
 export function identitySentence(row) {
   switch (row.status) {
     case "minted": return row.kind === "firebase"
       ? `signed in as ${row.role} through the Firebase emulator standing in for your project; the token stays inside the sandbox`
-      : `signed in as ${row.role} through your own door ${row.door}; the token stays inside the sandbox`;
+      : row.kind === "basic"
+        ? `signed in as ${row.role} with the username and password your environment sets (${row.note ?? "two variables"}); the header stays inside the sandbox`
+        : `signed in as ${row.role} through your own door ${row.door}; the token stays inside the sandbox`;
     case "sealed": return `${row.role} is the sealed ${row.note} value itself; it never leaves the sandbox, so only the compile's own probe can speak as it`;
     case "absent": return `could not sign in as ${row.role}: ${row.note} is not in the environment you sealed`;
     case "refused": return `your door refused the ${row.role} sign-in (${row.note}), so cases behind it are counted and not driven`;

package/lib/mint.mjs

@@ -10,7 +10,7 @@ import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync }
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { identityScript, parseIdentityReport } from "./identities.mjs";
+import { envCredentialRecipes, identityScript, parseIdentityReport } from "./identities.mjs";
 
 const exec = promisify(execFile);
 export const AS_HEADER = "x-cortad-as";
@@ -128,7 +128,13 @@ export function makeIdentities({ root, work, envFiles, sourceFiles = () => [], s
   }
 
   async function mint(body, port) {
-    const recipes = Array.isArray(body?.recipes) ? body.recipes.slice(0, 12) : [];
+    let recipes = Array.isArray(body?.recipes) ? body.recipes.slice(0, 12) : [];
+    // On a refused first pass the raise asks again with this flag: sign in with the credential the
+    // app's own environment names, filling its sign-in form or a Basic header from that pair.
+    if (body?.envCreds) {
+      const names = Object.keys(Object.assign({}, ...[...envs().all].reverse()));
+      recipes = envCredentialRecipes(recipes, names, body.loginRoutes).slice(0, 12);
+    }
     if (!recipes.length || !port) return { identities: [] };
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const out = join(dir, "bl-identities.json");
@@ -141,7 +147,9 @@ export function makeIdentities({ root, work, envFiles, sourceFiles = () => [], s
     const merged = Object.assign({}, ...[...envs().all].reverse());
     const emulated = Boolean(merged.FIREBASE_AUTH_EMULATOR_HOST);
     const refused = new Map();
-    for (const r of recipes) { const why = refusal(r, merged, (value) => inSource(root, sourceFiles(), value)); if (why && typeof r?.role === "string") refused.set(r.role, why); }
+    // A pair the environment names for the app's own account is the one credential the raise is
+    // allowed to reuse: the elevation and existing-account guards do not apply to it.
+    for (const r of recipes) { const why = r?.envCred ? null : refusal(r, merged, (value) => inSource(root, sourceFiles(), value)); if (why && typeof r?.role === "string") refused.set(r.role, why); }
     const forProgram = recipes.filter((r) => !refused.has(r?.role) && (r?.kind !== "firebase" || emulated));
     // The program signs in once per role value ("staff" as sales, support, marketing), each named
     // role:value; an account made for "staff" alone was never the one it asked for.

package/lib/text.mjs

@@ -50,8 +50,15 @@ function coverageLine(d) {
 
 function scoreLine(d) {
   const floor = has(d.decided) && d.decided < 22;
-  return `${floor ? "Provisional score" : "Score"} ${num(d.score)} of 100${interval(d.ci)}${floor ? `, from ${plural(d.decided, "decided reading")}: under the 22-reading floor, so not a verdict yet` : ""}.`;
+  // The number never stands without its denominator: "93 of 100" read as broad assurance to four
+  // agents whose runs had measured a quarter of the checks.
+  const on = has(d.questionsAsked) && has(d.questionsOf) && d.questionsOf > 0 ? ` on the ${num(d.questionsAsked)} of ${plural(d.questionsOf, "check")} measured` : "";
+  return `${floor ? "Provisional score" : "Score"} ${num(d.score)} of 100${on}${interval(d.ci)}${floor ? `, from ${plural(d.decided, "decided reading")}: under the 22-reading floor, so not a verdict yet` : ""}.`;
 }
+// A row the run held back names a door and why, or, when no door could take it, only the reason.
+const heldBackLine = (h) => h.why === "not testable here"
+  ? `Held back: ${plural(h.trials, "trial")} cannot be played here: ${clip(h.surface, 200)}.`
+  : `Held back: ${plural(h.trials, "trial")} on ${h.surface}${h.why ? `, ${clip(h.why, 200)}` : ""}.`;
 const haltLine = (h) => `${h.side === "ours" ? "We lost your app" : "Your app stopped answering"} after ${plural(h.after, "turn")}${h.why ? `: ${clip(h.why, 200)}` : ""}. The score covers the turns before that.`;
 const LAYER_WORDS = {
   retrieval: "what the store returned behind the reply, not how the reply was written",
@@ -69,11 +76,12 @@ function runLines(d, prefix = "") {
   // Coverage before the number: a 97 beside 59 of 80 checks that never fired read as production-ready
   // to every agent that got it. What was measured leads, then the rate on what was measured.
   if (done && has(d.questionsAsked) && has(d.questionsOf) && d.questionsOf > 0) lines.push(coverageLine(d));
+  if (done && d.blocked) lines.push(d.blocked);
   if (done && typeof d.score === "number") lines.push(scoreLine(d));
   if (done && d.halted) lines.push(haltLine(d.halted));
   if (done && has(d.readingsHeld) && has(d.readings) && d.readings > 0) lines.push(`The question readings held in ${num(d.readingsHeld)} of ${num(d.readings)}, ${Math.round((100 * d.readingsHeld) / d.readings)}%; the score is the case checks' pass rate on the checks measured.`);
   if (done && has(d.findings)) lines.push(`${plural(d.findings, "finding")}.`);
-  for (const h of (d.heldBack ?? []).slice(0, 6)) lines.push(`Held back: ${plural(h.trials, "trial")} on ${h.surface}${h.why ? `, ${clip(h.why, 200)}` : ""}.`);
+  for (const h of (d.heldBack ?? []).filter((h) => h.trials > 0).slice(0, 6)) lines.push(heldBackLine(h));
   const reads = readingsLine(d);
   if (reads) lines.push(reads);
   if (d.stopped) lines.push(stoppedLine(d));
@@ -182,7 +190,9 @@ export function linesOf(d) {
 export const findingsText = (d, page = 1) => pageOf(findingsPages(d), page, (n) => `findings with page ${n}`);
 
 function findingsHead(d) {
+  if (!d.runId) return ["No run has finished on this repository yet."];
   const lines = [`Run ${d.runId}: ${plural(d.findings?.length ?? 0, "finding")}.`];
+  if (d.blocked) lines.push(d.blocked);
   if (typeof d.score === "number") lines.push(scoreLine(d));
   if (d.halted) lines.push(haltLine(d.halted));
   const reads = readingsLine(d);

package/local.mjs

@@ -532,7 +532,9 @@ async function ask(question) {
 let child = null;
 async function startApp() {
   const wanted = Number(flag("--port"));
-  if (wanted) {
+  // "--port 8106 --start ..." is "start it, it will answer on 8106", not "it is already on 8106":
+  // read as the latter it said nothing was answering and never ran the command it was given.
+  if (wanted && !flag("--start")) {
     if (!(await answers(wanted))) return { port: null, said: "", why: `nothing is answering on port ${wanted}, so there is nothing to ask.`, noStart: true };
     const took = await takeOver(wanted);
     if (took) return took;
@@ -735,7 +737,10 @@ async function start(waitMs) {
   const started = Date.now();
   while (Date.now() - started < waitMs) {
     const tail = () => seen.replace(/\x1b\[[0-9;]*m/g, "").split("\n").filter(Boolean).slice(-25).join("\n");
-    if (exited !== null) return { port: null, exited, tail: tail() };
+    // The port was taken: the app says so and exits at once, so this is read before the exit code,
+    // or a bed whose .env named a port another round still held printed "your app stopped" three times.
+    const taken = /EADDRINUSE|address already in use/i.test(seen);
+    if (exited !== null && !taken) return { port: null, exited, tail: tail() };
     // nodemon and its kind outlive the app they watch: the app is gone, the process is not, and
     // the wait ran its whole three minutes on one app with the reason sitting in the output.
     // Also: the port is taken, under a watcher that does not exit when its app cannot listen. The app
@@ -904,6 +909,7 @@ await exec("tar", ["-czf", archive, "-C", root, "-T", list]);
 const bytes = readFileSync(archive);
 const PART = 1_500_000;
 let resumed = false;
+let moved = false;
 const parts = Math.max(1, Math.ceil(bytes.length / PART));
 for (let off = 0; off < bytes.length; off += PART) {
   const last = off + PART >= bytes.length;
@@ -915,12 +921,13 @@ for (let off = 0; off < bytes.length; off += PART) {
   if (!put.ok) fail(put.data?.error ?? `upload failed (${put.status})`);
   if (last) {
     resumed = put.data?.resumed === true;
+    moved = put.data?.moved === true;
     if (typeof put.data?.machineKey === "string" && put.data.machineKey) writeToken(project, put.data.machineKey);
     writeDigest(project, treeDigest);
   }
 }
 // Unchanged code has already been read: coming back says so instead of claiming a second read.
-stepDone(resumed ? "connected · nothing changed since last time" : "connected");
+stepDone(moved ? "connected · your change is in; the read from before stands" : resumed ? "connected · nothing changed since last time" : "connected");
 // The coding agents on this machine learn about Cortad now, once: an MCP entry and a skill in each
 // one's own home folder. A run started by an agent later comes back through lib/cli.mjs.
 if (!viaToken) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.0-rc.11",
+  "version": "0.3.0-rc.12",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"