cortad 0.3.0-rc.3 → 0.3.0-rc.4

package/lib/pyhook/sitecustomize.py

@@ -33,6 +33,16 @@ def _install():
         except OSError:
             pass
 
+    # Every other outbound call: the host and what it answered, never a byte of it. A search
+    # provider over its limit for a whole run was invisible until this row existed.
+    def dep(url, status, code=None):
+        try:
+            host = (urlsplit(str(url)).hostname or "").lower()
+            if not host or host in ("localhost", "127.0.0.1", "::1"):
+                return
+            write({"dep": {"at": int(time.time() * 1000), "host": host[:253], "status": int(status or 0), **({"code": str(code)[:40]} if code else {})}})
+        except Exception:
+            pass
     def is_model_call(url):
         try:
             parts = urlsplit(str(url))
@@ -330,6 +340,7 @@ def _install():
 
         def watch(request, response, sent):
             if not is_model_call(request.url):
+                dep(request.url, response.status_code)
                 return response
             kind = response.headers.get("content-type", "")
             if getattr(response, "_content", None) is not None:
@@ -356,9 +367,11 @@ def _install():
                         pass
                     try:
                         response = _send(self, request, *a, **k)
-                    except Exception:
+                    except Exception as err:
                         if is_model_call(request.url):
                             meter(request.url, sent, 0, "", "")
+                        else:
+                            dep(request.url, 0, type(err).__name__)
                         raise
                     try:
                         return watch(request, response, sent)
@@ -374,9 +387,11 @@ def _install():
                         pass
                     try:
                         response = await _send(self, request, *a, **k)
-                    except Exception:
+                    except Exception as err:
                         if is_model_call(request.url):
                             meter(request.url, sent, 0, "", "")
+                        else:
+                            dep(request.url, 0, type(err).__name__)
                         raise
                     try:
                         return watch(request, response, sent)
@@ -392,8 +407,15 @@ def _install():
                 note(request.url, request.body)
             except Exception:
                 pass
-            response = send(self, request, *a, **k)
             try:
+                response = send(self, request, *a, **k)
+            except Exception as err:
+                if not is_model_call(request.url):
+                    dep(request.url, 0, type(err).__name__)
+                raise
+            try:
+                if not is_model_call(request.url):
+                    dep(request.url, response.status_code)
                 if is_model_call(request.url):
                     # A streamed reply is counted as a call whose counts were not read.
                     raw = response.content.decode("utf-8", "replace") if getattr(response, "_content_consumed", False) else ""
@@ -413,9 +435,16 @@ def _install():
                 note(str_or_url, body)
             except Exception:
                 pass
-            response = await request(self, method, str_or_url, *a, **k)
+            try:
+                response = await request(self, method, str_or_url, *a, **k)
+            except Exception as err:
+                if not is_model_call(str_or_url):
+                    dep(str_or_url, 0, type(err).__name__)
+                raise
             if is_model_call(str_or_url):
                 response._cortad = (str_or_url, text(body))
+            else:
+                dep(str_or_url, response.status)
             return response
 
         # Metered when your app reads the reply, or, for one it streams, when the reply is let go.

package/lib/replay.mjs

@@ -88,8 +88,9 @@ const meter = (() => {
     },
     // A service their settings name: only its setting, host and status travel, never a byte of it.
     dep(d) {
-      if (!d || typeof d.env !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(d.env) || typeof d.host !== "string") return;
-      deps.push({ at: count(d.at), env: d.env, host: d.host.slice(0, 253), status: count(d.status), ...(typeof d.code === "string" ? { code: d.code.slice(0, 40) } : {}) });
+      if (!d || typeof d.host !== "string" || !d.host) return;
+      const env = typeof d.env === "string" && /^[A-Z_][A-Z0-9_]*$/.test(d.env) ? d.env : undefined;
+      deps.push({ at: count(d.at), ...(env ? { env } : {}), host: d.host.slice(0, 253), status: count(d.status), ...(typeof d.code === "string" ? { code: d.code.slice(0, 40) } : {}) });
       if (deps.length > ROWS) deps.splice(0, deps.length - ROWS);
     },
     report() {

package/lib/trace.cjs

@@ -196,7 +196,7 @@ if (FILE) {
       } catch { return null; }
     };
     const depRow = (dep, status, code) => {
-      try { fs.appendFileSync(FILE, JSON.stringify({ dep: { at: Date.now(), env: dep.env, host: dep.host, status, code: code ? String(code).slice(0, 40) : undefined } }) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ }
+      try { fs.appendFileSync(FILE, JSON.stringify({ dep: { at: Date.now(), ...(dep.env ? { env: dep.env } : {}), host: dep.host, status, code: code ? String(code).slice(0, 40) : undefined } }) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ }
     };
 
     // Outbound: the model call your app makes while it handles that request.
@@ -210,7 +210,10 @@ if (FILE) {
           if (isModelCall(u.host, u.pathname)) url = u;
         } catch { /* not a URL we can read */ }
         if (!url) {
-          const dep = depOf(input);
+          // Every outbound host, named by the setting that points at it when one does, and by the
+          // host alone otherwise: the search provider behind TAVILY_API_KEY has no URL setting.
+          let dep = depOf(input);
+          if (!dep) { try { const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input)); if (/^https?:$/.test(u.protocol) && !/^(localhost|127\.0\.0\.1|\[::1\])$/.test(u.hostname)) dep = { host: u.hostname }; } catch { /* not a URL */ } }
           if (!dep) return realFetch.apply(this, arguments);
           return realFetch.apply(this, arguments).then(
             (res) => { depRow(dep, res.status); return res; },

package/lib/verbs.mjs

@@ -127,7 +127,13 @@ export function makeVerbs({ api, token, fetchImpl = fetch, startApp, pending, ro
       const more = await call("GET", path(page, d.runId ?? jobId));
       if (!more.ok) return more;
       d.findings = [...(d.findings ?? []), ...(more.data.findings ?? [])];
-      if (more.data.byLine) d.byLine = [...(d.byLine ?? []), ...more.data.byLine];
+      // Every page carries the whole byLine; merged by line with the ids joined, or the first
+      // page's groups print twice.
+      for (const g of more.data.byLine ?? []) {
+        const held = (d.byLine ?? []).find((h) => h.path === g.path && h.line === g.line);
+        if (held) held.findingIds = [...new Set([...held.findingIds, ...g.findingIds])];
+        else d.byLine = [...(d.byLine ?? []), g];
+      }
     }
     return first;
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.0-rc.3",
+  "version": "0.3.0-rc.4",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"