cortad 0.3.1-rc.5 → 0.3.1-rc.7

package/lib/cli.mjs

@@ -36,7 +36,7 @@ export async function main(argv, { root = process.cwd(), env = process.env, stdo
   const children = [];
   const pending = { read: () => readPending(project), write: (p) => writePending(project, p) };
   // The key is read at every call: the MCP process outlives a connect that writes it after the process started.
-  const writes = { mark: (id) => markRun(writesDirOf(homeOf(project)), id), putBack: (id) => putBack(writesDirOf(homeOf(project)), root, id) };
+  const writes = { mark: (id) => markRun(writesDirOf(homeOf(project)), id), putBack: () => putBack(writesDirOf(homeOf(project)), root) };
   const verbs = makeVerbs({
     api: `${origin.origin}/api`,
     root,

package/lib/text.mjs

@@ -144,6 +144,17 @@ const moveText = (m) => `held ${kn(m.before)} readings before, ${kn(m.after)} af
 // Over zero pairs there is no move to print: the line says verification is unavailable and why,
 // never "no change, 0 points" measured on nothing. The visible side's reason is the said line.
 function verifyLines(v) {
+  // An access verify is a re-knock, not a trial move: the routes side by side, then the count.
+  if (v.access) {
+    const lines = [`Verify of ${v.findingId}.`];
+    for (const r of v.routes ?? []) {
+      const then = r.wasOpen ? `answered ${r.before} with no sign-in` : `refused (${r.before || "no answer"})`;
+      const now = r.nowOpen ? `answers ${r.after} with no sign-in` : r.after ? `refuses (${r.after})` : "did not answer";
+      lines.push(`  ${r.method} ${r.route}: ${then}, now ${now}.`);
+    }
+    if (v.said) lines.push(v.said);
+    return lines;
+  }
   const lines = [`Verify of ${v.findingId}${v.path ? ` at ${at(v.path, v.line)}` : ""}.`];
   if (v.visible && !v.visible.unavailable) lines.push(`Visible trials: ${moveText(v.visible)}`);
   if (v.holdout?.unavailable) lines.push(`Held-out trials: verification unavailable: ${v.holdout.unavailable}.`);
@@ -233,6 +244,9 @@ function findingsHead(d) {
   if (reads) lines.push(reads);
   if (d.baseRunId) lines.push(`Compared with run ${d.baseRunId}.`);
   for (const s of [d.read, d.heldBack, d.findings?.length ? null : d.why]) if (s) lines.push(s);
+  // A finding in a situation the run keeps back: what failed and where, so the rule can be fixed;
+  // its inputs and trials stay unseen, and verify replays it all the same.
+  for (const k of d.keptBack ?? []) lines.push(`Kept back ${k.id}: "${clip(k.asks, 160)}"${k.file ? ` at ${at(k.file, k.line)}` : ""}, held ${kn(k.rate)} at reply ${num(k.reply)}${k.quote ? `; the reply said "${clip(k.quote, 120)}"` : ""}. Its inputs are not shown; verify ${k.id} replays them.`);
   return lines.join("\n");
 }
 
@@ -271,6 +285,17 @@ function findingsPages(d, budget = PAGE_CHARS - 60) {
 }
 
 function findingBlock(f, placed) {
+  // A gate the run knocked open: the route, the address, the request sent and the status it answered
+  // with no sign-in. Its own words, then how to prove the fix.
+  if (f.kind === "access-open") {
+    const lines = [`${f.id}  ${f.says}`];
+    if (f.path) lines.push(`  At ${at(f.path, f.line)}`);
+    if (f.standard) lines.push(`  Standard: ${clip(f.standard, 200)}`);
+    lines.push(`  Sent: ${f.request.method} ${f.request.path}${f.request.body ? ` ${clip(f.request.body, 200)}` : ""}${f.as === "another-user" ? " as another user" : " with no sign-in"}`);
+    lines.push(`  Answered: ${f.status}${has(f.response) && f.response ? `, ${clip(f.response, 400)}` : ""}`);
+    lines.push(`  Replay: verify ${f.id}`);
+    return lines.join("\n");
+  }
   const lines = [`${f.id}  ${f.asks}`];
   if (!placed && f.file) lines.push(`  At ${at(f.file, f.line)}`);
   if (f.criteria) lines.push(`  Criteria: ${clip(f.criteria, 600)}`);

package/lib/verbs.mjs

@@ -114,7 +114,7 @@ export function makeVerbs({ api, token, fetchImpl = fetch, startApp, pending, ro
     }
     // The run is over: what the app wrote into its folder during it is put back, said before the next step.
     let back = "";
-    if (writes && finished(res.data)) { try { back = writes.putBack(id); } catch { back = ""; } }
+    if (writes && finished(res.data)) { try { back = writes.putBack(); } catch { back = ""; } }
     return { text: back ? withBack(runText(res.data), back) : runText(res.data), data: res.data };
   };
 

package/lib/writes.mjs

@@ -8,19 +8,23 @@ import { dirname, join, resolve, sep } from "node:path";
 
 export const writesDirOf = (home) => join(home, "writes");
 
-// A run has started: from now until it ends, the hook records what the app writes.
-export function markRun(dir, jobId) {
+// A run has started: from now until it ends, the hook records what the app writes. A record that
+// is already open is kept when `keep` is set: an app started again mid-run keeps the copies made
+// before it went down.
+export function markRun(dir, jobId, { keep = false } = {}) {
+  if (keep && existsSync(join(dir, "run"))) return;
   try { rmSync(dir, { recursive: true, force: true }); } catch { /* fresh */ }
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   writeFileSync(join(dir, "run"), String(jobId), { mode: 0o600 });
 }
 
-// The run has ended: every file it wrote is put back, and the line says which. Nothing happens
-// for a run that is not the one marked, so an old id read late never undoes a newer run's work.
-export function putBack(dir, root, jobId) {
+// The run has ended: every file written since the record began is put back, and the line says
+// which. The record begins when the command starts the app (the first run starts itself on the
+// server's side, so no verb marks it) and again at every run a verb starts, so what a person wrote
+// between two runs is dropped from the record rather than undone.
+export function putBack(dir, root) {
   let rows = [];
   try {
-    if (readFileSync(join(dir, "run"), "utf8").trim() !== String(jobId)) return "";
     rows = readFileSync(join(dir, "written.jsonl"), "utf8").split("\n").filter(Boolean)
       .map((line) => { try { return JSON.parse(line); } catch { return null; } }).filter(Boolean);
   } catch { /* the run wrote nothing */ }

package/local.mjs

@@ -33,6 +33,7 @@ import { listingUrl } from "./lib/listing.mjs";
 import { installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
 import { openSwitches } from "./lib/switches.mjs";
 import { keepData } from "./lib/data.mjs";
+import { markRun, writesDirOf } from "./lib/writes.mjs";
 
 const argv = process.argv.slice(2);
 // The two faces a coding agent uses after the first connect (lib/cli.mjs): the MCP server the
@@ -768,6 +769,9 @@ function dataOnce(started) {
 
 async function start(waitMs) {
   const { cmd, lifted } = await freed(launched.cmd, launched.lifted ?? {});
+  // The record of what the app writes opens with the app: the first run starts itself on the
+  // server's side, with no verb here to mark it, and a restart mid-run keeps the record open.
+  try { markRun(writesDirOf(homeOf(projectOf(root))), "session", { keep: true }); } catch { /* the app's writes go unrecorded */ }
   child = spawn("/bin/sh", ["-c", cmd], { cwd: appDir, env: { ...envExports(envFiles), ...process.env, ...lifted, ...dataOnce(true).env, ...(capture ? capture.env(process.env) : {}), FORCE_COLOR: "0", ...(pinned.bin ? { PATH: `${pinned.bin}:${process.env.PATH ?? ""}` } : {}) }, stdio: ["ignore", "pipe", "pipe"], detached: true });
   const mine = child;
   let seen = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.1-rc.5",
+  "version": "0.3.1-rc.7",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"