cortad 0.3.10 → 0.3.11

package/lib/intel-text.mjs

@@ -0,0 +1,47 @@
+// What the agent reads back from the Intelligence Layer's tools, as plain lines: numbers, ids and
+// the cause, never a user's words.
+
+const n = (v) => (typeof v === "number" ? v.toLocaleString("en-US") : String(v ?? 0));
+const when = (iso) => (iso ? new Date(iso).toISOString().replace("T", " ").slice(0, 16) + "Z" : "");
+
+export function incidentLine(i) {
+  const where = i.segment ? (i.segment.kind === "country" ? ` from ${i.segment.value}` : ` on release ${i.segment.value}`) : "";
+  const cause = i.cause ? `; the change was ${i.cause.kind} ${i.cause.value ?? ""}`.trimEnd() + (i.cause.at ? ` at ${when(i.cause.at)}` : "") : "";
+  return `Since ${when(i.since)}, ${i.kind === "reaction" ? `people${where} reacted "${i.key}" after` : `replies${where} broke "${i.key}" in`} ${n(i.now.broke)} of ${n(i.now.of)}; before, ${n(i.before.broke)} of ${n(i.before.of)}${cause}.`;
+}
+
+export function intelligenceText(d) {
+  const lines = [];
+  lines.push(d.wrong?.length ? `Wrong now: ${d.wrong.length}.` : "Nothing is wrong right now.");
+  for (const i of d.wrong ?? []) lines.push(`- ${incidentLine(i)}`);
+  const t = d.conversations ?? {};
+  lines.push(`Last ${d.days} days: ${n(t.n)} conversations, ${n(t.read)} read, ${n(t.heldEvery)} kept every rule, ${n(t.got)} got what they came for, ${n(t.frustrated)} frustrated, ${n(t.wantsHuman)} asked for a person.`);
+  if (d.visits?.n) {
+    const r = d.visits.reactions ?? {};
+    lines.push(`Visits: ${n(d.visits.n)}; after answers people ${Object.entries(r).filter(([k]) => k !== "waited").map(([k, v]) => `${k} ${n(v)}`).join(", ") || "reacted to nothing yet"} (of ${n(r.waited)} answers seen).`);
+  }
+  if (d.checks?.length) lines.push(`Checks broken most: ${d.checks.filter((c) => c.broke).sort((a, b) => b.broke - a.broke).slice(0, 5).map((c) => `${c.id} ${n(c.broke)} of ${n(c.held + c.broke)}`).join("; ") || "none"}.`);
+  lines.push(`The page: ${d.url}`);
+  return lines.join("\n");
+}
+
+export function incidentsText(d) {
+  if (!d.open?.length) return `${d.said ?? "Nothing is wrong right now."}\n${d.url}`;
+  return [...d.open.map((i) => `${incidentLine(i)} Conversations: ${(i.conversations ?? []).join(", ")}`), d.said, d.url].filter(Boolean).join("\n");
+}
+
+const ruleWords = (r) => r.kind === "path" ? `a page ${r.match} ${r.value}` : r.kind === "click" ? `a click on ${r.text ? `"${r.text}"` : r.selector}` : r.kind === "event" ? `the page's event "${r.name}"` : `the backend's outcome "${r.name}"`;
+
+export function outcomesText(d) {
+  if (d.proposed !== undefined) return `${n(d.proposed)} proposed. ${d.awaiting}`;
+  if (!d.outcomes?.length) return `No outcome is defined yet. Propose what the code treats as a good ending (a signup route, a checkout, a "done" button) with outcomes {proposals: [{name, rules, why}]}; ${d.shape}`;
+  return [...d.outcomes.map((o) => `${o.approved ? "Counted" : "Proposed, awaiting the person"}: ${o.name}: ${o.rules.map(ruleWords).join(", or ")}${o.why ? ` (${o.why})` : ""}`), d.url].join("\n");
+}
+
+export function queryText(d) {
+  if (d.error) return `${d.error}${d.sql ? `\n${d.sql}` : ""}`;
+  const rows = d.rows ?? [];
+  if (rows.length === 0) return `No rows.\n${d.sql}`;
+  const keys = Object.keys(rows[0]);
+  return [keys.join("\t"), ...rows.slice(0, 200).map((r) => keys.map((k) => String(r[k] ?? "")).join("\t")), rows.length > 200 ? `${rows.length - 200} more rows` : "", d.scannedBytes != null ? `Scanned ${n(d.scannedBytes)} bytes.` : ""].filter(Boolean).join("\n");
+}

package/lib/keeping.mjs

@@ -1,7 +1,7 @@
 // What one session keeps out of the run's way and brings up for it: the app's database files and
 // servers, copied before it starts (lib/data.mjs, lib/stores.mjs), and the stores and services it
 // reaches, started when nothing answers there (lib/backing.mjs). Every sentence goes to the terminal
-// and, through lines(), to the run: what trials write into for real first.
+// and to the run: the copies made through lines(), and each store with none through blocked().
 import { createHash } from "node:crypto";
 import { localAddresses, makeBacking, tcpOpen } from "./backing.mjs";
 import { keepData } from "./data.mjs";
@@ -14,7 +14,7 @@ const addressed = (s) => Boolean(s.host) && !s.host.startsWith("/") && Boolean(s
 // One nothing answers at is left for later: trials cannot write into it.
 const isDown = async (s) => addressed(s) && !(await tcpOpen(s.host, s.port));
 // The stores the settings name on this machine, as ports to bring up; a compose image may serve them.
-const localStores = (k) => k.stores.filter((s) => addressed(s) && onThisMachine(s.host)).map((s) => ({ port: s.port, names: s.names, store: true }));
+const localStores = (k) => k.named.filter((s) => addressed(s) && onThisMachine(s.host)).map((s) => ({ port: s.port, names: s.names, store: true }));
 // The API keeps eight stores that hold Run. Past that, the rest travel as one row, and a yes to that
 // row is a yes to each of them; a row more changes its id, so an old yes no longer covers it.
 const BLOCKED_MAX = 8;
@@ -37,8 +37,10 @@ function blockedRows(blocked) {
 // `typed`: the person gave the start command. It is run as it is, with the settings and the stores
 // that command gives the app: a legal research API typed ENV=staging and was started on copies of
 // the test databases its default settings file names, where its library is empty.
+// `chosen`: the store settings of the file the person chose for the run (--data). Those stores are
+// the ones copied, and the app is handed all of those settings, so it reaches the server they name.
 const AS_TYPED = "Your app is started with your own command as it is, on the databases that command gives it. Nothing is copied: a run writes into them once you say yes to each on the card.";
-export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, copies = () => [], hold = () => {}, typed = false }) {
+export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, copies = () => [], hold = () => {}, typed = false, chosen = {} }) {
   let pending = null;
   let now = null;
   let backing = null;
@@ -48,37 +50,38 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
   const held = (blocked) => tell(blocked.map((b) => `One question for the person on the card in the browser: ${lower(b.why)}`));
 
   async function keepAll(started) {
-    if (typed) {
-      const none = async () => ({ env: {}, risks: [], copies: [], blocked: [], pass: [] });
-      // The app's own command may still reach a Qdrant: the copies the hook makes there are dropped too.
-      const keeper = storeKeeper({ ledgerFile, values: {}, dirs: [] });
-      now = { env: {}, risks: [], notes: [AS_TYPED], blocked: [], pass: [], stores: [], keeper: { keep: none, drop: async () => {}, dropCopies: (c, s) => keeper.dropCopies(c, s) }, values: {}, started };
-      tell(now.notes);
-      return now;
-    }
     const { values, from, appDir, sources } = settings();
-    const disk = keepData({ values, from, appDir, root, work, sources, started });
+    // Which stores a typed command gives the app is its own: only those chosen for the run are copied,
+    // and each other store it reaches holds Run once the hook sees it (watch). A store it reaches for
+    // and finds nothing at is still brought up: a session that ended stopped the ones it had started,
+    // and the app started next with its own command met "connection refused".
+    const disk = typed ? { env: {}, said: Object.keys(chosen).length ? [] : [AS_TYPED], held: [], values: chosen } : keepData({ values, from, appDir, root, work, sources, started });
     const stores = storesOf(disk.values);
     const keeper = storeKeeper({ ledgerFile, values: disk.values, dirs: [...new Set([appDir, root])] });
     const got = await keeper.keep(stores, { started, down: isDown });
-    backing ??= makeBacking({ root, appDir, values: disk.values, onPath, ledgerFile, launch, adopt: started });
-    now = { env: { ...disk.env, ...got.env }, risks: got.risks, notes: [...disk.said, ...got.copies], blocked: got.blocked, pass: got.pass, stores, keeper, values: disk.values, started };
-    tell([...now.risks, ...now.notes]);
+    backing ??= makeBacking({ root, appDir, values: typed ? values : disk.values, onPath, ledgerFile, launch, adopt: started });
+    now = { env: { ...chosen, ...disk.env, ...got.env }, notes: [...disk.said, ...got.copies], blocked: [...disk.held, ...got.blocked], pass: got.pass, stores, named: stores, keeper, values: disk.values, started };
+    tell(now.notes);
     held(now.blocked);
     return now;
   }
   // A read that failed is tried again on the next ask, never handed back as the same failure.
   const once = (started) => (pending ??= keepAll(started).catch((e) => { pending = null; throw e; }));
+  // The store ids the person's yes covers: a yes to the row the rest travel as is a yes to each.
+  const yesOf = (stores) => {
+    const yes = new Set(stores);
+    const rest = now && now.blocked.length > BLOCKED_MAX ? overflow(now.blocked) : [];
+    if (rest.length && yes.has(overflowId(rest))) for (const b of rest) yes.add(b.id);
+    return yes;
+  };
 
   // Brings up what is wanted, copies each store that now answers, and says both.
   async function bringUp(wants) {
-    if (typed) return { changed: false, came: false, copied: false };
     const k = await once(true);
     hold();
     const up = await backing.up(wants);
     const got = await k.keeper.keep(k.stores, { started: k.started, down: isDown });
     Object.assign(k.env, got.env);
-    k.risks.unshift(...got.risks);
     // Said once: every look brings the same lines back, and status printed one hold four times.
     k.notes.push(...[...up.lines, ...got.copies].filter((l) => !k.notes.includes(l)));
     // A service a setting names that answers nothing holds Run until it does; one that answers now
@@ -89,7 +92,7 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
     for (const d of up.down) if (!k.blocked.some((b) => b.down && b.port === d.port)) k.blocked.push({ id: downId(d.port), names: d.names, why: d.why, down: true, port: d.port });
     k.blocked.push(...got.blocked.filter((b) => !k.blocked.some((x) => x.id === b.id)));
     k.pass.push(...got.pass);
-    const said = [...got.risks, ...up.lines, ...got.copies];
+    const said = [...up.lines, ...got.copies];
     tell(said);
     held(got.blocked);
     return { changed: said.length > 0 || got.blocked.length > 0, came: up.ports.length > 0, copied: Object.keys(got.env).length > 0 };
@@ -103,20 +106,24 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
     env: async (started) => (await once(started)).env,
     // The copies so far, for a service of the repository started beside the app.
     envNow: () => now?.env ?? {},
-    // What trials write into for real first; the API keeps eight sentences of 400 characters.
-    lines: async (started) => { const k = await once(started); return [...k.risks, ...k.notes].map((l) => l.slice(0, 400)).slice(0, 8); },
-    // The stores off this machine no copy could be made of: each holds Run until the person says yes.
+    // The copies trials write into; the API keeps eight sentences of 400 characters.
+    lines: async (started) => (await once(started)).notes.map((l) => l.slice(0, 400)).slice(0, 8),
+    // The stores no copy could be made of: each holds Run until the person says yes.
     blocked: async (started) => blockedRows((await once(started)).blocked),
     // The hosts a trial's writes may reach: the copies made off this machine, and the hosts and
     // stores the person said yes to (setup.consent). Before the copies are made, or after the app
     // was attached to instead, only the hosts.
     outbound: ({ hosts = [], stores = [] } = {}) => {
       if (!now) return [...new Set(hosts)];
-      const yes = new Set(stores);
-      const rest = now.blocked.length > BLOCKED_MAX ? overflow(now.blocked) : [];
-      if (rest.length && yes.has(overflowId(rest))) for (const b of rest) yes.add(b.id);
+      const yes = yesOf(stores);
       return [...new Set([...hosts, ...now.pass, ...now.stores.filter((s) => yes.has(storeId(s)) && !onThisMachine(s.host)).map((s) => String(s.host).toLowerCase())])];
     },
+    // The stores with no copy the person has not said yes to writing into. A service that is down
+    // holds Run too, but nothing can be written into it.
+    holding: ({ stores = [] } = {}) => {
+      const yes = yesOf(stores);
+      return now?.blocked.filter((b) => !b.down && !yes.has(b.id)) ?? [];
+    },
     // The app stopped before it answered: each store its settings name and each port it reached that
     // is down is brought up, once. True when the app is worth starting again.
     async backUp(appPort) {
@@ -151,7 +158,7 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
       const bypassed = [...bypassedOf(live, k.stores, k.blocked), ...unnamedHeld(live, k.stores, k.blocked)];
       k.blocked.push(...bypassed);
       held(bypassed);
-      const got = typed ? { changed: false, copied: false } : await bringUp(reached(appPort));
+      const got = await bringUp(reached(appPort));
       return { changed: bypassed.length > 0 || got.changed, copied: got.copied };
     },
     // An app attached to instead of started keeps its own connections: its copies are of no use.

package/lib/keys.mjs

@@ -1,3 +1,4 @@
+import { parseEnv } from "./env-files.mjs";
 // A file that carries a key stays on this machine, whatever git thinks of it: a catalogue that keeps
 // an AES key per video is tracked like code and is no more shareable than a .env.
 // The header alone is code that looks for keys; a key has its body after it.
@@ -21,18 +22,21 @@ export function holdsKeys(text, values = []) {
 const SECRET_NAME = /KEY|SECRET|TOKEN|PASSW|PRIVATE|CREDENTIAL/i;
 const EXAMPLE = /\.(example|sample|template|dist)$/i;
 export function secretEnvValues(envFiles, read) {
-  const values = [];
+  const values = new Set();
+  // A value of few distinct characters is a placeholder or a published test key, not a secret.
+  const add = (v) => { if (v.length >= 12 && !/\s/.test(v) && new Set(v).size >= 8) values.add(v); };
   for (const file of envFiles) {
     if (EXAMPLE.test(file)) continue;
     let text = "";
     try { text = read(file); } catch { continue; }
     for (const line of text.split("\n")) {
       const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-      if (!m || !SECRET_NAME.test(m[1])) continue;
-      const v = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
-      // A value of few distinct characters is a placeholder or a published test key, not a secret.
-      if (v.length >= 12 && !/\s/.test(v) && new Set(v).size >= 8) values.push(v);
+      if (m && SECRET_NAME.test(m[1])) add(m[2].trim().replace(/^(['"])(.*)\1$/, "$2"));
+    }
+    // As the app's loader reads it too, each line of a value that spans lines on its own.
+    for (const [name, v] of Object.entries(parseEnv(text))) {
+      if (SECRET_NAME.test(name)) for (const one of v.split("\n")) add(one.trim());
     }
   }
-  return values;
+  return [...values];
 }

package/lib/lock.mjs

@@ -3,8 +3,9 @@
 // bubblewrap. Inside it a shell line can read your project and run your tests, and it can write
 // only where your own .gitignore already says files are disposable (caches, build output, coverage)
 // and in temp. It cannot write a tracked file, cannot read your keys or environment files, and on a
-// Mac cannot read what other programs left in /tmp or reach the network beyond this machine. With
-// neither tool present there is no shell.
+// Mac cannot read what other programs left in /tmp or reach the network beyond this machine, unless
+// it runs as the app (a world's command): then it keeps the app's reach, since it runs the app's own
+// AI, which calls the app's model provider. With neither tool present there is no shell.
 import { execFile, execFileSync } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -58,7 +59,7 @@ export async function makeLock({ root, work }) {
     // Later rules win: home is shut, the project and the toolchains are opened again inside it, and
     // what the project ignores and your keys are shut last.
     const hide = ignored.hidden.map(({ path, dir }) => `(${dir ? "subpath" : "literal"} ${q(real(path) ?? path)})`);
-    const profile = [
+    const rules = ({ network }) => [
       "(version 1)(allow default)",
       `(deny file-read-data (subpath ${q(real(home) ?? home)}))`,
       // /tmp holds what other programs on this machine logged; a shell line may write there, never read it.
@@ -67,17 +68,17 @@ export async function makeLock({ root, work }) {
       '(allow file-read-data (regex #"^/private/tmp/sh-thd"))',
       `(allow file-read-data (subpath ${q(project)}) ${[work, ...tools].map((p) => `(subpath ${q(p)})`).join(" ")})`,
       ...(hide.length ? [`(deny file-read-data file-write* ${hide.join(" ")})`] : []),
-      "(deny network*)",
       // This machine only. Unix sockets stay shut: through one, a request rides out to the internet
       // by name on a system network helper even with every direct connection refused.
-      '(allow network-outbound (remote ip "localhost:*"))(allow network-inbound (local ip "localhost:*"))',
+      ...(network ? [] : ['(deny network*)(allow network-outbound (remote ip "localhost:*"))(allow network-inbound (local ip "localhost:*"))']),
       "(deny file-write*)",
       `(allow file-write* ${writable.map((p) => `(subpath ${q(p)})`).join(" ")} (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (literal "/dev/tty") (subpath "/dev/fd"))`,
       // The same operation the project is opened with: a rule naming file-read-data outranks one naming
       // file-read*, so a wildcard deny here let every .env be read again.
       `(deny file-read* file-read-data ${SECRET_DIRS.map((d) => `(subpath ${q(join(home, d))})`).join(" ")} ${SECRET_FILES.map((f) => `(literal ${q(join(home, f))})`).join(" ")} (regex #"\\.env$") (regex #"/\\.env\\.(local|staging|stage|development|dev|test|production|prod)$"))`,
     ].join("");
-    return { name: "seatbelt", wrap: (cmd) => ({ file: "/usr/bin/sandbox-exec", args: ["-p", profile, "/bin/sh", "-c", cmd] }) };
+    const locked = rules({ network: false }), asApp = rules({ network: true });
+    return { name: "seatbelt", wrap: (cmd, { network = false } = {}) => ({ file: "/usr/bin/sandbox-exec", args: ["-p", network ? asApp : locked, "/bin/sh", "-c", cmd] }) };
   }
   const bwrap = process.platform === "linux" ? ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync) : null;
   if (bwrap) {

package/lib/mcp.mjs

@@ -11,7 +11,7 @@ export const PROTOCOL = "2025-06-18";
 // every server, so the first paragraph stands alone and the whole stays under 1,500 characters.
 export const instructions = (spec = "cortad") => [
   "Cortad tests the AI in this repository: simulated users written from the app's code talk to the app running on this machine, and every reply is checked. Cortad sends each AI endpoint a test request itself. status says whether the app is up, what Cortad's audit of the AI code found, and what a run would play and cost. A run starts when the person presses Run in the browser or asks you.",
-  `Tell the person what status found in three or four short, plain lines, leaving out file paths, endpoints, status codes and setting names unless they ask. Before you stop, start \`npx -y ${spec} wait\` as a background command: it returns when the next run or verify ends, with what it found. After a run, call findings and tell the person what their users ran into and what you would change, worst first, three problems at most; the person then says which fix to make, and nothing is edited before their go. On their go, one fix at a time: verify replays the failing conversations and says whether the failure is gone, and a further round plays only when verify is called again. findings has each failure whole and findings numbers every rate. field_connect gives the steps to connect production. dispute records a check that reads this app wrong.`,
+  `Tell the person what status found in three or four short, plain lines, leaving out file paths, endpoints, status codes and setting names unless they ask. Before you stop, start \`npx -y ${spec} wait\` as a background command: it returns when the next run or verify ends, with what it found. After a run, call findings and tell the person what their users ran into and what you would change, worst first, three problems at most; the person then says which fix to make, and nothing is edited before their go. On their go, one fix at a time: verify replays the failing conversations and says whether the failure is gone, and a further round plays only when verify is called again. findings has each failure whole and findings numbers every rate. connect gives the steps to connect the live app. intelligence says what is happening to it and incidents what went wrong and why; outcomes, subscribe and query are the layer's other tools. dispute records a check that reads this app wrong.`,
 ].join("\n\n");
 export const INSTRUCTIONS = instructions();
 
@@ -19,7 +19,7 @@ const str = (description, extra = {}) => ({ type: "string", description, ...extr
 const none = { type: "object", properties: {}, additionalProperties: false };
 const readOnly = { readOnlyHint: true };
 // What a note to the Cortad team may be about: a tool, the connect command, or the skill text.
-const ABOUT = ["status", "reach", "run", "run_status", "findings", "verify", "dispute", "field_connect", "field", "connect", "skill"];
+const ABOUT = ["status", "reach", "run", "run_status", "findings", "verify", "dispute", "field_connect", "field", "world", "world_status", "test", "connect", "intelligence", "incidents", "outcomes", "subscribe", "query", "skill"];
 
 export const TOOLS = [
   { name: "status", title: "Cortad status", annotations: readOnly,
@@ -58,6 +58,39 @@ export const TOOLS = [
   { name: "field", title: "Production numbers", annotations: readOnly,
     description: "Production in numbers: conversations read, checks passed, resolved, frustrated, asks for a human, and the rules broken most. Message text stays out of the answer.",
     inputSchema: { type: "object", properties: { days: { type: "integer", minimum: 1, maximum: 180, description: "Window in days. Default 30." } }, additionalProperties: false } },
+  { name: "world", title: "Test the AI in a world",
+    description: "For an AI in this app that is not a chat, such as a worker that reads data and writes a verdict: Cortad builds a copy of the product's data on this machine from the app's own seed, plants problems whose answers are known, runs the app's own detection on each, and scores what it raised against the answer key, repeated for a flip rate. Answers within a second with the world's id; world_status follows it. Say what was built or what to test, and the report keeps it.",
+    inputSchema: { type: "object", properties: { ask: str("What was built or what to test, in a sentence.", { maxLength: 2000 }) }, additionalProperties: false } },
+  { name: "world_status", title: "Where a world stands", annotations: readOnly,
+    description: "Where a world stands: planted problems found, missed, false alarms where nothing was planted, and flips between repeats, with what the app raised for each.",
+    inputSchema: { type: "object", properties: { jobId: str("The world's id, from world.") }, required: ["jobId"], additionalProperties: false } },
+  { name: "test", title: "Test what you built",
+    description: "The one call after a change: say what you built or want tested, in a sentence, and Cortad decides what kind of test that is. A world, where this app has one and the sentence names something it can plant; a run of the app's chat surfaces otherwise. Answers within a second with which kind started and the call that follows it.",
+    inputSchema: { type: "object", properties: { ask: str("What was built or what to test, in a sentence.", { maxLength: 2000 }) }, additionalProperties: false } },
+  { name: "connect", title: "Connect the live app", inputSchema: none,
+    description: "The steps to connect the live app, backend and page: a one-time code writes both keys into the env file, the SDK lines for the framework, the page tag, and where each conversation then appears. The same as field_connect." },
+  { name: "intelligence", title: "The live app in numbers", annotations: readOnly,
+    description: "What is happening to the live app: what is wrong now (since when, in how many of how many, the change before it), the window's conversations and checks, the visits and what people did after answers. No user's words.",
+    inputSchema: { type: "object", properties: { days: { type: "integer", minimum: 1, maximum: 90, description: "Window in days. Default 7." } }, additionalProperties: false } },
+  { name: "incidents", title: "What went wrong", annotations: readOnly, inputSchema: none,
+    description: "Each open incident: the check or reaction, since when, now against before, the cause the data points at (a release, a changed prompt or model, tool errors, page errors), and the conversations to open on the page. Fix the cause named first, then verify." },
+  { name: "outcomes", title: "What counts as a good ending",
+    description: "What the app counts as an outcome and how often it is reached; or, with proposals, new ones read from the code (a signup route, a checkout, a done button), which the person approves on the page before they count.",
+    inputSchema: { type: "object", properties: { proposals: { type: "array", maxItems: 10, items: { type: "object", properties: { name: str("A short name, as the person would say it.", { maxLength: 64 }), why: str("What in the code makes this an outcome.", { maxLength: 500 }), rules: { type: "array", minItems: 1, maxItems: 10, items: { type: "object", properties: { kind: { type: "string", enum: ["path", "click", "event", "backend"] }, match: { type: "string", enum: ["exact", "starts", "contains"] }, value: { type: "string" }, text: { type: "string" }, selector: { type: "string" }, name: { type: "string" } }, required: ["kind"], additionalProperties: false } } }, required: ["name", "rules", "why"], additionalProperties: false } } }, additionalProperties: false } },
+  { name: "subscribe", title: "Hear of incidents",
+    description: "Registers a public https address that receives each incident as signed JSON (x-cortad-event, x-cortad-signature: sha256=HMAC of the body). Answers with the secret once; keep it where the app keeps its secrets.",
+    inputSchema: { type: "object", properties: { url: str("A public https address that takes a POST.", { maxLength: 500 }) }, required: ["url"], additionalProperties: false } },
+  { name: "query", title: "Ask the warehouse", annotations: readOnly,
+    description: "A structured question over the live app's events, readings or reactions: a table, a time range of at most 90 days, filters, a grouping by columns or by hour or day, measures (count, count_distinct, sum, avg, min, max, share), a limit. Compiled by Cortad, pinned to this app; no SQL is taken. Rows come back as a table.",
+    inputSchema: { type: "object", properties: {
+      table: { type: "string", enum: ["events", "readings", "reactions"] },
+      from: str("Start, ISO 8601."), to: str("End, ISO 8601, at most 90 days after from."),
+      filters: { type: "array", maxItems: 20, items: { type: "object", properties: { column: { type: "string" }, op: { type: "string", enum: ["eq", "ne", "in", "gt", "gte", "lt", "lte", "null", "not_null"] }, value: {} }, required: ["column", "op"], additionalProperties: false } },
+      group: { type: "array", maxItems: 4, items: { type: "string" }, description: "Columns, or hour or day." },
+      measures: { type: "array", minItems: 1, maxItems: 8, items: { type: "object", properties: { fn: { type: "string", enum: ["count", "count_distinct", "sum", "avg", "min", "max", "share"] }, column: { type: "string" }, equals: {}, as: { type: "string" } }, required: ["fn"], additionalProperties: false } },
+      order: { type: "object", properties: { by: { type: "string" }, dir: { type: "string", enum: ["asc", "desc"] } }, required: ["by"], additionalProperties: false },
+      limit: { type: "integer", minimum: 1, maximum: 1000 },
+    }, required: ["table", "from", "to", "measures"], additionalProperties: false } },
 ];
 const NAMES = new Set(TOOLS.map((t) => t.name));
 

package/lib/mint.mjs

@@ -109,7 +109,7 @@ async function send(url, { method = "POST", headers = {}, body } = {}) {
   const res = await fetch(url, { method, headers: { "content-type": "application/json", ...headers }, ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: AbortSignal.timeout(20_000) });
   return { ok: res.ok, status: res.status, json: await res.json().catch(() => null) };
 }
-const saidBy = (r) => String(r.json?.errors?.[0]?.long_message ?? r.json?.msg ?? r.json?.error_description ?? r.json?.message ?? `status ${r.status}`).slice(0, 120);
+const saidBy = (r) => String(r.json?.errors?.[0]?.long_message ?? r.json?.msg ?? r.json?.error_description ?? r.json?.message ?? r.json?.error?.message ?? `status ${r.status}`).slice(0, 120);
 const refusedBy = (who, r) => ({ status: "refused", note: `${who} refused the test account: ${saidBy(r)}` });
 // An account the service already held may have been given a role since this machine made it.
 const ELEVATED_ACCOUNT = { status: "refused", note: "the test account carries an admin role; only an ordinary account is signed in" };
@@ -176,13 +176,31 @@ export function supabaseCookie(origin, session) {
   return value.match(/.{1,3180}/g).map((part, i) => `${name}.${i}=${part}`).join("; ");
 }
 
+// The Auth emulator their app verifies against while FIREBASE_AUTH_EMULATOR_HOST is set: it signs up any
+// address under any key. The account is this machine's own test account, made once and signed in after.
+export async function emulatorToken(host, account) {
+  // An emulator runs beside the app on this machine, and the test account's password goes to it in
+  // plain http: never to another host.
+  if (!/^(?:localhost|127\.0\.0\.1|\[::1\]):\d{2,5}$/.test(host)) return { status: "refused", note: "FIREBASE_AUTH_EMULATOR_HOST does not name an emulator on this machine" };
+  const at = (verb) => `http://${host}/identitytoolkit.googleapis.com/v1/accounts:${verb}?key=cortad-test`;
+  const body = { email: account.email, password: account.password, returnSecureToken: true };
+  let got = await send(at("signUp"), { body });
+  if (!got.ok && /EMAIL_EXISTS/.test(saidBy(got))) got = await send(at("signInWithPassword"), { body });
+  if (!got.ok || typeof got.json?.idToken !== "string") return refusedBy("your Firebase Auth emulator", got);
+  return { idToken: got.json.idToken, ttl: Number(got.json.expiresIn) || 3600 };
+}
+
 // Each hosted service's sign-in, as the value the role's header carries and how long it holds.
 const SIGN_IN = new Map([
-  ["firebase", async ({ env, all }) => {
-    const account = serviceAccountOf(env);
+  ["firebase", async ({ env, all, account }) => {
+    if (env.FIREBASE_AUTH_EMULATOR_HOST) {
+      const got = await emulatorToken(env.FIREBASE_AUTH_EMULATOR_HOST, account);
+      return got.idToken ? { value: `Bearer ${got.idToken}`, ttl: got.ttl, door: "your Firebase Auth emulator", said: "made a test account in your Firebase Auth emulator for the run to sign in with" } : got;
+    }
+    const admin = serviceAccountOf(env);
     const apiKey = webApiKeyOf(all);
-    if (!account || !apiKey) return { status: "absent", note: !account ? "no Firebase admin credential in your environment" : "no Firebase web API key in your environment" };
-    const got = await firebaseIdToken(account, apiKey);
+    if (!admin || !apiKey) return { status: "absent", note: !admin ? "no Firebase admin credential in your environment" : "no Firebase web API key in your environment" };
+    const got = await firebaseIdToken(admin, apiKey);
     if (!got.idToken) return { status: "refused", note: `your Firebase project refused the sign-in: ${got.error}` };
     return { value: `Bearer ${got.idToken}`, ttl: 3600, door: "your Firebase project", said: `signed in to your app as a test user it can tell apart (${TEST_UID}, in your own Firebase project)` };
   }],
@@ -251,13 +269,11 @@ export function makeIdentities({ root, work, envFiles, sourceFiles = () => [], s
     rmSync(out, { force: true });
     // ponytail: the program is Python, as it is in the sandbox. A machine without python3 mints
     // nothing and says so; port the program to this file if that turns out to be common.
-    // A caller a hosted service verifies is signed in at that service, below; a Firebase caller goes
-    // to the program only when an emulator stands in for their project. Handed to the program it
-    // waited its whole deadline on an emulator that was never there, and one app's sign-in arrived
-    // after the world had given up waiting for it.
+    // A caller a hosted service verifies is signed in at that service, below, a Firebase one at the
+    // Auth emulator when the app's settings name one: the program reads one env file and never saw an
+    // emulator named anywhere else, so a Python app verified by the emulator was knocked unsigned.
     const env = merged();
-    const emulated = Boolean(env.FIREBASE_AUTH_EMULATOR_HOST);
-    const signsHere = (r) => SIGN_IN.has(r?.kind) && !(r.kind === "firebase" && emulated);
+    const signsHere = (r) => SIGN_IN.has(r?.kind);
     const refused = new Map();
     // A pair the environment names for the app's own account is the one credential the raise is
     // allowed to reuse: the elevation and existing-account guards do not apply to it.

package/lib/mongo.mjs

@@ -1,11 +1,14 @@
 // A MongoDB database copied for a session on the server it lives on, with MongoDB's own tools: a
-// dump of it restored under a name of ours, and dropped after. The address carries the password, so
-// it reaches mongodump and mongorestore through a config file only this user can read, and mongosh
-// through its environment: never a command line another process on this machine can read.
+// dump of it restored under a name of ours, and dropped after. Or, for an app that names its
+// databases in its code, the whole server copied into a container of ours (serveMongo). The address
+// carries the password, so it reaches mongodump and mongorestore through a config file only its user
+// can read, and mongosh through its environment: never a command line another process can read.
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { docker, dockerUp, freePort, runCopy, servedBy, until } from "./container.mjs";
 
 // A database bigger than this is not copied: said instead, so the person decides.
 export const MONGO_CAP = 1024 ** 3;
@@ -72,3 +75,61 @@ export async function cloneMongo(conn, source, clone) {
 export async function dropMongo(conn, clone, source) {
   return (await shell(withDb(conn.uri, clone, source), `c.getDB(${JSON.stringify(clone)}).dropDatabase()`)).code === 0;
 }
+
+// The address with only this host in it, for a reader that talks to the one server it names: a
+// replica set's member list holds names only its own network resolves.
+function directTo(uri, hostPort) {
+  const [, head, hosts, rest = "", query = "", tail = ""] = /^([^:]+:\/\/)([^/?#]*)(\/[^?#]*)?(\?[^#]*)?(#.*)?$/.exec(uri);
+  const cut = hosts.lastIndexOf("@");
+  const params = new URLSearchParams(query.slice(1));
+  params.delete("replicaSet");
+  params.set("directConnection", "true");
+  return `${head}${cut >= 0 ? hosts.slice(0, cut + 1) : ""}${hostPort}${rest || "/"}?${params}${tail}`;
+}
+
+// A replica set that asks for a password needs a key its members share, one member or not: made in
+// the container before mongod starts, readable by mongod alone.
+const KEYED = 'umask 077; head -c 756 /dev/urandom | base64 > /tmp/cortad.key; chown mongodb /tmp/cortad.key; exec docker-entrypoint.sh mongod "$@"';
+
+// The whole server copied into a container of ours (lib/container.mjs) with MongoDB's own tools,
+// which the container has whatever this machine lacks: every database, its indexes, and its users
+// and roles, so the app signs in there as it does on the original. A server the app signs in to is
+// copied into one that asks for a password too: the dump is restored by a user of ours, made through
+// MongoDB's localhost exception and dropped after. Answers { port } or { why }.
+export async function serveMongo(conn, name) {
+  if (!(await dockerUp())) return { why: "docker" };
+  const from = await servedBy(conn.port);
+  let image = from?.image;
+  if (!image) {
+    const v = await shell(conn.uri, "print(c.getDB('admin').version())");
+    if (v.code !== 0) return { why: refusal(v) };
+    image = `mongo:${v.out.trim()}`;
+  }
+  const port = await freePort();
+  const replSet = new URLSearchParams(/\?([^#]*)/.exec(conn.uri)?.[1] ?? "").get("replicaSet");
+  const restorer = conn.user ? { user: `cortad_${randomBytes(4).toString("hex")}`, pwd: randomBytes(24).toString("hex") } : null;
+  const mongod = ["--port", String(port), "--bind_ip_all", ...(replSet ? ["--replSet", replSet] : []), ...(restorer ? ["--auth"] : [])];
+  const started = restorer && replSet
+    ? { entrypoint: "bash", args: ["-c", KEYED, "bash", ...mongod, "--keyFile", "/tmp/cortad.key"] }
+    : { args: mongod };
+  if (!(await runCopy({ name, image, port, network: from?.net, ...started }))) return { why: "container" };
+  const inside = (script, env = {}) => docker(["exec", ...Object.keys(env).flatMap((k) => ["-e", k]), name, "mongosh", "--quiet", "--port", String(port), "--eval", script], { env });
+  if (!(await until(async () => (await inside("db.runCommand({ ping: 1 }).ok")).out.trim() === "1", 90_000))) return { why: "other" };
+  if (replSet) {
+    await inside(`rs.initiate({ _id: ${JSON.stringify(replSet)}, members: [{ _id: 0, host: "127.0.0.1:${port}" }] })`);
+    if (!(await until(async () => (await inside("db.hello().isWritablePrimary")).out.trim() === "true", 60_000))) return { why: "other" };
+  }
+  if (restorer && (await inside(`print(db.getSiblingDB("admin").createUser({ user: ${JSON.stringify(restorer.user)}, pwd: process.env.CORTAD_PWD, roles: ["root"] }).ok)`, { CORTAD_PWD: restorer.pwd })).out.trim() !== "1") return { why: "other" };
+  const source = directTo(conn.uri, from?.ip ? `${from.ip}:${from.inner}` : `host.docker.internal:${conn.port}`);
+  const target = `mongodb://${restorer ? `${restorer.user}:${restorer.pwd}@` : ""}127.0.0.1:${port}/?directConnection=true${restorer ? "&authSource=admin" : ""}`;
+  const size = await docker(["exec", "-e", "CORTAD_SOURCE", name, "mongosh", "--nodb", "--quiet", "--eval", "print(new Mongo(process.env.CORTAD_SOURCE).getDB('admin').adminCommand({ listDatabases: 1 }).totalSize)"], { env: { CORTAD_SOURCE: source } });
+  if (!size.ok) return { why: refusal({ code: 1, err: size.err + size.out }) };
+  if (Number(size.out.trim()) > MONGO_CAP) return { why: "big" };
+  // Each address goes into a file only the container's own user reads, never onto a command line.
+  const copy = await docker(["exec", "-e", "CORTAD_FROM", "-e", "CORTAD_TO", name, "bash", "-c",
+    "set -o pipefail; umask 077; printf '%s\\n' \"$CORTAD_FROM\" > /tmp/from.yaml && printf '%s\\n' \"$CORTAD_TO\" > /tmp/to.yaml && mongodump --config=/tmp/from.yaml --archive --quiet | mongorestore --config=/tmp/to.yaml --archive --quiet --nsExclude='config.*'; s=$?; rm -f /tmp/from.yaml /tmp/to.yaml; exit $s"],
+  { env: { CORTAD_FROM: `uri: ${JSON.stringify(source)}`, CORTAD_TO: `uri: ${JSON.stringify(target)}` }, timeout: 900_000 });
+  if (!copy.ok) return { why: refusal({ code: 1, err: copy.err }) };
+  if (restorer) await docker(["exec", "-e", "CORTAD_TARGET", name, "mongosh", "--nodb", "--quiet", "--eval", `new Mongo(process.env.CORTAD_TARGET).getDB("admin").dropUser(${JSON.stringify(restorer.user)})`], { env: { CORTAD_TARGET: target } });
+  return { port };
+}

package/lib/proof.mjs

@@ -991,7 +991,14 @@ export function canaryOf(exchanges, proof, found = null, own = []) {
   if (carried(b1)) add("shared-history", "theirs", "A new conversation carried an earlier one's words: every conversation on this endpoint shares what your app keeps, so test conversations would read each other's.");
   const met = metIn(a1, own);
   if (met) add("unreadable", "theirs", met);
-  else if (!ok(a1.status) || !replyOf(a1).text.trim()) add("unreadable", ok(a1.status) ? "ours" : "theirs", ok(a1.status) ? "The reply to the first message could not be read as words." : `Your app answered ${a1.status} to the first message.`);
+  else if (!ok(a1.status)) add("unreadable", "theirs", `Your app answered ${a1.status} to the first message.`);
+  else if (!replyOf(a1).text.trim()) {
+    // No words because the app's own model refused it is the app's key, card or model, never our
+    // reading: a wrong key in the twin's env file held Run as "could not be read as words", ours.
+    const calls = generation(a1);
+    const refused = calls.length && calls.every((c) => REFUSED.has(Number(c.status))) ? calls.at(-1) : null;
+    add("unreadable", refused ? "theirs" : "ours", refused ? `The first message reached your app's model, and the ${modelCall(refused)}, so no words came back.` : "The reply to the first message could not be read as words.");
+  }
   const instructions = str(generation(a1).find((c) => typeof c.instructions === "string")?.instructions).trim();
   const pieces = piecesOf(instructions);
   const request = norm(a1.body);