cortad 0.3.5 → 0.3.6

package/lib/replay.mjs

@@ -461,7 +461,12 @@ export function makeAccounts(file = null) {
   let bare = null;
   if (file) {
     try {
-      for (const a of JSON.parse(readFileSync(file, "utf8"))) {
+      const stored = JSON.parse(readFileSync(file, "utf8"));
+      // A visitor who is not signed in still sends what the app lets them in by (its Origin): ulaim
+      // refused every test request of a reconnect with 403, having been sent none of it.
+      const visitor = Array.isArray(stored) ? null : stored?.visitor;
+      if (visitor && typeof visitor === "object" && !signInKey(visitor)) bare = Object.fromEntries(Object.entries(visitor).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
+      for (const a of Array.isArray(stored) ? stored : stored?.accounts ?? []) {
         if (kept.length >= ACCOUNTS_MAX || typeof a?.key !== "string" || !a.headers || typeof a.headers !== "object") continue;
         const headers = Object.fromEntries(Object.entries(a.headers).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
         if (signInKey(headers) !== a.key || (identityOf(headers).expiresInS ?? 1) <= 0) continue;
@@ -473,7 +478,7 @@ export function makeAccounts(file = null) {
     if (!file) return;
     try {
       mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
-      writeFileSync(file, JSON.stringify(kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) }))), { mode: 0o600 });
+      writeFileSync(file, JSON.stringify({ visitor: bare, accounts: kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) })) }), { mode: 0o600 });
     } catch { /* kept for this connect only */ }
   };
   const at = (role) => { const m = ACCOUNT_ROLE.exec(role); return m ? kept[Number(m[1] ?? 1) - 1] ?? kept[0] ?? null : null; };
@@ -481,7 +486,7 @@ export function makeAccounts(file = null) {
     // `door` and `body`: the request as that customer sent it, for the values in it that are theirs.
     keep(headers, door, body) {
       const key = signInKey(headers);
-      if (!key) { bare = headers; return; }
+      if (!key) { bare = headers; save(); return; }
       let account = kept.find((a) => a.key === key);
       if (account) account.headers = headers;
       else {

package/local.mjs

@@ -410,7 +410,12 @@ async function verb(job) {
         if (role === CAPTURED || role.startsWith(`${CAPTURED}:`)) {
           spokenAs = role;
           // Speaking as one of the customers whose requests we watched: every header their own client sent.
-          for (const [name, value] of Object.entries(capture?.headers(role) ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          const theirs = capture?.headers(role);
+          for (const [name, value] of Object.entries(theirs ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          // No request of theirs is held (a new connect): sent from the app's own address, as Cortad's
+          // own test request is, so an app that lets visitors in by Origin lets this one in.
+          const from = !theirs && app ? ownOrigin(app.port) : null;
+          if (from && !Object.keys(headers).some((k) => k.toLowerCase() === "origin")) { headers.origin = from; headers.referer = `${from}/`; }
         } else {
           const held = await identities?.headerFor(role);
           if (held) { for (const k of Object.keys(headers)) if (k.toLowerCase() === held.name) delete headers[k]; headers[held.name] = held.value; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"