cortad 0.3.5 → 0.3.7

package/lib/reach.mjs

@@ -21,7 +21,7 @@ const appUrl = (runner) => new URL(`http://${runner.host === "::1" ? "[::1]" : r
 // Why nothing can be sent to the app this record names, or null.
 export function notUp(runner) {
   if (runner?.state !== "up") {
-    return !runner ? "No connect command is running for this repository, so no app is up on this machine."
+    return !runner ? "No connect command is running for this repository, so no app is up on this machine. Run npx cortad in this folder as a background command to connect it again."
       : runner.state === "failed" ? upper(runner.error) : "Your app is still starting.";
   }
   const host = runner.host ?? "127.0.0.1";

package/lib/replay.mjs

@@ -461,7 +461,12 @@ export function makeAccounts(file = null) {
   let bare = null;
   if (file) {
     try {
-      for (const a of JSON.parse(readFileSync(file, "utf8"))) {
+      const stored = JSON.parse(readFileSync(file, "utf8"));
+      // A visitor who is not signed in still sends what the app lets them in by (its Origin): ulaim
+      // refused every test request of a reconnect with 403, having been sent none of it.
+      const visitor = Array.isArray(stored) ? null : stored?.visitor;
+      if (visitor && typeof visitor === "object" && !signInKey(visitor)) bare = Object.fromEntries(Object.entries(visitor).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
+      for (const a of Array.isArray(stored) ? stored : stored?.accounts ?? []) {
         if (kept.length >= ACCOUNTS_MAX || typeof a?.key !== "string" || !a.headers || typeof a.headers !== "object") continue;
         const headers = Object.fromEntries(Object.entries(a.headers).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
         if (signInKey(headers) !== a.key || (identityOf(headers).expiresInS ?? 1) <= 0) continue;
@@ -473,7 +478,7 @@ export function makeAccounts(file = null) {
     if (!file) return;
     try {
       mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
-      writeFileSync(file, JSON.stringify(kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) }))), { mode: 0o600 });
+      writeFileSync(file, JSON.stringify({ visitor: bare, accounts: kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) })) }), { mode: 0o600 });
     } catch { /* kept for this connect only */ }
   };
   const at = (role) => { const m = ACCOUNT_ROLE.exec(role); return m ? kept[Number(m[1] ?? 1) - 1] ?? kept[0] ?? null : null; };
@@ -481,7 +486,7 @@ export function makeAccounts(file = null) {
     // `door` and `body`: the request as that customer sent it, for the values in it that are theirs.
     keep(headers, door, body) {
       const key = signInKey(headers);
-      if (!key) { bare = headers; return; }
+      if (!key) { bare = headers; save(); return; }
       let account = kept.find((a) => a.key === key);
       if (account) account.headers = headers;
       else {

package/lib/verbs.mjs

@@ -16,7 +16,7 @@ import { fieldConnectText, fieldText, findingsText, finished, linesOf, notStarte
 // the run before them has its numbers in and its job is still ending: the server holds them until it
 // has, up to the same 45 seconds.
 
-const NOT_CONNECTED = "This folder is not connected to Cortad.\nFor the person: sign in at cortad.com and run the command the connect screen shows, in this folder.";
+const NOT_CONNECTED = "This folder is not connected to Cortad. Run npx cortad in this folder as a background command: it prints a link for the person to approve.\nFor the person: approve the link npx cortad prints, in a browser where you are signed in to Cortad.";
 const HOLD_S = 45;
 // `wait`: how often it asks whether a run has started, how long the connect command may be gone
 // before no run can start, and how long it waits for one at all.
@@ -204,7 +204,7 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
     let goneAt = null;
     for (;;) {
       if (runner()) goneAt = null;
-      else if (now() - (goneAt ??= now()) >= GONE_MS) return { text: "The connect command stopped, so no run can start from the browser.\nFor the person: run the connect command again in this folder.\nnext: status", isError: true };
+      else if (now() - (goneAt ??= now()) >= GONE_MS) return { text: "The connect command stopped, so no run can start from the browser. Run npx cortad in this folder again as a background command: it reconnects with the key it kept.\nnext: status", isError: true };
       if (now() - began >= IDLE_MS) return { text: `No run ended in 6 hours.\nnext: npx -y ${spec} wait` };
       const res = id ? await call("GET", `/mcp/run/${encodeURIComponent(id)}?wait=${HOLD_S}`, undefined, (HOLD_S + 13) * 1000) : await call("GET", "/mcp/status?quiet=1");
       // A key that no longer opens this repository, or a run that is gone, does not come back by asking again.

package/local.mjs

@@ -61,7 +61,7 @@ if (unknownVerb(argv[0])) {
 const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : undefined; };
 const verbose = argv.includes("--verbose");
 // A code is eight characters from the connect screen's alphabet, which has no I, O, 0 or 1.
-const code = (argv.find((a) => /^[A-HJ-NP-Za-hj-np-z2-9-]{8,9}$/.test(a) && !a.startsWith("-")) ?? "").toUpperCase().replace(/-/g, "");
+let code = (argv.find((a) => /^[A-HJ-NP-Za-hj-np-z2-9-]{8,9}$/.test(a) && !a.startsWith("-")) ?? "").toUpperCase().replace(/-/g, "");
 const say = (line) => console.log(`cortad  ${line}`);
 const fail = (line) => { console.error(`cortad  ${line}`); process.exit(1); };
 
@@ -82,7 +82,10 @@ const step = (line) => {
 };
 const clearStep = () => { if (process.stdout.isTTY) process.stdout.write("\r\x1b[K"); };
 const stepDone = (line) => { clearStep(); say(line); };
-if (!explain && !viaToken && !/^[A-Z0-9]{8}$/.test(code)) fail(`usage: npx cortad <code from the connect screen> [--port N] [--start \"cmd\"] [--proxy]   |   npx cortad --explain   |   npx cortad ${[...VERBS, "wait"].join(" | ")}`);
+// `npx cortad` alone connects too: with the key this folder kept from its last connect, or, with none,
+// by one approval in the browser (pairing below). A word that is neither a code nor a flag is refused.
+const words = argv.filter((a, i) => !a.startsWith("-") && !["--port", "--start"].includes(argv[i - 1] ?? ""));
+if (!explain && !viaToken && words.length && !/^[A-Z0-9]{8}$/.test(code)) fail(`usage: npx cortad <code from the connect screen> [--port N] [--start \"cmd\"] [--proxy]   |   npx cortad --explain   |   npx cortad ${[...VERBS, "wait"].join(" | ")}`);
 // Where Brainsless is. The host is not on the command line: a code cannot point at an impostor.
 const origin = new URL(process.env.CORTAD_ORIGIN || "https://cortad.com");
 // Ours, and only ours. brainsless.com is the same service under its earlier name and stays trusted
@@ -300,6 +303,27 @@ const mask = (text) => maskWith(String(text ?? ""), secrets);
 // ---- the wire
 let box = "";
 let key = "";
+// The browser approves this computer: a link to open where the person is signed in, and four
+// characters the page shows too. The terminal waits, and is handed a code once it is approved.
+async function paired() {
+  const machine = hostname().replace(/[^\w.-]/g, "-").slice(0, 80);
+  const opened = await call("POST", "/local/pair", { name: basename(root).replace(/[^\w.-]/g, "-").slice(0, 80), machine }).catch(unreachable);
+  if (!opened.ok) fail(opened.data?.error ?? `could not start connecting (${opened.status})`);
+  const link = `${origin.origin}/approve/${opened.data.id}`;
+  say(`approve this computer in your browser, where you are signed in to Cortad: ${link}`);
+  say(`the page shows ${opened.data.words} and ${machine}; approve only if both match`);
+  if (process.stdout.isTTY) {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    try { spawn(opener, [link], { stdio: "ignore", detached: true }).on("error", () => {}).unref(); } catch { /* the link is printed */ }
+  }
+  for (const until = Date.now() + 10 * 60_000; Date.now() < until; await new Promise((r) => setTimeout(r, 2_000))) {
+    const got = await call("POST", `/local/pair/${opened.data.id}/collect`, { secret: opened.data.secret }).catch(() => null);
+    if (got?.ok && typeof got.data?.code === "string") { say("approved"); return got.data.code; }
+    if (got && got.status === 410) break;
+  }
+  fail("the link was not approved within ten minutes. Run npx cortad again for a new one.");
+}
+
 async function call(method, path, body, { raw = false, timeoutMs = 60_000, headers = {} } = {}) {
   const res = await fetch(`${api}${path}`, {
     method,
@@ -410,7 +434,12 @@ async function verb(job) {
         if (role === CAPTURED || role.startsWith(`${CAPTURED}:`)) {
           spokenAs = role;
           // Speaking as one of the customers whose requests we watched: every header their own client sent.
-          for (const [name, value] of Object.entries(capture?.headers(role) ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          const theirs = capture?.headers(role);
+          for (const [name, value] of Object.entries(theirs ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          // No request of theirs is held (a new connect): sent from the app's own address, as Cortad's
+          // own test request is, so an app that lets visitors in by Origin lets this one in.
+          const from = !theirs && app ? ownOrigin(app.port) : null;
+          if (from && !Object.keys(headers).some((k) => k.toLowerCase() === "origin")) { headers.origin = from; headers.referer = `${from}/`; }
         } else {
           const held = await identities?.headerFor(role);
           if (held) { for (const k of Object.keys(headers)) if (k.toLowerCase() === held.name) delete headers[k]; headers[held.name] = held.value; }
@@ -1183,15 +1212,21 @@ if (!files.length) fail("no source files here to read.");
 try { copyFileSync(join(homeOf(project), "tools.json"), join(work, "tools.json")); } catch { /* no run has read this project's tools yet */ }
 // The key the last connect left for this project, if any: the token face signs in with it. A connect
 // from the screen always asks for a fresh one, since the code may belong to another account or site.
-const stored = readToken(project);
-if (viaToken && !stored) fail("this project has no stored key. Run the command from the connect screen once.");
+let stored = readToken(project);
+if (viaToken && !stored) fail("this project has no stored key. Run npx cortad in this folder once.");
 // A network that drops while connecting ends here in a sentence, never a stack trace: running the
 // command again starts a clean connection.
 const unreachable = (err) => fail(`could not reach ${origin.host}: ${err?.name === "TimeoutError" ? "it did not answer in time" : "the connection failed"}. Check your connection and run the command again.`);
 // The key goes up beside a code too: a code that has lapsed while this project's key still holds is
 // the same person coming back, and the server signs them in by the key instead of refusing.
-const attach = await call("POST", "/local/attach", { ...(viaToken ? {} : { code }), name: basename(root), project },
+let attach = !code && !viaToken && !stored ? null : await call("POST", "/local/attach", { ...(viaToken ? {} : { code }), name: basename(root), project },
   stored ? { headers: { authorization: `Bearer ${stored}` } } : {}).catch(unreachable);
+// No code and no key that still signs in: the person approves this computer in their browser.
+if (!viaToken && !code && !attach?.ok) {
+  if (attach && stored) { say("the key this folder kept no longer signs in, so this computer is connected again"); stored = null; }
+  code = await paired();
+  attach = await call("POST", "/local/attach", { code, name: basename(root), project }).catch(unreachable);
+}
 if (!attach.ok) fail(attach.data?.error ?? `could not sign in (${attach.status})`);
 box = attach.data.box;
 key = attach.data.key;
@@ -1239,7 +1274,7 @@ for (let off = 0; off < bytes.length; off += PART) {
   // The last part asks for this machine's key when none is stored yet: minted once the repository
   // row exists, kept in ~/.cortad for the runs a coding agent asks for on later days.
   const put = await call("PUT", `/local/${box}/tree?last=${last ? 1 : 0}${last ? `&digest=${treeDigest}${head ? `&head=${head}` : ""}` : ""}`, bytes.subarray(off, off + PART),
-    { raw: true, timeoutMs: 120_000, ...(last && !viaToken ? { headers: { "x-cortad-machine": hostname().slice(0, 80) } } : {}) }).catch(unreachable);
+    { raw: true, timeoutMs: 120_000, ...(last && !viaToken && !stored ? { headers: { "x-cortad-machine": hostname().slice(0, 80) } } : {}) }).catch(unreachable);
   if (!put.ok) fail(put.data?.error ?? `upload failed (${put.status})`);
   if (last) {
     resumed = put.data?.resumed === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"

package/skill/SKILL.md

@@ -18,6 +18,13 @@ The tools are the `cortad` MCP tools. Where they are missing, each one is `npx {
 
 ## A session, start to finish
 
+## Connecting
+
+`npx {{cortad}}` in the repository's folder connects it, with nothing to copy. Run it as a background command (in Claude Code: Bash with run_in_background) and leave it running: it starts the app and keeps it reachable from the browser until it is stopped.
+- A folder connected before reconnects at once with the key it kept.
+- A folder connected for the first time prints a link and four characters, good for ten minutes. Give the person both as printed; they approve the link in their browser, signed in to Cortad, and the command goes on by itself.
+- When a result says no connect command is running, run `npx {{cortad}}` again in this folder. No code is needed from the person.
+
 The connect command prints "Go back to the browser" once it is connected. Cortad then finds the AI endpoints in the app's code and sends each one a test request itself, from this machine to the app on its port.
 
 1. Call `status` and tell the person, in a few plain lines: