modelos-secure 0.3.2 → 0.3.4

package/assets/{login-DeAJGhiN.js → login-DeGa63BQ.js}

@@ -49,11 +49,26 @@ function step(name, detail, state = "done") {
 	const right = state === "done" ? "done" : "";
 	say(`  ${bold(name.padEnd(STEP_WIDTH))}${detail}${right ? `  ${grey(right)}` : ""}`);
 }
+var RECOMMENDED = "   (recommended)";
+/**
+* The choices as the lines they take on screen, one each and none wider than the window. The
+* picker redraws by moving up exactly this many lines, so a line that wrapped would leave the one
+* above it standing: seen on an 80-column window, where "Yes" appeared twice.
+*/
+function choiceLines(choices, index, columns) {
+	return choices.map((choice, i) => {
+		const tail = choice.recommended ? RECOMMENDED : "";
+		const room = Math.max(8, columns - 1 - 4 - tail.length);
+		const label = choice.label.length > room ? `${choice.label.slice(0, room - 1)}${unicode ? "…" : "~"}` : choice.label;
+		return `  ${i === index ? blue(pointer) : " "} ${label}${tail ? grey(tail) : ""}`;
+	});
+}
 /** One question, one reason, a default. Arrows, Enter and the first letter of each choice. */
 async function ask(question, why, choices) {
 	const start = Math.max(0, choices.findIndex((c) => c.recommended));
 	say();
 	say(`  ${question}`);
+	if (why) say(`  ${grey(`Why we ask: ${why}`)}`);
 	say();
 	if (!interactive()) {
 		const chosen = choices[start];
@@ -63,14 +78,10 @@ async function ask(question, why, choices) {
 	let index = start;
 	const render = (first) => {
 		if (!first) process.stdout.write(`\u001b[${choices.length.toString()}A`);
-		for (const [i, choice] of choices.entries()) {
-			const mark = i === index ? blue(pointer) : " ";
-			process.stdout.write(`\u001b[2K  ${mark} ${choice.label}${choice.recommended ? grey("   (recommended)") : ""}\n`);
-		}
+		const columns = process.stdout.columns || 80;
+		for (const line of choiceLines(choices, index, columns)) process.stdout.write(`\u001b[2K${line}\n`);
 	};
 	render(true);
-	if (why) say(`\n  ${grey(`Why we ask: ${why}`)}`);
-	if (why) process.stdout.write(`\u001b[2A`);
 	return new Promise((resolve, reject) => {
 		emitKeypressEvents(process.stdin);
 		process.stdin.setRawMode(true);
@@ -79,7 +90,6 @@ async function ask(question, why, choices) {
 			process.stdin.off("keypress", onKey);
 			process.stdin.setRawMode(false);
 			process.stdin.pause();
-			if (why) process.stdout.write(`\u001b[2B\n`);
 		};
 		const onKey = (text, key) => {
 			if (key.ctrl && key.name === "c") {
@@ -89,7 +99,7 @@ async function ask(question, why, choices) {
 			}
 			if (key.name === "up") index = (index - 1 + choices.length) % choices.length;
 			else if (key.name === "down") index = (index + 1) % choices.length;
-			else if (key.name === "return") {
+			else if (key.name === "return" || key.name === "enter") {
 				done();
 				resolve(choices[index].value);
 				return;
@@ -120,7 +130,7 @@ async function askText(question, secret = false) {
 				reject(new Interrupted());
 				return;
 			}
-			if (key.name === "return") {
+			if (key.name === "return" || key.name === "enter") {
 				process.stdin.off("keypress", onKey);
 				process.stdin.setRawMode(false);
 				process.stdin.pause();

package/assets/login-Dz4o-1cM.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-DeGa63BQ.js";

package/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d as beforeStopping, f as blue, g as interactive, h as grey, i as IapRefusal, l as ask, m as finishBeforeStopping, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as red, x as step, y as say } from "./assets/login-DeAJGhiN.js";
+import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d as beforeStopping, f as blue, g as interactive, h as grey, i as IapRefusal, l as ask, m as finishBeforeStopping, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as red, x as step, y as say } from "./assets/login-DeGa63BQ.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
-import { access, appendFile, constants, glob, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
+import { access, appendFile, constants, glob, lstat, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -23,7 +23,7 @@ if (existsSync(resolve(here, "wasm"))) {
 }
 // package.json
 var name = "modelos-secure";
-var version$1 = "0.3.2";
+var version$1 = "0.3.4";
 var type = "module";
 var bin = { "modelos-secure": "dist/cli.js" };
 var exports$1 = { "./hook": "./dist/hook/hook.mjs" };
@@ -335,7 +335,17 @@ var SKIPPED = /* @__PURE__ */ new Set([
 	"e2e",
 	"coverage",
 	".turbo",
-	".cache"
+	".cache",
+	".idea",
+	".vscode",
+	".vs",
+	".terraform",
+	".ruff_cache",
+	".nox",
+	".gradle",
+	".yarn",
+	".svelte-kit",
+	".angular"
 ]);
 var MAX_FILE_BYTES = 1048576;
 var DOCUMENT = /* @__PURE__ */ new Set([
@@ -414,8 +424,10 @@ async function walk$1(root) {
 	};
 }
 /**
-* The folders whose manifests describe this one: itself, then each folder above it up to the
-* repository's root, for an app kept in a folder of a larger repository.
+* The folders whose manifests describe this one: itself, each folder above it up to the
+* repository's root, for an app kept in a folder of a larger repository, and the folders below
+* it that hold a manifest, for a repository whose app sits in `backend/` or `sidecar/`. Without
+* the ones below, such a repository showed no library, no framework and no route. ADR 0094.
 */
 async function manifestFolders(root) {
 	const folders = [root];
@@ -427,6 +439,23 @@ async function manifestFolders(root) {
 		folders.push(up);
 		at = up;
 	}
+	const below = async (dir, depth) => {
+		if (depth > 3) return;
+		for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+			if (!entry.isDirectory() || SKIPPED.has(entry.name) || entry.name.startsWith(".")) continue;
+			const full = join(dir, entry.name);
+			for (const manifest of [
+				"package.json",
+				"pyproject.toml",
+				"Pipfile"
+			]) if (await access(join(full, manifest)).then(() => true, () => false)) {
+				folders.push(full);
+				break;
+			}
+			await below(full, depth + 1);
+		}
+	};
+	await below(root, 1);
 	return folders;
 }
 /** A TOML file's sections by name, each with its body. Enough for the manifests read here. */
@@ -532,15 +561,25 @@ async function look(root) {
 		command: web,
 		from: "Procfile"
 	});
-	const composed = (await read("docker-compose.yml"))?.match(/^\s*command:\s*(.+)$/m)?.[1];
-	if (composed) startCommands.push({
-		command: composed.replace(/^["']|["']$/g, ""),
-		from: "docker-compose.yml"
-	});
-	const made = (await read("Makefile"))?.match(/^(?:run|start|serve):[^\n]*\n\t(.+)$/m)?.[1];
-	if (made) startCommands.push({
-		command: made,
-		from: "Makefile"
+	for (const name of [
+		"docker-compose.yml",
+		"docker-compose.yaml",
+		"compose.yml",
+		"compose.yaml"
+	]) {
+		const composed = (await read(name))?.match(/^\s*command:\s*(.+)$/m)?.[1];
+		if (composed) {
+			startCommands.push({
+				command: composed.replace(/^["']|["']$/g, ""),
+				from: name
+			});
+			break;
+		}
+	}
+	const target = (await read("Makefile"))?.match(/^(run|start|serve|dev|dev-api|api|server):[^\n]*\n\t(.+)$/m);
+	if (target) startCommands.push({
+		command: `make ${target[1]}`,
+		from: `Makefile, whose ${target[1]} target runs ${target[2].trim().split(/\s+/).slice(0, 3).join(" ")}`
 	});
 	const settingsFiles = [];
 	const settingNames = /* @__PURE__ */ new Set();
@@ -5621,46 +5660,128 @@ function docOf(node, file) {
 // ../../packages/scan/src/start-candidates.ts
 /** Words a README command starts with that start an app, not install or test one. */
 var STARTS = /^(?:\$\s*)?((?:uvicorn|gunicorn|hypercorn|fastapi (?:dev|run)|flask (?:--app \S+ )?run|streamlit run|chainlit run|gradio|python3? (?:-m )?\S+\.py|python3? -m \S+|(?:npm|pnpm|yarn|bun) (?:run )?(?:dev|start|serve)|node \S+\.(?:m?js|ts)|npx tsx \S+|docker compose up|docker-compose up)\b.*)$/;
+/** The words of an instruction in its list form, or null when it is in the shell form. */
+function listForm(body) {
+	try {
+		const parts = JSON.parse(body);
+		return Array.isArray(parts) ? parts.map(String) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* What a Dockerfile runs, as Docker reads it: the last stage's entrypoint with its command as the
+* arguments, unless the entrypoint is in the shell form, which ignores them. A health check's own
+* CMD is not it. Only arguments, starting with a dash, go to a program in the base image, which is
+* not here to name, so they are no command at all.
+*/
+function dockerCommand(dockerfile) {
+	const lines = dockerfile.replace(/\\\r?\n/g, " ").split(/\r?\n/).map((l) => l.trim());
+	const stage = lines.slice(lines.findLastIndex((l) => /^FROM\s/i.test(l)) + 1);
+	const last = (word) => stage.findLast((l) => new RegExp(`^${word}\\s`, "i").test(l))?.slice(word.length).trim();
+	const entrypoint = last("ENTRYPOINT");
+	if (entrypoint && !listForm(entrypoint)) return entrypoint;
+	const full = [entrypoint, last("CMD")].filter((body) => body !== void 0).map((body) => listForm(body)?.join(" ") ?? body).join(" ");
+	return full && !full.startsWith("-") ? full : null;
+}
+/**
+* Scripts beside the app, not the app: a main block in scripts/, tests/ or eval/, or in a file
+* named for a check, a benchmark or a one-off job, starts nothing a review could talk to.
+*/
+var ASIDE_FOLDERS = /(^|\/)(scripts?|tests?|evals?|benchmarks?|training|tools|migrations|examples?|notebooks?|docs?|bin|hooks|experiments?|utils?)(\/|$)/;
+var ASIDE_NAMES = /(^|\/)(benchmark|check|backfill|stress|verify|test|dump|audit|import|export|migrate|seed|setup|install|build|deploy|smoke|demo|debug|fixture|generate|convert|download|upload|sync|clean|classify|investigate|analy[sz]e|report)([_-][^/]*)?\.py$|(^|\/)conftest\.py$|_(test|tests|audit|smoke|check|benchmark|demo|gates?)\.py$/;
+function isAside(path) {
+	return ASIDE_FOLDERS.test(path.replace(/\/[^/]+$/, "")) || ASIDE_NAMES.test(path);
+}
+/**
+* The folder a Python file's absolute imports resolve from, which is where the app runs: for
+* `from app.db import x` in backend/app/main.py, that is backend. Empty for the repository's
+* root, or when nothing it imports is here.
+*/
+function importRoot(path, imports, files) {
+	const parts = path.split("/").slice(0, -1);
+	const own = imports.filter((name) => !name.startsWith("."));
+	for (let i = parts.length; i >= 0; i--) {
+		const dir = parts.slice(0, i).join("/");
+		const under = (rest) => dir ? `${dir}/${rest}` : rest;
+		if (own.some((name) => {
+			const head = name.split(".")[0];
+			return files.has(under(`${head}.py`)) || files.has(under(`${head}/__init__.py`));
+		})) return dir;
+	}
+	return "";
+}
+/** What is offered first: the framework's own way, then the build, the README, the scripts. */
+var RANK = [
+	[/^the (FastAPI|Starlette|Flask) (app|factory) /, 0],
+	[/^the Dockerfile's command$/, 1],
+	[/^README/i, 2],
+	[/^(package\.json|pyproject\.toml|Procfile|docker-compose|compose\.|Makefile)/, 3],
+	[/^the main block at ([^/]+\/)*(main|app|server|api|cli|run|serve|wsgi|asgi)\.py:/, 4]
+];
+function rankStart(candidates) {
+	const rank = (c) => RANK.find(([pattern]) => pattern.test(c.from))?.[1] ?? 5;
+	return candidates.map((c, i) => ({
+		c,
+		i
+	})).sort((a, b) => rank(a.c) - rank(b.c) || a.i - b.i).map(({ c }) => c);
+}
 async function startCandidates(look, project) {
 	const files = new Set(project.files.map((f) => f.path));
 	const read = (file) => readFile(join(look.root, file), "utf8").catch(() => null);
 	const found = [];
 	for (const file of project.files) {
 		if (file.language !== "python") continue;
-		const module = file.path.replace(/\.py$/, "").replace(/\//g, ".");
+		const symbols = symbolsOf(file);
+		const appDir = importRoot(file.path, symbols.imports, files);
+		const module = file.path.slice(appDir ? appDir.length + 1 : 0).replace(/\.py$/, "").replace(/\//g, ".");
+		const dirOption = appDir ? ` --app-dir ${appDir}` : "";
 		const standsAlone = module.includes(".") || !/^from \.+\w*\s+import/m.test(file.text);
-		for (const d of symbolsOf(file).declarations) {
+		const made = /* @__PURE__ */ new Set();
+		for (const d of symbols.declarations) {
 			const callee = d.callee.split(".").at(-1) ?? "";
 			if (!d.name) continue;
 			if (!standsAlone) continue;
-			if (/^(FastAPI|Starlette)$/.test(callee)) found.push({
-				command: `uvicorn ${module}:${d.name}`,
-				from: `the ${callee} app ${d.name} at ${file.path}:${d.line.toString()}`
-			});
-			else if (callee === "Flask") found.push({
-				command: `flask --app ${module}:${d.name} run`,
-				from: `the Flask app ${d.name} at ${file.path}:${d.line.toString()}`
+			if (/^(FastAPI|Starlette)$/.test(callee)) {
+				made.add(callee);
+				found.push({
+					command: `uvicorn ${module}:${d.name}${dirOption}`,
+					from: `the ${callee} app ${d.name} at ${file.path}:${d.line.toString()}`
+				});
+			} else if (callee === "Flask") {
+				made.add(callee);
+				found.push({
+					command: `flask --app ${module}:${d.name} run${dirOption}`,
+					from: `the Flask app ${d.name} at ${file.path}:${d.line.toString()}`
+				});
+			}
+		}
+		const lines = file.text.split("\n");
+		if (standsAlone) for (const s of symbols.symbols) {
+			if (s.kind !== "function") continue;
+			const body = lines.slice(s.line - 1, s.end).join("\n");
+			const callee = /\b(FastAPI|Starlette|Flask)\(/.exec(body)?.[1];
+			if (!callee || made.has(callee) || !/^\s+return\s/m.test(body)) continue;
+			found.push(callee === "Flask" ? {
+				command: `flask --app ${module}:${s.name} run${dirOption}`,
+				from: `the Flask factory ${s.name} at ${file.path}:${s.line.toString()}`
+			} : {
+				command: `uvicorn ${module}:${s.name} --factory${dirOption}`,
+				from: `the ${callee} factory ${s.name} at ${file.path}:${s.line.toString()}`
 			});
 		}
-		const main = file.text.split("\n").findIndex((l) => /^if __name__\s*==\s*["']__main__["']/.test(l));
-		if (main >= 0) found.push({
+		const main = lines.findIndex((l) => /^if __name__\s*==\s*["']__main__["']/.test(l));
+		if (main >= 0 && !isAside(file.path)) found.push({
 			command: `python ${file.path}`,
 			from: `the main block at ${file.path}:${(main + 1).toString()}`
 		});
 	}
-	const cmd = (await read("Dockerfile"))?.split("\n").reverse().find((l) => /^\s*(CMD|ENTRYPOINT)\s/i.test(l));
-	if (cmd) {
-		const body = cmd.replace(/^\s*(CMD|ENTRYPOINT)\s+/i, "").trim();
-		let command = body;
-		try {
-			const parts = JSON.parse(body);
-			if (Array.isArray(parts)) command = parts.map(String).join(" ");
-		} catch {}
-		if (command) found.push({
-			command,
-			from: "the Dockerfile's command"
-		});
-	}
+	const dockerfile = await read("Dockerfile");
+	const command = dockerfile ? dockerCommand(dockerfile) : null;
+	if (command) found.push({
+		command,
+		from: "the Dockerfile's command"
+	});
 	for (const name of [
 		"README.md",
 		"readme.md",
@@ -5680,8 +5801,10 @@ async function startCandidates(look, project) {
 	return found.filter((c) => {
 		if (seen.has(c.command)) return false;
 		seen.add(c.command);
-		const file = c.command.split(/\s+/).find((w) => /\.(py|m?js|ts)$/.test(w));
-		return !file || files.has(file.replace(/^\.\//, ""));
+		const file = c.command.split(/\s+/).find((w) => /\.(py|m?js|ts)$/.test(w))?.replace(/^\.\//, "");
+		if (!file) return true;
+		if (/^README/i.test(c.from) && isAside(file)) return false;
+		return files.has(file);
 	});
 }
 // ../../packages/scan/src/outline.ts
@@ -5722,7 +5845,8 @@ var where$1 = (f) => ({
 	file: f.file,
 	line: f.line
 });
-async function buildOutline(look, facts, project) {
+async function buildOutline(look, facts, project, options = {}) {
+	const budget = options.budget ?? BUDGET;
 	const outlines = project.files.map(symbolsOf);
 	const known = await localValues(look.root, look.settingsFiles);
 	const ranked = [...outlines].sort((a, b) => priority(b) - priority(a));
@@ -5731,7 +5855,7 @@ async function buildOutline(look, facts, project) {
 	let size = 0;
 	for (const file of ranked) {
 		const bytes = JSON.stringify(file).length;
-		if (size + bytes > BUDGET) omitted.push(file.file);
+		if (size + bytes > budget) omitted.push(file.file);
 		else {
 			code.push(file);
 			size += bytes;
@@ -6135,7 +6259,7 @@ function draftConfig(input) {
 		trigger: previous?.ways_in.find((w) => w.kind === "conversation")?.trigger ?? "Hello, can you help me?"
 	});
 	for (const fact of wayFacts) {
-		const before = previous?.ways_in.find((w) => w.name === fact.name || w.function === fact.function);
+		const before = previous?.ways_in.find((w) => w.name === fact.name || !!fact.function && w.function === fact.function);
 		const understood = understanding?.waysIn.find((w) => w.name === fact.name);
 		if (before) {
 			waysIn.push({
@@ -6368,11 +6492,15 @@ function resolveImport(from, name, known) {
 		base = up.slice(0, Math.max(0, up.length - (dots - 1))).join("/");
 	} else base = "";
 	const path = rest ? base ? `${base}/${rest}` : rest : base;
-	return first((dots > 0 ? [""] : [
+	const parts = dir.split("/").filter(Boolean);
+	const ancestors = parts.map((_, i) => `${parts.slice(0, parts.length - i).join("/")}/`);
+	return first((dots > 0 ? [""] : [.../* @__PURE__ */ new Set([
+		...ancestors,
 		"",
 		"src/",
-		"app/"
-	]).flatMap((root) => [`${root}${path}.py`, `${root}${path}/__init__.py`]));
+		"app/",
+		...ancestors.map((a) => `${a}src/`)
+	])]).flatMap((root) => [`${root}${path}.py`, `${root}${path}/__init__.py`]));
 }
 function normalise(path) {
 	const out = [];
@@ -6395,15 +6523,36 @@ var LIMITS = {
 	maxFileBytes: 1e6
 };
 var CODE_TOOLS = ["grep", "read"];
-/** Every file in the repository the tools could see, skipping what the scan never walks. */
+var NOT_OPENED = "the scan never opens that folder";
+/** Whether the scan opens a folder at all: no part of its path is one it never walks. */
+var opensFolder = (dir) => !dir.split("/").some((part) => SKIPPED.has(part.toLowerCase()));
+/**
+* Every file in the repository the tools could see, and so what --explain counts. All of it by hand
+* rather than by glob, whose `*` leaves out names starting with a dot, which is where settings files
+* are. A link is not a file here: it could lead outside the repository. ADR 0093.
+*/
 async function repositoryFiles(root, pattern = "**/*", most = 5e3) {
 	const found = [];
+	if (pattern === "**/*") {
+		const walk = async (dir) => {
+			const entries = await readdir(join(root, dir), { withFileTypes: true }).catch(() => []);
+			for (const entry of entries) {
+				if (found.length >= most) return;
+				const path = posix.join(dir, entry.name);
+				if (entry.isFile()) found.push(path);
+				else if (entry.isDirectory() && opensFolder(entry.name)) await walk(path);
+			}
+		};
+		await walk("");
+		return found.sort();
+	}
 	for await (const entry of glob(pattern, {
 		cwd: root,
 		exclude: (name) => SKIPPED.has(String(name).split(/[\\/]/).at(-1) ?? "")
 	})) {
 		const path = String(entry).split("\\").join("/");
-		if ((await stat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
+		if (!opensFolder(posix.dirname(path))) continue;
+		if ((await lstat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
 		if (found.length >= most) break;
 	}
 	return found.sort();
@@ -6419,6 +6568,7 @@ function createTools(input) {
 			const dir = String(args.dir ?? ".");
 			const inRepo = await insideRepository(root, dir);
 			if (inRepo === null) return refused(dir, "it is not a folder in this repository");
+			if (!opensFolder(inRepo)) return refused(inRepo, NOT_OPENED);
 			const entries = await readdir(join(root, inRepo), { withFileTypes: true }).catch(() => null);
 			if (!entries) return refused(dir, "it is not a folder in this repository");
 			return {
@@ -6463,6 +6613,7 @@ function createTools(input) {
 			if (inRepo === null) return refused(path, "it is not a file in this repository");
 			const why = neverRead(inRepo);
 			if (why) return refused(inRepo, why);
+			if (!opensFolder(posix.dirname(inRepo))) return refused(inRepo, NOT_OPENED);
 			if ((await stat(join(root, inRepo))).size > LIMITS.maxFileBytes) return refused(inRepo, "it is over 1 MB");
 			const all = (await readFile(join(root, inRepo), "utf8")).split(/\r?\n/);
 			const from = Math.max(1, Number(args.from ?? (args.to === void 0 ? 1 : args.to - LIMITS.readLines + 1)));
@@ -6924,7 +7075,7 @@ async function answerQuestion(input) {
 async function scanFolder(root) {
 	const found = await look(root);
 	const { facts, adapters, project } = await readFacts(found);
-	found.startCommands.push(...await startCandidates(found, project));
+	found.startCommands = rankStart([...found.startCommands, ...await startCandidates(found, project)]);
 	return {
 		look: found,
 		facts,
@@ -20713,6 +20864,23 @@ async function scriptsIn(dir) {
 		return {};
 	}
 }
+var SAME_INTERPRETER = {
+	python: "python3",
+	python3: "python",
+	pip: "pip3",
+	pip3: "pip"
+};
+/**
+* The same command under the interpreter's name this machine has: `python main.py` where only
+* `python3` is installed, as on most Linux and Mac machines, or the reverse on Windows. A command
+* whose first word is here already is returned as it is.
+*/
+async function interpreterHere(command) {
+	const [first = "", ...rest] = command.trim().split(/\s+/);
+	const other = SAME_INTERPRETER[first];
+	if (!other || await onPath(first) || !await onPath(other)) return command;
+	return [other, ...rest].join(" ");
+}
 /**
 * Why `command` cannot start the app in `dir`, in one sentence, or null when it can as far as can
 * be told without running it.
@@ -21305,7 +21473,7 @@ function toFix(ctx, fix) {
 			}
 		};
 		case "run-command": return {
-			label: `${fix.label}: ${fix.command}`,
+			label: fix.label.includes(fix.command) ? fix.label : `${fix.label}: ${fix.command}`,
 			needsPerson: true,
 			apply: async () => {
 				if (!interactive()) return;
@@ -21350,7 +21518,7 @@ var DONT_KNOW = /^(i\s+)?(don'?t|do not)\s+know|^not\s+sure|^no\s+idea|^\?$/i;
 */
 async function typeTheCommand(ctx) {
 	for (let tries = 0; tries < 3; tries++) {
-		const typed = (await askText("How do you start the app?")).trim();
+		const typed = await interpreterHere((await askText("How do you start the app?")).trim());
 		if (!typed || DONT_KNOW.test(typed)) return;
 		const why = await whyNotRunnable(ctx.dir, typed);
 		if (!why) {
@@ -21367,13 +21535,14 @@ async function typeTheCommand(ctx) {
 async function candidateFixes(ctx) {
 	const fixes = [];
 	for (const c of ctx.startCommands) {
-		if (c.command === ctx.config.start?.command) continue;
-		if (await whyNotRunnable(ctx.dir, c.command)) continue;
+		const command = await interpreterHere(c.command);
+		if (command === ctx.config.start?.command) continue;
+		if (await whyNotRunnable(ctx.dir, command)) continue;
 		fixes.push({
-			label: `${c.command}   (from ${c.from})`,
+			label: `${command}   (from ${c.from})`,
 			apply: () => void (ctx.config.start = {
 				...ctx.config.start,
-				command: c.command
+				command
 			})
 		});
 	}
@@ -21389,7 +21558,11 @@ var notKnown = {
 /** Starts the pool, or fails with what happened and how to fix it. */
 async function startApp(ctx, instances) {
 	const { config } = ctx;
-	const command = config.start?.command;
+	const command = config.start?.command ? await interpreterHere(config.start.command) : void 0;
+	if (command && config.start && command !== config.start.command) config.start = {
+		...config.start,
+		command
+	};
 	const typeIt = {
 		label: "Type the command",
 		apply: () => typeTheCommand(ctx)
@@ -22103,6 +22276,7 @@ async function scanCommand(dir, options) {
 		say(`\nNever sent, whatever is asked (${neverSent.length.toString()}):`);
 		for (const n of neverSent) say(`  ${n.path}, because ${n.why}`);
 		if (neverSent.length === 0) say("  nothing here matches");
+		say("\nThe scan never opens folders such as .git, node_modules and tests, so nothing in them is listed or read.");
 		say(`\nWhat was actually sent on earlier runs is in .modelos-secure/sent.jsonl.`);
 		return;
 	}
@@ -22157,7 +22331,7 @@ async function scanCommand(dir, options) {
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-CvPyhFJ7.js");
+					const { loginCommand } = await import("./assets/login-Dz4o-1cM.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;
@@ -22275,7 +22449,7 @@ async function scanCommand(dir, options) {
 		config = treatToolAs(config, tool.name, state.answers[id]);
 	}
 	if (drafted.config.decided_for_you?.length) say(`  ${grey(`I hit the limit of 7 questions, so I made the safer choice on ${plural(drafted.config.decided_for_you.length, "tool")} and recorded it for review in modelos-secure.yaml.`)}`);
-	const candidates = [...new Map([...reading?.verified.start ?? [], ...result.look.startCommands].map((c) => [c.command, c])).values()];
+	const candidates = [...new Map([...reading?.verified.start ?? [], ...result.look.startCommands].map((c) => [c.command, c])).values()].slice(0, 6);
 	if (!previous?.start?.command && candidates.length > 1 && !options.ci) {
 		const command = (state.answers.start ?? (options.yes ? candidates[0].command : await ask("How should the scan start the app?", "It starts the app on this machine, with the hooks attached, to check the connection.", [...candidates.map((c, i) => ({
 			label: `${c.command}   (${c.from})`,
@@ -22327,12 +22501,13 @@ async function scanCommand(dir, options) {
 	const paths = (config.ways_in.length || 1) * (config.rules.length || 1);
 	say(`\n  ${bold(`${config.system} is connected.`)}\n`);
 	say(`  ${`${plural(config.ways_in.length, "way")} in`.padEnd(14)} ${config.ways_in.map((w) => w.name).join(", ")}`);
-	say(`  ${plural(config.tools.length, "tool").padEnd(14)} ${plural(held(config).length, "tool")} held during reviews: ${held(config).join(", ")}`);
+	const heldNow = held(config);
+	say(`  ${plural(config.tools.length, "tool").padEnd(14)} ${config.tools.length === 0 ? "none to hold" : heldNow.length === 0 ? "none held during reviews" : `${heldNow.length.toString()} held during reviews: ${heldNow.join(", ")}`}`);
 	say(`  ${plural(paths, "path").padEnd(14)} none tested yet\n`);
 	const url = connection ? `${connection.url}/systems/${system.id}` : "";
 	say(`  Map:  ${url}`);
-	if (options.noReview || options.ci) return;
-	if (options.yes ? false : await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", "It starts the app on this machine with the hooks attached, checks they hold what they should, then reviews it.", [{
+	if (options.noReview || options.ci || options.yes || !interactive()) return;
+	if (await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", "It starts the app on this machine with the hooks attached, checks they hold what they should, then reviews it.", [{
 		label: "Yes, start it",
 		value: true,
 		recommended: true
@@ -22401,8 +22576,8 @@ async function sessionCommand(dir, run) {
 	for (;;) {
 		say();
 		const line = await askText(">");
-		const word = line.toLowerCase();
-		if (!line || word === "quit" || word === "exit") return;
+		const word = line.toLowerCase().replace(/\(\)$/, "");
+		if (!line || word === "quit" || word === "exit" || word === "q") return;
 		if (word === "help") {
 			run.help();
 			continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {

package/assets/login-CvPyhFJ7.js

@@ -1 +0,0 @@
-export { t as loginCommand } from "./login-DeAJGhiN.js";