modelos-secure 0.3.3 → 0.3.4

package/assets/{login-DeAJGhiN.js → login-DeGa63BQ.js}

@@ -49,11 +49,26 @@ function step(name, detail, state = "done") {
 	const right = state === "done" ? "done" : "";
 	say(`  ${bold(name.padEnd(STEP_WIDTH))}${detail}${right ? `  ${grey(right)}` : ""}`);
 }
+var RECOMMENDED = "   (recommended)";
+/**
+* The choices as the lines they take on screen, one each and none wider than the window. The
+* picker redraws by moving up exactly this many lines, so a line that wrapped would leave the one
+* above it standing: seen on an 80-column window, where "Yes" appeared twice.
+*/
+function choiceLines(choices, index, columns) {
+	return choices.map((choice, i) => {
+		const tail = choice.recommended ? RECOMMENDED : "";
+		const room = Math.max(8, columns - 1 - 4 - tail.length);
+		const label = choice.label.length > room ? `${choice.label.slice(0, room - 1)}${unicode ? "…" : "~"}` : choice.label;
+		return `  ${i === index ? blue(pointer) : " "} ${label}${tail ? grey(tail) : ""}`;
+	});
+}
 /** One question, one reason, a default. Arrows, Enter and the first letter of each choice. */
 async function ask(question, why, choices) {
 	const start = Math.max(0, choices.findIndex((c) => c.recommended));
 	say();
 	say(`  ${question}`);
+	if (why) say(`  ${grey(`Why we ask: ${why}`)}`);
 	say();
 	if (!interactive()) {
 		const chosen = choices[start];
@@ -63,14 +78,10 @@ async function ask(question, why, choices) {
 	let index = start;
 	const render = (first) => {
 		if (!first) process.stdout.write(`\u001b[${choices.length.toString()}A`);
-		for (const [i, choice] of choices.entries()) {
-			const mark = i === index ? blue(pointer) : " ";
-			process.stdout.write(`\u001b[2K  ${mark} ${choice.label}${choice.recommended ? grey("   (recommended)") : ""}\n`);
-		}
+		const columns = process.stdout.columns || 80;
+		for (const line of choiceLines(choices, index, columns)) process.stdout.write(`\u001b[2K${line}\n`);
 	};
 	render(true);
-	if (why) say(`\n  ${grey(`Why we ask: ${why}`)}`);
-	if (why) process.stdout.write(`\u001b[2A`);
 	return new Promise((resolve, reject) => {
 		emitKeypressEvents(process.stdin);
 		process.stdin.setRawMode(true);
@@ -79,7 +90,6 @@ async function ask(question, why, choices) {
 			process.stdin.off("keypress", onKey);
 			process.stdin.setRawMode(false);
 			process.stdin.pause();
-			if (why) process.stdout.write(`\u001b[2B\n`);
 		};
 		const onKey = (text, key) => {
 			if (key.ctrl && key.name === "c") {
@@ -89,7 +99,7 @@ async function ask(question, why, choices) {
 			}
 			if (key.name === "up") index = (index - 1 + choices.length) % choices.length;
 			else if (key.name === "down") index = (index + 1) % choices.length;
-			else if (key.name === "return") {
+			else if (key.name === "return" || key.name === "enter") {
 				done();
 				resolve(choices[index].value);
 				return;
@@ -120,7 +130,7 @@ async function askText(question, secret = false) {
 				reject(new Interrupted());
 				return;
 			}
-			if (key.name === "return") {
+			if (key.name === "return" || key.name === "enter") {
 				process.stdin.off("keypress", onKey);
 				process.stdin.setRawMode(false);
 				process.stdin.pause();

package/assets/login-Dz4o-1cM.js

@@ -0,0 +1 @@
+export { t as loginCommand } from "./login-DeGa63BQ.js";

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d as beforeStopping, f as blue, g as interactive, h as grey, i as IapRefusal, l as ask, m as finishBeforeStopping, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as red, x as step, y as say } from "./assets/login-DeAJGhiN.js";
+import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d as beforeStopping, f as blue, g as interactive, h as grey, i as IapRefusal, l as ask, m as finishBeforeStopping, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as red, x as step, y as say } from "./assets/login-DeGa63BQ.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -23,7 +23,7 @@ if (existsSync(resolve(here, "wasm"))) {
 }
 // package.json
 var name = "modelos-secure";
-var version$1 = "0.3.3";
+var version$1 = "0.3.4";
 var type = "module";
 var bin = { "modelos-secure": "dist/cli.js" };
 var exports$1 = { "./hook": "./dist/hook/hook.mjs" };
@@ -424,8 +424,10 @@ async function walk$1(root) {
 	};
 }
 /**
-* The folders whose manifests describe this one: itself, then each folder above it up to the
-* repository's root, for an app kept in a folder of a larger repository.
+* The folders whose manifests describe this one: itself, each folder above it up to the
+* repository's root, for an app kept in a folder of a larger repository, and the folders below
+* it that hold a manifest, for a repository whose app sits in `backend/` or `sidecar/`. Without
+* the ones below, such a repository showed no library, no framework and no route. ADR 0094.
 */
 async function manifestFolders(root) {
 	const folders = [root];
@@ -437,6 +439,23 @@ async function manifestFolders(root) {
 		folders.push(up);
 		at = up;
 	}
+	const below = async (dir, depth) => {
+		if (depth > 3) return;
+		for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+			if (!entry.isDirectory() || SKIPPED.has(entry.name) || entry.name.startsWith(".")) continue;
+			const full = join(dir, entry.name);
+			for (const manifest of [
+				"package.json",
+				"pyproject.toml",
+				"Pipfile"
+			]) if (await access(join(full, manifest)).then(() => true, () => false)) {
+				folders.push(full);
+				break;
+			}
+			await below(full, depth + 1);
+		}
+	};
+	await below(root, 1);
 	return folders;
 }
 /** A TOML file's sections by name, each with its body. Enough for the manifests read here. */
@@ -542,15 +561,25 @@ async function look(root) {
 		command: web,
 		from: "Procfile"
 	});
-	const composed = (await read("docker-compose.yml"))?.match(/^\s*command:\s*(.+)$/m)?.[1];
-	if (composed) startCommands.push({
-		command: composed.replace(/^["']|["']$/g, ""),
-		from: "docker-compose.yml"
-	});
-	const made = (await read("Makefile"))?.match(/^(?:run|start|serve):[^\n]*\n\t(.+)$/m)?.[1];
-	if (made) startCommands.push({
-		command: made,
-		from: "Makefile"
+	for (const name of [
+		"docker-compose.yml",
+		"docker-compose.yaml",
+		"compose.yml",
+		"compose.yaml"
+	]) {
+		const composed = (await read(name))?.match(/^\s*command:\s*(.+)$/m)?.[1];
+		if (composed) {
+			startCommands.push({
+				command: composed.replace(/^["']|["']$/g, ""),
+				from: name
+			});
+			break;
+		}
+	}
+	const target = (await read("Makefile"))?.match(/^(run|start|serve|dev|dev-api|api|server):[^\n]*\n\t(.+)$/m);
+	if (target) startCommands.push({
+		command: `make ${target[1]}`,
+		from: `Makefile, whose ${target[1]} target runs ${target[2].trim().split(/\s+/).slice(0, 3).join(" ")}`
 	});
 	const settingsFiles = [];
 	const settingNames = /* @__PURE__ */ new Set();
@@ -5655,29 +5684,94 @@ function dockerCommand(dockerfile) {
 	const full = [entrypoint, last("CMD")].filter((body) => body !== void 0).map((body) => listForm(body)?.join(" ") ?? body).join(" ");
 	return full && !full.startsWith("-") ? full : null;
 }
+/**
+* Scripts beside the app, not the app: a main block in scripts/, tests/ or eval/, or in a file
+* named for a check, a benchmark or a one-off job, starts nothing a review could talk to.
+*/
+var ASIDE_FOLDERS = /(^|\/)(scripts?|tests?|evals?|benchmarks?|training|tools|migrations|examples?|notebooks?|docs?|bin|hooks|experiments?|utils?)(\/|$)/;
+var ASIDE_NAMES = /(^|\/)(benchmark|check|backfill|stress|verify|test|dump|audit|import|export|migrate|seed|setup|install|build|deploy|smoke|demo|debug|fixture|generate|convert|download|upload|sync|clean|classify|investigate|analy[sz]e|report)([_-][^/]*)?\.py$|(^|\/)conftest\.py$|_(test|tests|audit|smoke|check|benchmark|demo|gates?)\.py$/;
+function isAside(path) {
+	return ASIDE_FOLDERS.test(path.replace(/\/[^/]+$/, "")) || ASIDE_NAMES.test(path);
+}
+/**
+* The folder a Python file's absolute imports resolve from, which is where the app runs: for
+* `from app.db import x` in backend/app/main.py, that is backend. Empty for the repository's
+* root, or when nothing it imports is here.
+*/
+function importRoot(path, imports, files) {
+	const parts = path.split("/").slice(0, -1);
+	const own = imports.filter((name) => !name.startsWith("."));
+	for (let i = parts.length; i >= 0; i--) {
+		const dir = parts.slice(0, i).join("/");
+		const under = (rest) => dir ? `${dir}/${rest}` : rest;
+		if (own.some((name) => {
+			const head = name.split(".")[0];
+			return files.has(under(`${head}.py`)) || files.has(under(`${head}/__init__.py`));
+		})) return dir;
+	}
+	return "";
+}
+/** What is offered first: the framework's own way, then the build, the README, the scripts. */
+var RANK = [
+	[/^the (FastAPI|Starlette|Flask) (app|factory) /, 0],
+	[/^the Dockerfile's command$/, 1],
+	[/^README/i, 2],
+	[/^(package\.json|pyproject\.toml|Procfile|docker-compose|compose\.|Makefile)/, 3],
+	[/^the main block at ([^/]+\/)*(main|app|server|api|cli|run|serve|wsgi|asgi)\.py:/, 4]
+];
+function rankStart(candidates) {
+	const rank = (c) => RANK.find(([pattern]) => pattern.test(c.from))?.[1] ?? 5;
+	return candidates.map((c, i) => ({
+		c,
+		i
+	})).sort((a, b) => rank(a.c) - rank(b.c) || a.i - b.i).map(({ c }) => c);
+}
 async function startCandidates(look, project) {
 	const files = new Set(project.files.map((f) => f.path));
 	const read = (file) => readFile(join(look.root, file), "utf8").catch(() => null);
 	const found = [];
 	for (const file of project.files) {
 		if (file.language !== "python") continue;
-		const module = file.path.replace(/\.py$/, "").replace(/\//g, ".");
+		const symbols = symbolsOf(file);
+		const appDir = importRoot(file.path, symbols.imports, files);
+		const module = file.path.slice(appDir ? appDir.length + 1 : 0).replace(/\.py$/, "").replace(/\//g, ".");
+		const dirOption = appDir ? ` --app-dir ${appDir}` : "";
 		const standsAlone = module.includes(".") || !/^from \.+\w*\s+import/m.test(file.text);
-		for (const d of symbolsOf(file).declarations) {
+		const made = /* @__PURE__ */ new Set();
+		for (const d of symbols.declarations) {
 			const callee = d.callee.split(".").at(-1) ?? "";
 			if (!d.name) continue;
 			if (!standsAlone) continue;
-			if (/^(FastAPI|Starlette)$/.test(callee)) found.push({
-				command: `uvicorn ${module}:${d.name}`,
-				from: `the ${callee} app ${d.name} at ${file.path}:${d.line.toString()}`
-			});
-			else if (callee === "Flask") found.push({
-				command: `flask --app ${module}:${d.name} run`,
-				from: `the Flask app ${d.name} at ${file.path}:${d.line.toString()}`
+			if (/^(FastAPI|Starlette)$/.test(callee)) {
+				made.add(callee);
+				found.push({
+					command: `uvicorn ${module}:${d.name}${dirOption}`,
+					from: `the ${callee} app ${d.name} at ${file.path}:${d.line.toString()}`
+				});
+			} else if (callee === "Flask") {
+				made.add(callee);
+				found.push({
+					command: `flask --app ${module}:${d.name} run${dirOption}`,
+					from: `the Flask app ${d.name} at ${file.path}:${d.line.toString()}`
+				});
+			}
+		}
+		const lines = file.text.split("\n");
+		if (standsAlone) for (const s of symbols.symbols) {
+			if (s.kind !== "function") continue;
+			const body = lines.slice(s.line - 1, s.end).join("\n");
+			const callee = /\b(FastAPI|Starlette|Flask)\(/.exec(body)?.[1];
+			if (!callee || made.has(callee) || !/^\s+return\s/m.test(body)) continue;
+			found.push(callee === "Flask" ? {
+				command: `flask --app ${module}:${s.name} run${dirOption}`,
+				from: `the Flask factory ${s.name} at ${file.path}:${s.line.toString()}`
+			} : {
+				command: `uvicorn ${module}:${s.name} --factory${dirOption}`,
+				from: `the ${callee} factory ${s.name} at ${file.path}:${s.line.toString()}`
 			});
 		}
-		const main = file.text.split("\n").findIndex((l) => /^if __name__\s*==\s*["']__main__["']/.test(l));
-		if (main >= 0) found.push({
+		const main = lines.findIndex((l) => /^if __name__\s*==\s*["']__main__["']/.test(l));
+		if (main >= 0 && !isAside(file.path)) found.push({
 			command: `python ${file.path}`,
 			from: `the main block at ${file.path}:${(main + 1).toString()}`
 		});
@@ -5707,8 +5801,10 @@ async function startCandidates(look, project) {
 	return found.filter((c) => {
 		if (seen.has(c.command)) return false;
 		seen.add(c.command);
-		const file = c.command.split(/\s+/).find((w) => /\.(py|m?js|ts)$/.test(w));
-		return !file || files.has(file.replace(/^\.\//, ""));
+		const file = c.command.split(/\s+/).find((w) => /\.(py|m?js|ts)$/.test(w))?.replace(/^\.\//, "");
+		if (!file) return true;
+		if (/^README/i.test(c.from) && isAside(file)) return false;
+		return files.has(file);
 	});
 }
 // ../../packages/scan/src/outline.ts
@@ -5749,7 +5845,8 @@ var where$1 = (f) => ({
 	file: f.file,
 	line: f.line
 });
-async function buildOutline(look, facts, project) {
+async function buildOutline(look, facts, project, options = {}) {
+	const budget = options.budget ?? BUDGET;
 	const outlines = project.files.map(symbolsOf);
 	const known = await localValues(look.root, look.settingsFiles);
 	const ranked = [...outlines].sort((a, b) => priority(b) - priority(a));
@@ -5758,7 +5855,7 @@ async function buildOutline(look, facts, project) {
 	let size = 0;
 	for (const file of ranked) {
 		const bytes = JSON.stringify(file).length;
-		if (size + bytes > BUDGET) omitted.push(file.file);
+		if (size + bytes > budget) omitted.push(file.file);
 		else {
 			code.push(file);
 			size += bytes;
@@ -6162,7 +6259,7 @@ function draftConfig(input) {
 		trigger: previous?.ways_in.find((w) => w.kind === "conversation")?.trigger ?? "Hello, can you help me?"
 	});
 	for (const fact of wayFacts) {
-		const before = previous?.ways_in.find((w) => w.name === fact.name || w.function === fact.function);
+		const before = previous?.ways_in.find((w) => w.name === fact.name || !!fact.function && w.function === fact.function);
 		const understood = understanding?.waysIn.find((w) => w.name === fact.name);
 		if (before) {
 			waysIn.push({
@@ -6395,11 +6492,15 @@ function resolveImport(from, name, known) {
 		base = up.slice(0, Math.max(0, up.length - (dots - 1))).join("/");
 	} else base = "";
 	const path = rest ? base ? `${base}/${rest}` : rest : base;
-	return first((dots > 0 ? [""] : [
+	const parts = dir.split("/").filter(Boolean);
+	const ancestors = parts.map((_, i) => `${parts.slice(0, parts.length - i).join("/")}/`);
+	return first((dots > 0 ? [""] : [.../* @__PURE__ */ new Set([
+		...ancestors,
 		"",
 		"src/",
-		"app/"
-	]).flatMap((root) => [`${root}${path}.py`, `${root}${path}/__init__.py`]));
+		"app/",
+		...ancestors.map((a) => `${a}src/`)
+	])]).flatMap((root) => [`${root}${path}.py`, `${root}${path}/__init__.py`]));
 }
 function normalise(path) {
 	const out = [];
@@ -6974,7 +7075,7 @@ async function answerQuestion(input) {
 async function scanFolder(root) {
 	const found = await look(root);
 	const { facts, adapters, project } = await readFacts(found);
-	found.startCommands.push(...await startCandidates(found, project));
+	found.startCommands = rankStart([...found.startCommands, ...await startCandidates(found, project)]);
 	return {
 		look: found,
 		facts,
@@ -20763,6 +20864,23 @@ async function scriptsIn(dir) {
 		return {};
 	}
 }
+var SAME_INTERPRETER = {
+	python: "python3",
+	python3: "python",
+	pip: "pip3",
+	pip3: "pip"
+};
+/**
+* The same command under the interpreter's name this machine has: `python main.py` where only
+* `python3` is installed, as on most Linux and Mac machines, or the reverse on Windows. A command
+* whose first word is here already is returned as it is.
+*/
+async function interpreterHere(command) {
+	const [first = "", ...rest] = command.trim().split(/\s+/);
+	const other = SAME_INTERPRETER[first];
+	if (!other || await onPath(first) || !await onPath(other)) return command;
+	return [other, ...rest].join(" ");
+}
 /**
 * Why `command` cannot start the app in `dir`, in one sentence, or null when it can as far as can
 * be told without running it.
@@ -21355,7 +21473,7 @@ function toFix(ctx, fix) {
 			}
 		};
 		case "run-command": return {
-			label: `${fix.label}: ${fix.command}`,
+			label: fix.label.includes(fix.command) ? fix.label : `${fix.label}: ${fix.command}`,
 			needsPerson: true,
 			apply: async () => {
 				if (!interactive()) return;
@@ -21400,7 +21518,7 @@ var DONT_KNOW = /^(i\s+)?(don'?t|do not)\s+know|^not\s+sure|^no\s+idea|^\?$/i;
 */
 async function typeTheCommand(ctx) {
 	for (let tries = 0; tries < 3; tries++) {
-		const typed = (await askText("How do you start the app?")).trim();
+		const typed = await interpreterHere((await askText("How do you start the app?")).trim());
 		if (!typed || DONT_KNOW.test(typed)) return;
 		const why = await whyNotRunnable(ctx.dir, typed);
 		if (!why) {
@@ -21417,13 +21535,14 @@ async function typeTheCommand(ctx) {
 async function candidateFixes(ctx) {
 	const fixes = [];
 	for (const c of ctx.startCommands) {
-		if (c.command === ctx.config.start?.command) continue;
-		if (await whyNotRunnable(ctx.dir, c.command)) continue;
+		const command = await interpreterHere(c.command);
+		if (command === ctx.config.start?.command) continue;
+		if (await whyNotRunnable(ctx.dir, command)) continue;
 		fixes.push({
-			label: `${c.command}   (from ${c.from})`,
+			label: `${command}   (from ${c.from})`,
 			apply: () => void (ctx.config.start = {
 				...ctx.config.start,
-				command: c.command
+				command
 			})
 		});
 	}
@@ -21439,7 +21558,11 @@ var notKnown = {
 /** Starts the pool, or fails with what happened and how to fix it. */
 async function startApp(ctx, instances) {
 	const { config } = ctx;
-	const command = config.start?.command;
+	const command = config.start?.command ? await interpreterHere(config.start.command) : void 0;
+	if (command && config.start && command !== config.start.command) config.start = {
+		...config.start,
+		command
+	};
 	const typeIt = {
 		label: "Type the command",
 		apply: () => typeTheCommand(ctx)
@@ -22208,7 +22331,7 @@ async function scanCommand(dir, options) {
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-CvPyhFJ7.js");
+					const { loginCommand } = await import("./assets/login-Dz4o-1cM.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;
@@ -22326,7 +22449,7 @@ async function scanCommand(dir, options) {
 		config = treatToolAs(config, tool.name, state.answers[id]);
 	}
 	if (drafted.config.decided_for_you?.length) say(`  ${grey(`I hit the limit of 7 questions, so I made the safer choice on ${plural(drafted.config.decided_for_you.length, "tool")} and recorded it for review in modelos-secure.yaml.`)}`);
-	const candidates = [...new Map([...reading?.verified.start ?? [], ...result.look.startCommands].map((c) => [c.command, c])).values()];
+	const candidates = [...new Map([...reading?.verified.start ?? [], ...result.look.startCommands].map((c) => [c.command, c])).values()].slice(0, 6);
 	if (!previous?.start?.command && candidates.length > 1 && !options.ci) {
 		const command = (state.answers.start ?? (options.yes ? candidates[0].command : await ask("How should the scan start the app?", "It starts the app on this machine, with the hooks attached, to check the connection.", [...candidates.map((c, i) => ({
 			label: `${c.command}   (${c.from})`,
@@ -22378,12 +22501,13 @@ async function scanCommand(dir, options) {
 	const paths = (config.ways_in.length || 1) * (config.rules.length || 1);
 	say(`\n  ${bold(`${config.system} is connected.`)}\n`);
 	say(`  ${`${plural(config.ways_in.length, "way")} in`.padEnd(14)} ${config.ways_in.map((w) => w.name).join(", ")}`);
-	say(`  ${plural(config.tools.length, "tool").padEnd(14)} ${plural(held(config).length, "tool")} held during reviews: ${held(config).join(", ")}`);
+	const heldNow = held(config);
+	say(`  ${plural(config.tools.length, "tool").padEnd(14)} ${config.tools.length === 0 ? "none to hold" : heldNow.length === 0 ? "none held during reviews" : `${heldNow.length.toString()} held during reviews: ${heldNow.join(", ")}`}`);
 	say(`  ${plural(paths, "path").padEnd(14)} none tested yet\n`);
 	const url = connection ? `${connection.url}/systems/${system.id}` : "";
 	say(`  Map:  ${url}`);
-	if (options.noReview || options.ci) return;
-	if (options.yes ? false : await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", "It starts the app on this machine with the hooks attached, checks they hold what they should, then reviews it.", [{
+	if (options.noReview || options.ci || options.yes || !interactive()) return;
+	if (await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", "It starts the app on this machine with the hooks attached, checks they hold what they should, then reviews it.", [{
 		label: "Yes, start it",
 		value: true,
 		recommended: true
@@ -22452,8 +22576,8 @@ async function sessionCommand(dir, run) {
 	for (;;) {
 		say();
 		const line = await askText(">");
-		const word = line.toLowerCase();
-		if (!line || word === "quit" || word === "exit") return;
+		const word = line.toLowerCase().replace(/\(\)$/, "");
+		if (!line || word === "quit" || word === "exit" || word === "q") return;
 		if (word === "help") {
 			run.help();
 			continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {

package/assets/login-CvPyhFJ7.js

@@ -1 +0,0 @@
-export { t as loginCommand } from "./login-DeAJGhiN.js";