nerdsystem 0.0.15 → 0.0.16

package/dist/commands/deploy.js

@@ -7,6 +7,7 @@ import { formatMb } from "../snapshot.js";
 import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
 import { appendLineage, cliVersion, LOCAL_ONLY_NOTE, packProject, readLineage, uploadSnapshot, uploadStopMessage } from "./source.js";
+import { lockedGetPaths } from "../gates/tests.js";
 import { BUILD_GATES, gateSummary, knownSecretsFrom, probeDeployment, runGates, skippedProbe, SOURCE_GATES, waitForDeployment } from "../gates/index.js";
 const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
 function walk(dir, base = dir) {
@@ -62,7 +63,7 @@ export async function applyRemoteMigrations(root, api) {
  * Probes the live URL after an upload, the same checks the builder runs after a git build.
  * Informational: the app is already live, so findings are printed, never thrown.
  */
-async function probeAfterDeploy(deployment, url, skip) {
+async function probeAfterDeploy(root, deployment, url, skip) {
     if (skip)
         return skippedProbe("--skip-probe was given");
     if (deployment.status !== "live")
@@ -71,7 +72,7 @@ async function probeAfterDeploy(deployment, url, skip) {
     // headers or routes; probing that would report false auth failures. Wait, and say so when it never came.
     if (!(await waitForDeployment(url)))
         return skippedProbe("the app had not started answering within 30 seconds; open the URL to check, or run nerd deploy again to probe it");
-    return probeDeployment(url);
+    return probeDeployment(url, undefined, { lockedGets: lockedGetPaths(root) });
 }
 function printProbe(url, probes) {
     if (probes.status === "skip")
@@ -183,7 +184,7 @@ export async function shipBuild(args) {
     log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
     if (!opts["skip-probe"] && deployment.status === "live")
         log.step(`Probing ${project.url}`);
-    const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
+    const probes = await probeAfterDeploy(root, deployment, project.url, Boolean(opts["skip-probe"]));
     return { deployment, url: project.url, migrations: mig, probes, source, sourceSkipped, lineage, warnings: pack.warnings };
 }
 /** The one line about the code after a live deploy, keyed on what the API recorded, not on what we sent. */

package/dist/commands/init.js

@@ -183,4 +183,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.15";
+const SDK_VERSION = "0.0.16";

package/dist/gates/rules.js

@@ -70,6 +70,7 @@ export const RULES = {
     "gates/retry-cap": { title: "Automatic fixing stopped after three attempts", severity: "block", audience: "human", risk: "The same rule has failed three runs in a row; further automatic attempts are unlikely to help and may make things worse.", fix: "Read the findings above and decide: fix it by hand, ask the agent a different way, or approve a suppression in the dashboard if the finding is wrong." },
     "smoke/unreachable": { title: "Deployed app did not respond", severity: "block", audience: "human", risk: "The app is not serving requests.", fix: "Check `nerd logs` for startup errors and the deployment status." },
     "smoke/header-missing": { title: "A security header is missing", severity: "warn", audience: "agent", risk: "Browsers lose a protection against clickjacking, content sniffing, or script injection.", fix: "Keep createNerdApp()'s default security headers; if you disabled them, re-enable or set the header yourself." },
+    "smoke/route-open": { title: "A locked route answers strangers on the live app", severity: "block", audience: "agent", risk: "A route the tests found locked is answering signed-out visitors on the live app, so its data may be readable by anyone right now.", fix: "Run `nerd rollback` to return to the previous version now. Then find why the live app differs from the tests (a route registered only in production, or the `public` list in `createNerdApp`), fix it, and deploy again." },
     "smoke/auth-me": { title: "Session endpoint misbehaves", severity: "block", audience: "agent", risk: "Visitors cannot tell whether they are signed in, so the app's login flow is broken.", fix: "/api/auth/me must return 200 with {user:null} when signed out. Do not override the SDK's auth routes." },
     "smoke/auth-login": { title: "Wrong credentials are not rejected", severity: "block", audience: "agent", risk: "The login endpoint does not return 401 for a wrong password.", fix: "Do not override the SDK's /api/auth/login route." },
 };

package/dist/gates/smoke.d.ts

@@ -12,7 +12,12 @@ export declare function waitForDeployment(url: string, opts?: {
 /**
  * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
  * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ * With `lockedGets` (paths the app's access tests found locked), each is also fetched signed out on
+ * the live app and must still answer 401 or 403: the same question the tests asked, put to the real
+ * thing. Only GETs are tried, so a probe can never change anyone's data.
  */
-export declare function probeDeployment(url: string, fetchImpl?: FetchLike): Promise<GateResult>;
+export declare function probeDeployment(url: string, fetchImpl?: FetchLike, opts?: {
+    lockedGets?: string[];
+}): Promise<GateResult>;
 /** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
 export declare function skippedProbe(reason: string): GateResult;

package/dist/gates/smoke.js

@@ -7,6 +7,8 @@
 import { finding, fingerprint } from "./secrets.js";
 import { verdict } from "./types.js";
 const PROBE_TIMEOUT_MS = 10_000;
+/** Most routes fetched signed out after a deploy. */
+const MAX_ROUTE_PROBES = 25;
 const REQUIRED_HEADERS = ["x-content-type-options", "content-security-policy", "x-frame-options"];
 /** Default fetch wrapped so it is never called with a foreign `this` (workerd throws "Illegal invocation"). */
 const defaultFetch = (input, init) => fetch(input, init);
@@ -51,8 +53,11 @@ export async function waitForDeployment(url, opts = {}) {
 /**
  * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
  * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ * With `lockedGets` (paths the app's access tests found locked), each is also fetched signed out on
+ * the live app and must still answer 401 or 403: the same question the tests asked, put to the real
+ * thing. Only GETs are tried, so a probe can never change anyone's data.
  */
-export async function probeDeployment(url, fetchImpl = defaultFetch) {
+export async function probeDeployment(url, fetchImpl = defaultFetch, opts = {}) {
     const startedAt = Date.now();
     const base = url.replace(/\/$/, "");
     const findings = [];
@@ -93,6 +98,15 @@ export async function probeDeployment(url, fetchImpl = defaultFetch) {
         if (login.status !== 401)
             findings.push(smokeFinding("smoke/auth-login", `Wrong credentials returned ${login.status} instead of 401.`, "/api/auth/login"));
     }
+    for (const p of (opts.lockedGets ?? []).slice(0, MAX_ROUTE_PROBES)) {
+        const res = await get(p);
+        if (!res)
+            continue;
+        await res.body?.cancel().catch(() => { });
+        if (res.status !== 401 && res.status !== 403) {
+            findings.push(smokeFinding("smoke/route-open", `GET ${p} answered ${res.status} to a signed-out visitor on the live app, although the tests found it locked.`, `route:${p}`));
+        }
+    }
     return probeResult(findings, startedAt);
 }
 /** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */

package/dist/gates/tests.d.ts

@@ -4,6 +4,11 @@ import { type Gate } from "./types.js";
  * characters a "METHOD /path" needs survive and the length is capped: a route cannot carry a sentence.
  */
 export declare function safeRoute(name: unknown): string | null;
+/**
+ * Concrete paths for the GET routes the last test run found locked, for the live probe after a deploy:
+ * every `:param` becomes "1". Empty when there is no report (an app without access tests).
+ */
+export declare function lockedGetPaths(root: string): string[];
 /**
  * Runs the app's own tests and reads what they checked about access. The person who owns the app cannot
  * read the code, and the agent that forgot a sign-in check tends to forget the test for it too, so the

package/dist/gates/tests.js

@@ -26,6 +26,18 @@ function readJson(file) {
         return null;
     }
 }
+/**
+ * Concrete paths for the GET routes the last test run found locked, for the live probe after a deploy:
+ * every `:param` becomes "1". Empty when there is no report (an app without access tests).
+ */
+export function lockedGetPaths(root) {
+    const report = readJson(path.join(root, REPORT));
+    if (!report || report.everyRouteChecked !== true)
+        return [];
+    return list(report.locked)
+        .filter((r) => r.startsWith("GET ") && !r.includes("*"))
+        .map((r) => r.slice(4).split("/").map((seg) => (seg.startsWith(":") ? "1" : seg)).join("/"));
+}
 /** True when a file under test/ uses the SDK's harness, which is what writes the access report. */
 function hasHarnessTests(root) {
     const dir = path.join(root, "test");
@@ -62,10 +74,6 @@ export const testsGate = {
             const f = finding(required ? "tests/required-missing" : "tests/missing", { file: "test/access.test.ts" });
             return result(this, required ? "fail" : "warn", "No access tests in this app", [f], t);
         }
-        // Git builds do not run this yet (the build container has not been proven to run the local database);
-        // the terminal path, which every `nerd deploy` takes, does.
-        if (ctx.committed)
-            return result(this, "skip", "Runs before `nerd deploy`; not yet part of git builds", [], t);
         if (!existsSync(path.join(ctx.root, "node_modules"))) {
             return result(this, "fail", "Dependencies are not installed", [finding("tests/not-installed", {})], t);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -36,7 +36,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -37,7 +37,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f851c99006a8); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (e719563eac29); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,7 +33,7 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change, and write or update its tests in the same step (see "Build it so it is safe and it works").
 2. `nerd check` (static rules, typecheck, then the tests and access checks). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
+4. `nerd deploy` when it is ready. It runs the checks, builds, stores a copy of the code, applies pending migrations, uploads, prints the URL, and probes the live URL (headers, the sign-in routes, and a signed-out GET of every route the tests found locked; a `smoke/route-open` finding means a locked route is answering strangers on the live app, so run `nerd rollback` first and investigate second). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.