built for real · Cal.com · osmods
Cal.com with simple password rules
A self-hosted Cal.com that accepts a 4-character password instead of demanding 15 characters with mixed case and numbers. Sounds trivial. The codebase had the rule duplicated in three places — and finding the third one is the story.
the request
“I want simpler passwords on my instance.” The planning agent warned upfront: the validation lives in duplicated files — change one and the others keep the old rule.
The plan came before any code
- Plan found TWO duplicated validators (isPasswordValid.ts and validPassword.ts) plus English-only hint messages, and listed both as explicit risks.
- Three options offered; “minimum length only” recommended.
What was actually changed
- First pass: both validators fixed, hint texts updated, five files touched — all criteria verified… by calling the functions directly. All green.
- The platform's own probe then exercised the REAL path — the running server still enforced 15 characters: the compiled bundle needed rebuilding. Layers green, seam broken.
- The user said “it still asks for 15” — and the agent, told to believe the user, found a THIRD copy: the error message hardcoded inside the admin-setup API route. One line. Rebuilt.
How we know it works
- First admin created through the real API with the password “demo” (4 lowercase letters) — impossible under the factory rules.
- “abc” (3 chars) rejected with the NEW message: “The password must be at least 4 characters long”.
- The agent cleaned up its test accounts afterwards, leaving the instance ready for its owner.
Two conversational rounds; the fix for the third duplicate took one message.
Three copies of one rule in a huge monorepo, resolved by a user who only ever said “it still doesn't work there”. That failure mode — every layer green, the seam broken — is precisely what this platform is built to catch.
Every story on this page happened on a live instance through a conversation. The upstream project belongs to its maintainers; the modification belongs to the person who needed it. This is a research prototype — access is by invitation while we learn.