@buoy-gg/network 7.0.35 → 7.0.38

package/lib/commonjs/network/utils/networkEventStore.js

@@ -46,14 +46,6 @@ var _networkSavedStore = require("./networkSavedStore");
 const BOOT_BUFFER_MAX = 200;
 class NetworkEventStore extends _sharedUi.BaseEventStore {
   pendingRequests = new Map();
-  /**
-   * Recently seen `METHOD:url` keys → when, and which event id we kept.
-   *
-   * The timestamp powers the dual-interception dedup below. The id is what lets
-   * a DROPPED duplicate still contribute something the kept event doesn't know
-   * — see `applyOverrideMark`.
-   */
-  recentRequests = new Map();
   rawListenerUnsubscribe = null;
   /** Raw events captured before the first consumer subscribed — see startBootCapture. */
   bootBuffer = [];
@@ -85,6 +77,7 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
    * state therefore never gains events it didn't ask for).
    */
   startBootCapture() {
+    if ((0, _sharedUi.getAccountAccess)().status === "locked") return;
     if (this.mirrorMode || this.bootBufferUnsubscribe || this.isCapturing()) {
       return;
     }
@@ -139,6 +132,7 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
    * Stop capturing network events
    */
   stopCapturing() {
+    this.takeBootBuffer();
     // Remove our raw listener
     if (this.rawListenerUnsubscribe) {
       this.rawListenerUnsubscribe();
@@ -205,57 +199,11 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
    * Process a network listener event
    */
   processNetworkEvent(event) {
+    if ((0, _sharedUi.getAccountAccess)().status === "locked") return;
     const {
       request
     } = event;
     if (event.type === "request") {
-      // Check for duplicate request based on URL, method, and timing.
-      // The clock is the event's CAPTURE time, not Date.now(): boot-buffered
-      // events are flushed in one synchronous burst, and wall-clock "now"
-      // would put two genuinely separate boot requests to the same endpoint
-      // inside the 50ms dual-interception window, silently dropping one. For
-      // live events the two clocks are the same (the raw event is emitted
-      // synchronously at capture).
-      const requestKey = `${request.method}:${request.url}`;
-      const now = event.timestamp instanceof Date ? event.timestamp.getTime() : Date.now();
-      const recent = this.recentRequests.get(requestKey);
-
-      // If same request within 50ms, likely a duplicate from XHR/fetch dual
-      // interception. The age must be non-negative: Date.now() is not
-      // monotonic, and after a backwards clock adjustment (iOS time sync) a
-      // future-dated entry would satisfy `< 50` for EVERY request to this
-      // endpoint until the clock caught up — capture going silent for minutes
-      // to hours, "fixed" only by Clear wiping this map (field-reported). A
-      // negative age falls through and re-stamps the entry with the new clock.
-      if (recent && now - recent.at >= 0 && now - recent.at < 50) {
-        // …but the duplicate is not always redundant. On React Native a
-        // `fetch()` is seen twice: once by the fetch wrapper, which is what
-        // creates this event, and again by the XHR wrapper underneath it —
-        // and ONLY the XHR layer resolves overrides, because that's where the
-        // request can actually be intercepted. So the mark arrives on the copy
-        // we're about to throw away. Move it across before dropping.
-        if (event.override) {
-          this.applyOverrideMark(recent.id, event.override);
-        }
-        return;
-      }
-      this.recentRequests.set(requestKey, {
-        at: now,
-        id: request.id
-      });
-
-      // Clean up old entries to prevent memory leak. Future-dated entries are
-      // stale by definition (clock moved backwards) — drop those too, or they
-      // survive every sweep until the clock overtakes them.
-      if (this.recentRequests.size > 100) {
-        const cutoff = now - 5000;
-        for (const [key, entry] of this.recentRequests.entries()) {
-          if (entry.at < cutoff || entry.at > now) {
-            this.recentRequests.delete(key);
-          }
-        }
-      }
-
       // Build full URL with query params if present
       const queryString = request.params ? `?${new URLSearchParams(request.params).toString()}` : "";
       const fullUrl = `${request.url}${queryString}`;
@@ -287,7 +235,8 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
         graphqlVariables,
         // Present when this request came straight through the XHR wrapper
         // (axios, raw XHR). For `fetch` it arrives later — see the dedup branch.
-        override: event.override
+        override: event.override,
+        condition: event.condition
       };
       this.pendingRequests.set(request.id, networkEvent);
       this.events = [networkEvent, ...this.events].slice(0, this.maxEvents);
@@ -331,26 +280,6 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
       }
     }
   }
-
-  /**
-   * Stamp an override mark onto an already-recorded event.
-   *
-   * Only ever moves a mark from a dropped duplicate onto the event that was
-   * kept, so it never overwrites one that is already there.
-   */
-  applyOverrideMark(id, override) {
-    const index = this.events.findIndex(e => e.id === id);
-    if (index === -1 || this.events[index].override) return;
-    const updatedEvent = {
-      ...this.events[index],
-      override
-    };
-    this.events = this.events.map((e, i) => i === index ? updatedEvent : e);
-    const pending = this.pendingRequests.get(id);
-    if (pending) this.pendingRequests.set(id, updatedEvent);
-    this.notify(updatedEvent);
-    this.notifyArrayListeners();
-  }
   extractHost(url) {
     try {
       const urlObj = new URL(url);
@@ -388,7 +317,6 @@ class NetworkEventStore extends _sharedUi.BaseEventStore {
   clearEvents() {
     super.clearEvents();
     this.pendingRequests.clear();
-    this.recentRequests.clear();
   }
 
   /**

package/lib/commonjs/network/utils/networkListener.js

@@ -4,6 +4,9 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.stopNetworkListener = exports.startNetworkListener = exports.removeAllNetworkListeners = exports.networkListener = exports.isNetworkListening = exports.isNetworkInterceptionLive = exports.getNetworkListenerCount = exports.addNetworkListener = exports.BUOY_XHR_INTERCEPTOR_FLAG = exports.BUOY_FETCH_INTERCEPTOR_FLAG = void 0;
+var _xhr = require("../conditions/xhr");
+var _store = require("../conditions/store");
+var _wait = require("../conditions/wait");
 var _engine = require("../overrides/engine");
 var _applyToXhr = require("../overrides/applyToXhr");
 var _applyToFetch = require("../overrides/applyToFetch");
@@ -26,7 +29,7 @@ var _httpCompletion = require("./httpCompletion");
  * executor, so a flag raised across the call expression alone is enough to
  * cover the inner `send()` without leaking across the await.
  */
-let insideOverriddenFetch = false;
+let insideFetchHandoff = false;
 
 // Extended XMLHttpRequest interface for monkey-patching
 
@@ -71,17 +74,56 @@ const BUOY_XHR_INTERCEPTOR_FLAG = exports.BUOY_XHR_INTERCEPTOR_FLAG = "__buoyNet
  * @performance Uses lazy singleton pattern to minimize memory footprint
  * @performance Includes URL filtering to ignore development traffic
  */
+/**
+ * Hosts another Buoy package has claimed as its own traffic.
+ *
+ * A GLOBAL, not an import: `@buoy-gg/network` cannot depend on `agent-core`
+ * (Ask Buoy is optional and this package is older), and `agent-core` ships
+ * with no dependencies at all. `registerSelfEndpoint` in agent-core writes the
+ * set; this reads it. Absent, undefined or the wrong shape all mean "nothing
+ * to exclude", so nothing breaks in an app without Ask Buoy.
+ *
+ * WHY IT IS NOT ENOUGH TO FILTER LATER. The interceptor reads the response
+ * body — `await processResponseBody(response.clone())` — BEFORE handing the
+ * response back. On a streamed reply that resolves only at EOF, so an
+ * intercepted model endpoint delivers its whole answer at once and Ask Buoy
+ * cannot stream a word. Ignoring the URL is what keeps the socket the
+ * caller's. It also keeps override rules off model traffic, which a broad
+ * user-authored rule would otherwise rewrite.
+ */
+/**
+ * Content types whose body arrives over time rather than all at once.
+ *
+ * These are the ones where reading the clone before returning the response
+ * changes the CALLER's behaviour instead of merely observing it.
+ */
+const STREAMED_CONTENT_TYPES = ["text/event-stream", "application/x-ndjson", "application/stream+json"];
+const STREAMING_PLACEHOLDER = "[streaming\u2026]";
+function isStreamedContentType(contentType) {
+  if (!contentType) return false;
+  const lower = contentType.toLowerCase();
+  return STREAMED_CONTENT_TYPES.some(t => lower.includes(t));
+}
+const INTERNAL_HOSTS_KEY = "__BUOY_INTERNAL_HOSTS__";
+function isInternalBuoyHost(url) {
+  const hosts = globalThis[INTERNAL_HOSTS_KEY];
+  if (!(hosts instanceof Set) || hosts.size === 0) return false;
+  let authority;
+  try {
+    authority = new URL(url).host.toLowerCase();
+  } catch {
+    return false;
+  }
+  for (const host of hosts) {
+    if (typeof host === "string" && host && authority === host.toLowerCase()) return true;
+  }
+  return false;
+}
 class NetworkListener {
   listeners = [];
   isListening = false;
   requestCounter = 1000;
 
-  // URLs to ignore (Metro bundler, symbolicate, etc.)
-  ignoredUrls = [/\/symbolicate$/, /\/logs$/, /\/debugger-proxy/, /\/reload$/, /\/launch-js-devtools/, /localhost:8081/, /100\.64\.\d+\.\d+:8081/,
-  // iOS simulator
-  /10\.0\.\d+\.\d+:8081/ // Android emulator
-  ];
-
   // Store original methods
 
   /**
@@ -105,7 +147,7 @@ class NetworkListener {
   xhrGeneration = 0;
   constructor() {
     // Store original methods
-    this.originalFetch = globalThis.fetch.bind(globalThis);
+    this.originalFetch = globalThis.fetch;
     this.originalXHROpen = XMLHttpRequest.prototype.open;
     this.originalXHRSend = XMLHttpRequest.prototype.send;
     this.originalXHRSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
@@ -121,7 +163,15 @@ class NetworkListener {
    * @returns True if the URL should be ignored
    */
   shouldIgnoreUrl(url) {
-    return this.ignoredUrls.some(pattern => pattern.test(url));
+    try {
+      const parsed = new URL(url);
+      if (parsed.hostname === "keygen.sh" || parsed.hostname.endsWith(".keygen.sh")) return true;
+      const local = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "10.0.2.2";
+      if (local && ["8081", "8802"].includes(parsed.port)) return true;
+    } catch {
+      return false;
+    }
+    return isInternalBuoyHost(url);
   }
 
   // Emit event to all listeners
@@ -167,6 +217,70 @@ class NetworkListener {
    * @param maxSize - Maximum body size in bytes (default: 1MB)
    * @returns Object containing body, size, and truncation status
    */
+  /**
+   * Read a streamed body in the background, with a hard ceiling.
+   *
+   * Deliberately not `processResponseBody`: that one calls `.text()`, which
+   * accumulates the WHOLE body before it checks the size, so a long-lived SSE
+   * stream would grow unbounded in memory with nothing to stop it. This stops
+   * at the cap and cancels the reader, and a runtime with no `body` (React
+   * Native's own fetch) falls back to `.text()` — that response was never
+   * streaming there in the first place.
+   */
+  async readStreamedBody(response, maxSize = 256 * 1024) {
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+      const text = await response.text();
+      return text.length > maxSize ? {
+        body: `${text.slice(0, maxSize)}\n\n... [truncated]`,
+        size: text.length
+      } : {
+        body: text,
+        size: text.length
+      };
+    }
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    let size = 0;
+    let capped = false;
+    try {
+      for (;;) {
+        const {
+          done,
+          value
+        } = await reader.read();
+        if (done) break;
+        size += value?.byteLength ?? 0;
+        if (!capped) {
+          out += decoder.decode(value, {
+            stream: true
+          });
+          if (size >= maxSize) {
+            out = `${out.slice(0, maxSize)}\n\n... [truncated]`;
+            capped = true;
+            break;
+          }
+        }
+      }
+      if (!capped) out += decoder.decode();
+    } finally {
+      try {
+        void Promise.resolve(reader.cancel()).catch(() => {});
+      } catch {
+        /* already gone */
+      }
+      try {
+        reader.releaseLock();
+      } catch {
+        /* already released */
+      }
+    }
+    return {
+      body: out,
+      size
+    };
+  }
   async processResponseBody(response, maxSize = 1024 * 1024 // 1MB default
   ) {
     try {
@@ -239,14 +353,14 @@ class NetworkListener {
    * Handle XMLHttpRequest response processing
    * This method processes the response and emits appropriate events
    */
-  handleXHRResponse(xhr, requestId, cleanUrl, method, requestHeaders, requestData, params, startTime, isError = false, clientType = "xhr", override) {
+  handleXHRResponse(xhr, requestId, cleanUrl, method, requestHeaders, requestData, params, startTime, isError = false, clientType = "xhr", override, condition) {
     const duration = startTime ? Date.now() - startTime : 0;
 
     // XHR's duration was ALREADY total (measured at readyState 4 / load), so
-    // only the split is new. `_ttfb` is stamped at HEADERS_RECEIVED; it is
+    // only the split is new. `_buoyTtfb` is stamped at HEADERS_RECEIVED; it is
     // absent for a request that failed before any headers arrived, and the
     // breakdown is then correctly omitted rather than faked as 0.
-    const ttfb = xhr._ttfb;
+    const ttfb = xhr._buoyTtfb;
     const timings = ttfb === undefined ? undefined : {
       ttfb,
       download: Math.max(0, duration - ttfb)
@@ -269,7 +383,8 @@ class NetworkListener {
         error: {
           message: isError ? "Request failed" : "Network error or request aborted"
         },
-        override
+        override,
+        condition
       });
       return;
     }
@@ -411,7 +526,8 @@ class NetworkListener {
           body,
           size: responseSize
         },
-        override
+        override,
+        condition
       });
     } else {
       this.emit({
@@ -437,7 +553,8 @@ class NetworkListener {
         error: {
           message: "Network Error"
         },
-        override
+        override,
+        condition
       });
     }
   }
@@ -503,7 +620,7 @@ class NetworkListener {
     // re-installing after a clobber must call through the replacement, and a
     // stale generation must replay the chain exactly as it stood beneath it.
     const passthroughFetch = globalThis.fetch.bind(globalThis);
-    this.originalFetch = passthroughFetch;
+    this.originalFetch = globalThis.fetch;
     const generation = ++this.fetchGeneration;
     const wrappedFetch = async (input, init) => {
       const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
@@ -521,7 +638,11 @@ class NetworkListener {
       }
       const startTime = Date.now();
       const requestId = `fetch_${++self.requestCounter}`;
-      const method = init?.method || "GET";
+      const inputRequest = typeof input === "object" && "method" in input ? input : undefined;
+      const method = init?.method ?? inputRequest?.method ?? "GET";
+      const signal = init?.signal !== undefined ? init.signal : inputRequest?.signal;
+      (0, _wait.throwIfAborted)(signal);
+      const condition = (0, _store.snapshotNetworkCondition)(url);
       const {
         url: cleanUrl,
         params
@@ -529,21 +650,24 @@ class NetworkListener {
 
       // Parse request headers
       let requestHeaders = {};
-      if (init?.headers) {
-        if (init.headers instanceof Headers) {
-          init.headers.forEach((value, key) => {
+      const headers = init?.headers ?? inputRequest?.headers;
+      if (headers) {
+        if (headers instanceof Headers) {
+          headers.forEach((value, key) => {
             requestHeaders[key] = value;
           });
-        } else if (Array.isArray(init.headers)) {
-          init.headers.forEach(([key, value]) => {
+        } else if (Array.isArray(headers)) {
+          headers.forEach(([key, value]) => {
             requestHeaders[key] = value;
           });
         } else {
-          requestHeaders = init.headers;
+          requestHeaders = headers;
         }
       }
 
       // Parse request body
+      // Explicitly typed: the late emit for a streamed reply reads this from
+      // inside a callback, which defeats the inference it used to rely on.
       let requestData;
       if (init?.body) {
         if (typeof init.body === "string") {
@@ -569,7 +693,7 @@ class NetworkListener {
        * Skipped when `canSynthesizeResponse()` is false so a runtime without a
        * `Response` global degrades to a real request rather than a broken one.
        */
-      const outcome = (0, _applyToFetch.canSynthesizeResponse)() ? (0, _engine.overrideForRequest)(url, method) : null;
+      const outcome = condition?.profile !== "offline" && (0, _applyToFetch.canSynthesizeResponse)() ? (0, _engine.overrideForRequest)(url, method) : null;
       const override = outcome ? (0, _types.markForOutcome)(outcome) : undefined;
 
       // Emit request event
@@ -585,24 +709,28 @@ class NetworkListener {
           params: params || undefined,
           client: clientType
         },
-        override
+        override,
+        condition
       });
       try {
-        if (outcome) await (0, _applyToFetch.sleep)(outcome.delayMs);
+        if (condition || outcome) await (0, _wait.waitBeforeDispatch)((condition?.delayMs ?? 0) + (outcome?.delayMs ?? 0), signal);
+        (0, _wait.throwIfAborted)(signal);
+        if (condition?.profile === "offline") throw new TypeError("Network request failed (Buoy Offline)");
         if (outcome?.kind === "fail") throw (0, _applyToFetch.synthesizeFetchError)(outcome);
         let response;
         if (outcome?.kind === "respond") {
           response = (0, _applyToFetch.synthesizeResponse)(url, outcome);
         } else {
-          // The flag spans the CALL only — see `insideOverriddenFetch`. It has
+          // The flag spans the CALL only — see `insideFetchHandoff`. It has
           // to be cleared before the await, or it would still be raised for
           // every unrelated request that starts while this one is in flight.
-          insideOverriddenFetch = outcome != null;
+          const previousFetchHandoff = insideFetchHandoff;
+          insideFetchHandoff = true;
           let pending;
           try {
             pending = passthroughFetch(input, init);
           } finally {
-            insideOverriddenFetch = false;
+            insideFetchHandoff = previousFetchHandoff;
           }
           response = await pending;
         }
@@ -612,12 +740,29 @@ class NetworkListener {
         // look faster through fetch than through XHR.
         const ttfb = Date.now() - startTime;
 
+        /**
+         * A STREAMED reply is never awaited here.
+         *
+         * `processResponseBody` reads the clone to the end, and for
+         * `text/event-stream` the end is when the server finishes — seconds
+         * later, for an LLM. Awaiting it made the interceptor hold the
+         * response back until then, so every consumer of a streaming endpoint
+         * inside an app with capture on received the whole thing at once and
+         * could not stream a word of it. The row is emitted now with what is
+         * known, and the body is filled in when the stream closes: the store
+         * merges a second `response` event onto the same request id.
+         */
+        const streamed = typeof response.body?.getReader === "function" || isStreamedContentType(response.headers?.get?.("content-type"));
+
         // Clone response to read body with size limits
         const responseClone = response.clone();
         const {
           body,
           size: responseSize
-        } = await self.processResponseBody(responseClone);
+        } = streamed ? {
+          body: STREAMING_PLACEHOLDER,
+          size: 0
+        } : await self.processResponseBody(responseClone);
 
         // Now the body is in — this is the comparable, total number.
         const duration = Date.now() - startTime;
@@ -674,8 +819,46 @@ class NetworkListener {
             body,
             size: responseSize
           },
-          override
+          override,
+          condition
         });
+        if (streamed) {
+          // Bounded, cancelled at the cap, and never awaited by the caller.
+          void self.readStreamedBody(responseClone).then(late => {
+            let capturedBody = late.body;
+            if (response.headers?.get?.("content-type")?.includes("json")) {
+              try {
+                capturedBody = JSON.parse(late.body);
+              } catch {/* Partial or malformed JSON stays text. */}
+            }
+            self.emit({
+              type: "response",
+              timestamp: new Date(),
+              duration: Date.now() - startTime,
+              timings,
+              request: {
+                id: requestId || "unknown",
+                url: cleanUrl,
+                method,
+                headers: requestHeaders,
+                data: requestData,
+                params: params || undefined,
+                client: clientType
+              },
+              response: {
+                status: response.status,
+                statusText: response.statusText,
+                headers: responseHeaders,
+                body: capturedBody,
+                size: late.size
+              },
+              override,
+              condition
+            });
+          }).catch(() => {
+            /* the caller's response is unaffected either way */
+          });
+        }
         return response;
       } catch (error) {
         const duration = Date.now() - startTime;
@@ -698,7 +881,8 @@ class NetworkListener {
             message: error instanceof Error ? error.message : "Network error",
             stack: error instanceof Error ? error.stack : undefined
           },
-          override
+          override,
+          condition
         });
         throw error;
       }
@@ -719,18 +903,20 @@ class NetworkListener {
     this.originalXHRSend = passthroughSend;
     this.originalXHRSetRequestHeader = passthroughSetRequestHeader;
     const generation = ++this.xhrGeneration;
+    const pendingCapture = new WeakMap();
     const patchedOpen = function (method, url, async, user, password) {
-      // Superseded generations must not re-stamp (a double stamp burns two
-      // request ids per request) — just pass through.
+      // Native validation runs before replacing metadata or capture listeners.
+      const result = passthroughOpen.call(this, method, url, async ?? true, user, password);
       if (generation === self.xhrGeneration) {
+        pendingCapture.get(this)?.();
         const xhr = this;
-        xhr._requestId = `xhr_${++self.requestCounter}`;
+        xhr._buoyRequestId = `xhr_${++self.requestCounter}`;
         xhr._method = method;
         xhr._url = url;
-        xhr._startTime = Date.now();
+        xhr._buoyStartTime = Date.now();
         xhr._requestHeaders = {};
       }
-      return passthroughOpen.call(this, method, url, async ?? true, user, password);
+      return result;
     };
 
     // Track request headers
@@ -745,14 +931,19 @@ class NetworkListener {
     // @ts-ignore - this does exist on native
     data) {
       // Superseded generation: silent pass-through (see the fetch wrapper).
-      if (generation !== self.xhrGeneration) {
+      if (generation !== self.xhrGeneration || insideFetchHandoff) {
+        return passthroughSend.call(this, data);
+      }
+      if (this.readyState !== 1 || this._sent) {
         return passthroughSend.call(this, data);
       }
       const xhr = this;
-      const requestId = xhr._requestId;
+      const requestId = xhr._buoyRequestId;
       const method = xhr._method || "GET";
       const url = xhr._url || "";
-      const startTime = xhr._startTime;
+      const startTime = Date.now();
+      xhr._buoyStartTime = startTime;
+      xhr._buoyTtfb = undefined;
       const requestHeaders = xhr._requestHeaders || {};
 
       // Skip ignored URLs
@@ -792,14 +983,15 @@ class NetworkListener {
        * This is the layer that covers `axios` and raw XMLHttpRequest. It also
        * covers `fetch` on BARE React Native, where the whatwg-fetch polyfill
        * runs through XHR — which is why the fetch wrapper raises
-       * `insideOverriddenFetch` around its pass-through, so one request can't
+       * `insideFetchHandoff` around its pass-through, so one request can't
        * be overridden twice.
        *
        * Matching uses the raw `url` (query string included), which is what the
        * developer sees in the list and writes into a rule. No-ops in production
        * builds; see `overrideForRequest`.
        */
-      const outcome = insideOverriddenFetch ? null : (0, _engine.overrideForRequest)(url, method);
+      const condition = (0, _store.snapshotNetworkCondition)(url);
+      const outcome = condition?.profile === "offline" ? null : (0, _engine.overrideForRequest)(url, method);
       const override = outcome ? (0, _types.markForOutcome)(outcome) : undefined;
 
       // Emit request event
@@ -815,7 +1007,8 @@ class NetworkListener {
           params: params || undefined,
           client: clientType
         },
-        override
+        override,
+        condition
       });
 
       // Track if we've already processed this request to avoid duplicate events
@@ -823,18 +1016,20 @@ class NetworkListener {
       const processResponse = (isError = false) => {
         if (processed) return;
         processed = true;
-        self.handleXHRResponse(this, requestId || "unknown", cleanUrl, method, requestHeaders, requestData, params, startTime || 0, isError, clientType, override);
+        self.handleXHRResponse(this, requestId || "unknown", cleanUrl, method, requestHeaders, requestData, params, startTime || 0, isError, clientType, override, condition);
         // Clean up event listeners after processing to prevent memory leaks
         cleanup();
       };
 
       // Cleanup function to remove event listeners
       const cleanup = () => {
+        pendingCapture.delete(this);
         this.removeEventListener("load", loadListener);
         this.removeEventListener("error", errorListener);
         this.removeEventListener("abort", abortListener);
         this.removeEventListener("readystatechange", readyStateListener);
       };
+      pendingCapture.set(this, cleanup);
 
       // Use addEventListener to listen to events WITHOUT replacing user handlers
       // This is critical because React Native's XMLHttpRequest uses EventTarget
@@ -856,8 +1051,8 @@ class NetworkListener {
         // TTFB here costs one comparison and one clock read.
         if (this.readyState === 2) {
           const xhr = this;
-          if (xhr._ttfb === undefined && xhr._startTime) {
-            xhr._ttfb = Date.now() - xhr._startTime;
+          if (xhr._buoyTtfb === undefined && xhr._buoyStartTime) {
+            xhr._buoyTtfb = Date.now() - xhr._buoyStartTime;
           }
         }
         if (this.readyState === 4 && !processed) {
@@ -870,6 +1065,10 @@ class NetworkListener {
       this.addEventListener("error", errorListener);
       this.addEventListener("abort", abortListener);
       this.addEventListener("readystatechange", readyStateListener);
+      if (condition) {
+        (0, _xhr.runConditionXhr)(this, url, condition, outcome, () => passthroughSend.call(this, data));
+        return;
+      }
       if (outcome) {
         // Listeners are attached above FIRST: `runOverride` drives the same
         // readyState transitions a real response would, and the interceptor has

package/lib/commonjs/network/utils/networkSavedStore.js

@@ -44,8 +44,8 @@ const MAX_PINNED = exports.MAX_PINNED = 25;
 const MAX_SAVED = exports.MAX_SAVED = 50;
 /**
  * @deprecated Read the live limit with `useLimit("network.saved")` — this only
- * reports the FREE tier's value and is blind to the anonymous tier. Kept
- * because it is part of the package's public exports.
+ * reports the FREE tier's value and ignores the Weekend Pass. Kept because it
+ * is part of the package's public exports.
  */
 const FREE_TIER_SAVED_LIMIT = exports.FREE_TIER_SAVED_LIMIT = _sharedUi.TIER_LIMITS["network.saved"].free;
 /** Per-body cap on a snapshot. */

package/lib/commonjs/network/utils/selectSavedEvents.js

@@ -19,8 +19,8 @@ var _networkSavedStore = require("./networkSavedStore");
 function selectSavedEvents(savedRecords,
 /**
  * How many saves this tier may see — `useLimit("network.saved")`. Takes a
- * number rather than `isPro` because there are now three tiers, and a
- * boolean cannot express the anonymous one.
+ * number rather than `isPro` because Pro's cap is 50, not unlimited, and a
+ * boolean cannot express that.
  */
 limit, search) {
   /**