@foldrun/core 0.4.0 → 0.6.0

package/src/tool-test.ts

@@ -19,13 +19,15 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-import { resolveSecrets } from "./secrets.ts";
+import { resolveSecrets, materializeSecrets } from "./secrets.ts";
 import { listAgents, workspaceDir, type ToolDef } from "./store.ts";
 import { libraryDir } from "./library.ts";
 import { secretsUsedByApi } from "./api-tools.ts";
+import { attachOperations, prefetchOpenApi, type OperationSpec } from "./openapi.ts";
 import { commandFor, resolveRunPath } from "./script-tools.ts";
 import { parseRuntime, prepareRuntime } from "./runtime.ts";
 import { hostSafeEnv } from "./host-env.ts";
+import { linkWorkspace, workspaceLinkEnv } from "./confine.ts";
 
 export interface ToolTestResult {
   ok: boolean;
@@ -60,6 +62,32 @@ const clip = (s: string) =>
 const substitute = (v: string, env: Record<string, string>) =>
   v.replace(/\$\{([A-Z0-9_]+)\}/g, (_, k) => env[k] ?? "");
 
+/**
+ * The secrets as a run would hand them over: an oauth2 or service-account
+ * secret swapped for a live access token. Without this the tester passed the
+ * stored `@oauth2 {…}` recipe itself, so every tool behind Google OAuth failed
+ * its Test button while working in every run (gbp-desk review_candidates,
+ * 2026-09-28). A refresh that fails is the tester's answer, not a throw.
+ */
+async function liveSecrets(
+  env: Record<string, string>,
+  ctx: { tenant: string; workspace?: string },
+): Promise<{ env: Record<string, string> } | { error: string }> {
+  try {
+    return { env: await materializeSecrets(env, ctx) };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/** Does a concrete path fit an operation's template (`/contacts/{id}`)? */
+function matchesTemplate(op: OperationSpec, concrete: string): boolean {
+  const re = new RegExp(
+    "^" + op.path.split(/\{[^/}]+\}/).map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+") + "$",
+  );
+  return re.test(concrete);
+}
+
 export interface ToolTestInput {
   /** http: the path to try, appended to `base:`. */
   path?: string;
@@ -80,10 +108,58 @@ export async function testTool(
   if (def.kind === "http") {
     const api = def.spec;
     const needed = secretsUsedByApi(api);
-    const { env, missing } = resolveSecrets(tenant, needed, workspace);
+    const { env: stored, missing } = resolveSecrets(tenant, needed, workspace);
+    const live = await liveSecrets(stored, { tenant, workspace });
+    if ("error" in live) {
+      return done({ ok: false, transport: "http", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+    }
+    const env = live.env;
 
     try {
-      const rel = probePath.startsWith("/") || probePath === "" ? probePath : `/${probePath}`;
+      let rel = probePath.startsWith("/") || probePath === "" ? probePath : `/${probePath}`;
+      let method = api.methods.includes("GET") ? "GET" : api.methods[0];
+
+      // An `operations:` allowlist binds the tester exactly as it binds a run:
+      // the probe may only be a GET to one of the listed operations, and an
+      // allowlist that resolves nothing is a failure, as it is in a run. A
+      // tester that reached the whole API would be the one door the allowlist
+      // left open, and would report "working" for a tool a run cannot use.
+      if (api.operations?.length) {
+        const fetched = await prefetchOpenApi(tenant, api.openapi ? [api.openapi] : []);
+        const { specs, warnings } = attachOperations([api], tenant, workspaceDir(tenant, workspace));
+        const ops = specs[0].resolvedOperations ?? [];
+        if (!ops.length) {
+          return done({
+            ok: false, transport: "http", missingSecrets: missing,
+            summary: "its operations: allowlist resolved no operations, so a run gets no tools from it",
+            detail: [...fetched, ...warnings].join("\n"),
+          });
+        }
+        const listed = ops.map((o) => `${o.method} ${o.path}`).join("\n");
+        const gets = ops.filter((o) => o.method === "GET");
+        const pathOnly = rel.split("?")[0];
+        if (pathOnly === "") {
+          const plain = gets.find((o) => !o.path.includes("{"));
+          if (!plain) {
+            return done({
+              ok: false, transport: "http", missingSecrets: missing,
+              summary: gets.length
+                ? "every GET operation takes a parameter; give a path, like " + gets[0].path
+                : "the allowlist has no GET operation, and the tester only sends GET: it will not probe a write",
+              detail: `operations:\n${listed}`,
+            });
+          }
+          rel = plain.path;
+        } else if (!gets.some((o) => matchesTemplate(o, pathOnly))) {
+          return done({
+            ok: false, transport: "http", missingSecrets: missing,
+            summary: "that path is not one of the tool's GET operations",
+            detail: `path: ${pathOnly}\noperations:\n${listed}`,
+          });
+        }
+        method = "GET";
+      }
+
       const url = new URL(api.base + rel);
       // Same confinement the agent gets: a probe can't reach another host.
       if (!url.href.startsWith(api.base)) {
@@ -98,7 +174,6 @@ export async function testTool(
       const headers: Record<string, string> = {};
       for (const [k, v] of Object.entries(api.headers)) headers[k] = substitute(v, env);
 
-      const method = api.methods.includes("GET") ? "GET" : api.methods[0];
       const res = await fetch(url, {
         method,
         headers,
@@ -203,7 +278,12 @@ export async function testTool(
     }
 
     const names = Array.isArray(def.spec.secrets) ? def.spec.secrets.map(String) : [];
-    const { env, missing } = resolveSecrets(tenant, names, workspace);
+    const { env: stored, missing } = resolveSecrets(tenant, names, workspace);
+    const live = await liveSecrets(stored, { tenant, workspace });
+    if ("error" in live) {
+      return done({ ok: false, transport: "script", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+    }
+    const env = live.env;
     // The runtime's own choice of interpreter, not a second table beside it.
     const interpreter =
       typeof def.spec.interpreter === "string" ? def.spec.interpreter : undefined;
@@ -234,11 +314,24 @@ export async function testTool(
       file,
       toolRuntime.interpreters,
     );
-    const { code, out } = await runOnce(cmd, [...args, ...flags], cwd, {
-      ...hostSafeBaseEnv(),
-      ...toolRuntime.env,
-      ...env,
-    });
+    // The `workspace` link a step holds, held for the test too — a tool
+    // whose code says `workspace/state/x` found nothing here while the same
+    // call worked in a flow. Only from an agent's folder: at the workspace
+    // root there is no depth for it to stand at (the note below says so).
+    const link = caller ? linkWorkspace(cwd, dir) : null;
+    let ran: Awaited<ReturnType<typeof runOnce>>;
+    try {
+      ran = await runOnce(cmd, [...args, ...flags], cwd, workspaceLinkEnv({
+        ...hostSafeBaseEnv(),
+        ...toolRuntime.env,
+        ...env,
+      }, cwd));
+    } finally {
+      link?.release();
+      // A private build (a concurrent one was wedged) is this test's alone.
+      toolRuntime.dispose?.();
+    }
+    const { code, out } = ran;
 
     // A script that needs arguments and got none has not failed — it has not
     // been tested. Saying "exited 2" would send someone looking for a bug.
@@ -254,7 +347,7 @@ export async function testTool(
       detail: clip(
         (caller
           ? `ran from agents/${caller.name}/, where a run runs\n\n`
-          : `ran from the workspace root — there is no agent to stand in for, so a script that reaches ../../ will look one level too high\n\n`) +
+          : `ran from the workspace root — there is no agent to stand in for, so a script that reaches workspace/ or ../../ will not find the workspace there\n\n`) +
           (out || "(no output)"),
       ),
     });
@@ -294,7 +387,12 @@ export async function testTool(
   const named = Object.entries(spec.env ?? {})
     .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])
     .filter((n): n is string => Boolean(n));
-  const { env, missing } = resolveSecrets(tenant, named, workspace);
+  const { env: stored, missing } = resolveSecrets(tenant, named, workspace);
+  const live = await liveSecrets(stored, { tenant, workspace });
+  if ("error" in live) {
+    return done({ ok: false, transport: "mcp", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+  }
+  const env = live.env;
   const childEnv: NodeJS.ProcessEnv = { ...hostSafeBaseEnv() };
   for (const [k, v] of Object.entries(spec.env ?? {})) childEnv[k] = substitute(String(v), env);
 

package/src/translator.ts

@@ -31,6 +31,7 @@ import crypto from "node:crypto";
 import { PROTECTED_PARAMS } from "./providers.ts";
 import { viaEgress } from "./egress.ts";
 import { trimSlashes } from "./paths.ts";
+import { captureRefusalHeaders, isRefusalStatus, refusalLine } from "./refusal.ts";
 
 // ------------------------------------------------------------------ shapes
 
@@ -60,6 +61,10 @@ export interface TranslatorSpec {
    *  upstream request goes through it, and `upstreamKey` is a placeholder
    *  the proxy fills. */
   egress?: string;
+  /** The step's own zone, from the clock cascade — what a reset time in a
+   *  refusal is told in. UTC when nothing said otherwise. */
+  timezone?: string;
+
 }
 
 export interface RunningTranslator {
@@ -419,16 +424,38 @@ export function toResponses(
 
 // ------------------------------------------------------- response mapping
 
-function stopReason(finish: unknown): string {
-  switch (finish) {
-    case "tool_calls":
-    case "function_call":
-      return "tool_use";
-    case "length":
-      return "max_tokens";
-    default:
-      return "end_turn";
-  }
+type Stop = { reason: string; sequence: string | null };
+
+/**
+ * Why a Chat Completion stopped, in Anthropic's words. `content_filter`
+ * (OpenAI, Azure, Gemini's safety block) is a refusal; Mistral's
+ * `model_length` is the context window filling, not max_tokens. A stop
+ * sequence is named only where the provider says which one matched — vLLM
+ * as `stop_reason`, SGLang as `matched_stop` — and only when it is one the
+ * request asked for; plain OpenAI says `stop` either way, which reads as
+ * end_turn. pause_turn has no counterpart: server-side tools are dropped.
+ */
+function chatStop(choice: Json, sawTool: boolean, stops: readonly string[]): Stop {
+  const finish = choice.finish_reason;
+  if (finish === "content_filter") return { reason: "refusal", sequence: null };
+  if (finish === "length") return { reason: "max_tokens", sequence: null };
+  if (finish === "model_length") return { reason: "model_context_window_exceeded", sequence: null };
+  if (sawTool || finish === "tool_calls" || finish === "function_call") return { reason: "tool_use", sequence: null };
+  const matched = typeof choice.stop_reason === "string" ? choice.stop_reason : choice.matched_stop;
+  if (typeof matched === "string" && stops.includes(matched)) return { reason: "stop_sequence", sequence: matched };
+  return { reason: "end_turn", sequence: null };
+}
+
+/** Why a Response stopped: a refusal part or a content filter is a refusal. */
+function responsesStop(incomplete: unknown, sawTool: boolean, sawRefusal: boolean): string {
+  if (sawRefusal || incomplete === "content_filter") return "refusal";
+  if (incomplete === "max_output_tokens") return "max_tokens";
+  if (sawTool) return "tool_use";
+  return "end_turn";
+}
+
+function stopList(stops: unknown): string[] {
+  return Array.isArray(stops) ? stops.filter((s): s is string => typeof s === "string") : [];
 }
 
 function parseArgs(raw: unknown): unknown {
@@ -441,7 +468,7 @@ function parseArgs(raw: unknown): unknown {
 }
 
 /** A finished Chat Completion as an Anthropic message. Pure. */
-export function fromChatCompletion(res: Json, requestedModel: string): Json {
+export function fromChatCompletion(res: Json, requestedModel: string, stopSequences?: unknown): Json {
   const choice = ((res.choices as Json[] | undefined) ?? [])[0] ?? {};
   const msg = (choice.message as Json | undefined) ?? {};
   const content: Json[] = [];
@@ -457,14 +484,15 @@ export function fromChatCompletion(res: Json, requestedModel: string): Json {
     });
   }
   const usage = (res.usage as Json | undefined) ?? {};
+  const stop = chatStop(choice, content.some((c) => c.type === "tool_use"), stopList(stopSequences));
   return {
     id: String(res.id ?? `msg_${crypto.randomBytes(8).toString("hex")}`),
     type: "message",
     role: "assistant",
     model: String(res.model ?? requestedModel),
     content,
-    stop_reason: stopReason(choice.finish_reason),
-    stop_sequence: null,
+    stop_reason: stop.reason,
+    stop_sequence: stop.sequence,
     usage: {
       input_tokens: Number(usage.prompt_tokens ?? 0),
       output_tokens: Number(usage.completion_tokens ?? 0),
@@ -485,12 +513,15 @@ export class StreamTranslator {
   private textIndex: number | null = null;
   /** Chat-Completions tool index → Anthropic block index. */
   private tools = new Map<number, { block: number; argsSeen: boolean }>();
-  private finish: unknown = null;
+  /** The last choice's stop fields: finish_reason and any matched stop. */
+  private finish: Json = {};
   private usage: { input: number; output: number } | null = null;
   private id = `msg_${crypto.randomBytes(8).toString("hex")}`;
   private readonly model: string;
-  constructor(model: string) {
+  private readonly stops: string[];
+  constructor(model: string, stopSequences?: unknown) {
     this.model = model;
+    this.stops = stopList(stopSequences);
   }
 
   private event(name: string, data: Json): string {
@@ -534,7 +565,7 @@ export class StreamTranslator {
     }
     const choice = ((chunk.choices as Json[] | undefined) ?? [])[0];
     if (!choice) return out;
-    if (choice.finish_reason) this.finish = choice.finish_reason;
+    if (choice.finish_reason) this.finish = { finish_reason: choice.finish_reason, stop_reason: choice.stop_reason, matched_stop: choice.matched_stop };
     const delta = (choice.delta as Json | undefined) ?? {};
 
     const text = typeof delta.content === "string" ? delta.content : "";
@@ -614,11 +645,11 @@ export class StreamTranslator {
       }
       out.push(this.event("content_block_stop", { type: "content_block_stop", index: entry.block }));
     }
-    const reason = this.tools.size && this.finish !== "length" ? "tool_use" : stopReason(this.finish);
+    const stop = chatStop(this.finish, this.tools.size > 0, this.stops);
     out.push(
       this.event("message_delta", {
         type: "message_delta",
-        delta: { stop_reason: reason, stop_sequence: null },
+        delta: { stop_reason: stop.reason, stop_sequence: stop.sequence },
         usage: { input_tokens: this.usage?.input ?? 0, output_tokens: this.usage?.output ?? 0 },
       }),
     );
@@ -648,7 +679,10 @@ export function fromResponses(res: Json, requestedModel: string): Json {
   }
   const usage = (res.usage as Json | undefined) ?? {};
   const incomplete = (res.incomplete_details as Json | undefined)?.reason;
-  const stop = content.some((c) => c.type === "tool_use") ? "tool_use" : incomplete === "max_output_tokens" ? "max_tokens" : "end_turn";
+  const refused = (Array.isArray(res.output) ? (res.output as Json[]) : []).some(
+    (item) => item.type === "message" && Array.isArray(item.content) && (item.content as Json[]).some((c) => c.type === "refusal"),
+  );
+  const stop = responsesStop(incomplete, content.some((c) => c.type === "tool_use"), refused);
   return {
     id: String(res.id ?? `msg_${crypto.randomBytes(8).toString("hex")}`),
     type: "message",
@@ -679,6 +713,7 @@ export class ResponsesStreamTranslator {
   private usage: { input: number; output: number } | null = null;
   private incomplete: string | null = null;
   private sawTool = false;
+  private sawRefusal = false;
   private id = `msg_${crypto.randomBytes(8).toString("hex")}`;
   private readonly model: string;
   constructor(model: string) {
@@ -743,6 +778,7 @@ export class ResponsesStreamTranslator {
     if (type === "response.output_text.delta" || type === "response.refusal.delta") {
       const entry = this.blocks.get(Number(ev.output_index));
       const text = String(ev.delta ?? "");
+      if (type === "response.refusal.delta") this.sawRefusal = true;
       if (entry && entry.kind === "text" && text) {
         out.push(this.event("content_block_delta", { type: "content_block_delta", index: entry.block, delta: { type: "text_delta", text } }));
       }
@@ -793,7 +829,7 @@ export class ResponsesStreamTranslator {
       }
       out.push(this.event("content_block_stop", { type: "content_block_stop", index: entry.block }));
     }
-    const reason = this.sawTool && this.incomplete !== "max_output_tokens" ? "tool_use" : this.incomplete === "max_output_tokens" ? "max_tokens" : "end_turn";
+    const reason = responsesStop(this.incomplete, this.sawTool, this.sawRefusal);
     out.push(
       this.event("message_delta", {
         type: "message_delta",
@@ -913,6 +949,20 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
         const text = await upstream.text();
         const message = upstreamMessage(text, upstream.status);
         log.push(`POST ${label} → ${upstream.status} (${Date.now() - started}ms): ${message.slice(0, 160)}`);
+        // The refusal in words, from the headers the response already
+        // carried. Only on a refusal, and only the allow-listed headers:
+        // a 400 about a malformed body is the work's problem, not the
+        // supply's, and explaining it as one would mislead.
+        if (isRefusalStatus(upstream.status)) {
+          log.push(
+            refusalLine({
+              status: upstream.status,
+              headers: captureRefusalHeaders(upstream.headers),
+              timezone: spec.timezone,
+              provider: label,
+            }),
+          );
+        }
         // The status crosses unchanged, so a 401 or 429 from the provider
         // reads as one to the SDK — and to the fallback decision upstream.
         return send(upstream.status, errorBody(upstream.status, message));
@@ -928,11 +978,11 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
           return send(502, errorBody(502, `translator: ${label} answered with something that is not JSON`));
         }
         log.push(`POST ${label} → 200 (${Date.now() - started}ms, ${model})`);
-        return send(200, JSON.stringify(responses ? fromResponses(parsed, model) : fromChatCompletion(parsed, model)));
+        return send(200, JSON.stringify(responses ? fromResponses(parsed, model) : fromChatCompletion(parsed, model, body.stop_sequences)));
       }
 
       res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
-      const machine = responses ? new ResponsesStreamTranslator(model) : new StreamTranslator(model);
+      const machine = responses ? new ResponsesStreamTranslator(model) : new StreamTranslator(model, body.stop_sequences);
       const reader = upstream.body?.getReader();
       if (!reader) {
         for (const e of machine.finishStream()) res.write(e);

package/src/trigger-log.ts

@@ -38,6 +38,7 @@ export type TriggerOutcome =
   | "throttled"
   | "debounced"
   | "quarantined"
+  | "paused"
   | "overlap-skipped"
   | "missed"
   | "failed";

package/src/triggers.ts

@@ -14,7 +14,7 @@
 
 import crypto from "node:crypto";
 import { platform } from "./platform.ts";
-import { listFlows, readRun, type FlowInfo, type FlowStep, type RunRecord } from "./store.ts";
+import { listFlows, readRun, runVerdict, type FlowInfo, type FlowStep, type RunRecord } from "./store.ts";
 import { getSecret } from "./secrets.ts";
 
 /** The last step's result — the same reading runner.ts makes, kept local so
@@ -36,6 +36,13 @@ export function withTask(steps: FlowStep[], tag: string, body: string): FlowStep
 
 // ------------------------------------------------------------ trigger: flow
 
+/** Which `on:` a settled run answers to: failed, blocked (completed, but
+ *  its work refused itself), or completed. */
+export function endingOf(run: RunRecord): "completed" | "failed" | "blocked" {
+  if (run.status === "failed") return "failed";
+  return runVerdict(run) === "BLOCKED" ? "blocked" : "completed";
+}
+
 /** The flows a finished run should start, by this workspace's own files. */
 export function chainedFlows(tenant: string, workspace: string, finished: RunRecord): FlowInfo[] {
   if (finished.status !== "completed" && finished.status !== "failed") return [];
@@ -48,7 +55,7 @@ export function chainedFlows(tenant: string, workspace: string, finished: RunRec
       // A flow chained on itself is a loop with no bound — refused here and
       // by foldrun check, never started.
       f.name !== finished.flow &&
-      (f.on === "any" || f.on === finished.status),
+      (f.on === "any" || f.on === endingOf(finished)),
   );
 }
 
@@ -66,6 +73,7 @@ export async function fireChainedFlows(tenant: string, workspace: string, finish
   const result = (runResult(finished) ?? "").slice(0, 20_000);
   const body =
     `run: ${finished.id}\nflow: ${finished.flow}\nstatus: ${finished.status}\n` +
+    (runVerdict(finished) ? `verdict: ${runVerdict(finished)}\n` : "") +
     (finished.summary ? `summary: ${finished.summary}\n` : "") +
     (result ? `\n${result}` : "");
   for (const flow of flows) {

package/src/untrusted-fetch.ts

@@ -0,0 +1,88 @@
+// fetch() for a URL a tenant chose, redirects included.
+//
+// platform.fetchUntrusted is the seam: on a platform it refuses private and
+// cluster addresses (by name, by IP literal, and at connect time through a
+// guarded DNS lookup). But it was handed fetch's default `redirect:
+// "follow"`, and a redirect is followed inside fetch, past the seam: a
+// public host answering `302 Location: http://169.254.169.254/…` sent the
+// platform to the metadata endpoint, because an IP literal never reaches the
+// DNS lookup the connect-time guard lives in. And the OAuth token POSTs
+// carried a client secret to wherever a 307 pointed.
+//
+// So redirects are followed here, one hop at a time, each hop through the
+// seam again — every address a request ends up at is checked the same way
+// the first one was. A hop to another origin keeps only the headers that
+// cannot carry a credential, and a caller whose request IS a credential
+// (a token exchange, a provider key in a header) follows none at all.
+
+import { platform } from "./platform.ts";
+
+/** How many redirects one request may follow. fetch's own limit is 20;
+ *  nothing a tenant points the platform at needs more than a couple. */
+export const MAX_REDIRECTS = 5;
+
+const REDIRECT = new Set([301, 302, 303, 307, 308]);
+
+/** Headers that may cross to another origin: none of them can carry a
+ *  credential. Everything else — Authorization, a cookie, an x-api-key, a
+ *  webhook's signature — stays with the origin it was meant for. */
+const CROSS_ORIGIN_SAFE = new Set(["accept", "accept-language", "content-type", "user-agent"]);
+
+export class RedirectRefused extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "RedirectRefused";
+  }
+}
+
+export async function fetchUntrusted(
+  url: string,
+  init: RequestInit = {},
+  opts: {
+    /** The request carries a credential (in its body or its headers):
+     *  follow a redirect only within the origin it was sent to. */
+    sameOrigin?: boolean;
+  } = {},
+): Promise<Response> {
+  let current = url;
+  let req: RequestInit = { ...init };
+  for (let hop = 0; ; hop++) {
+    const res = await platform.fetchUntrusted(current, { ...req, redirect: "manual" });
+    const location = REDIRECT.has(res.status) ? res.headers.get("location") : null;
+    if (!location) return res;
+    // The body of a redirect is never read; free the socket.
+    await res.body?.cancel().catch(() => {});
+    if (hop >= MAX_REDIRECTS) throw new RedirectRefused(`${url}: more than ${MAX_REDIRECTS} redirects — not followed`);
+    let next: URL;
+    try {
+      next = new URL(location, current);
+    } catch {
+      throw new RedirectRefused(`${current} redirected to "${location}", which is not a URL`);
+    }
+    if (next.protocol !== "https:" && next.protocol !== "http:") {
+      throw new RedirectRefused(`${current} redirected to a ${next.protocol} URL — not followed`);
+    }
+    const from = new URL(current);
+    const crossOrigin = next.origin !== from.origin;
+    if (crossOrigin && opts.sameOrigin) {
+      throw new RedirectRefused(
+        `${from.origin} redirected to ${next.origin} — not followed: this request carries a credential, and it goes only where it was sent`,
+      );
+    }
+    // fetch's own rewrite: a 303, and a 301/302 answering a POST, is
+    // followed as a GET with no body; a 307/308 repeats the request as it was.
+    const method = (req.method ?? "GET").toUpperCase();
+    const headers = new Headers(req.headers);
+    if ((res.status === 303 && method !== "GET" && method !== "HEAD") || ((res.status === 301 || res.status === 302) && method === "POST")) {
+      req = { ...req, method: "GET", body: undefined };
+      headers.delete("content-type");
+    }
+    if (crossOrigin) {
+      const names: string[] = [];
+      headers.forEach((_, name) => names.push(name));
+      for (const name of names) if (!CROSS_ORIGIN_SAFE.has(name)) headers.delete(name);
+    }
+    req = { ...req, headers };
+    current = next.toString();
+  }
+}