agenticreplay 0.1.0 → 0.1.2

package/packages/cli/dist/tls-capture.js

@@ -0,0 +1,586 @@
+import { readFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { DEFAULT_MAX_CAPTURED_BYTES, HostPolicy, RunCa, resolveTlsHosts, } from '@agenticreplay/proxy';
+import { captureLimits } from './capture-limits.js';
+/**
+ * Everything `setupTlsCapture` can refuse, without creating anything.
+ *
+ * A caller that has a trace directory to lose needs the refusal to happen first: a run abandoned
+ * by a throw leaves an unsealed directory behind, and an unsealed directory wins `last`. An exact
+ * replay has more than that to lose — it calls this before `replayWorkspace`, which writes the
+ * recording over the operator's checkout.
+ *
+ * `extraOriginRoots` is here for the second reason and not the first. It reads files, so it was
+ * left out of a function whose whole point was to decide from the arguments alone — but that made
+ * this only *most* of what `setupTlsCapture` refuses, and an unreadable `AGENTICREPLAY_TLS_UPSTREAM_CA`
+ * went on failing late, past the restore. The roots are read again below, microseconds later and
+ * on a path the run was going to read anyway.
+ */
+export async function planTlsCapture(args, recordedHosts) {
+    captureLimits(args);
+    if (!interceptionRequested(args, recordedHosts))
+        return;
+    HostPolicy.from([...resolveTlsHosts(args.list('tls-hosts'), recordedHosts)]);
+    await extraOriginRoots();
+}
+/**
+ * Is this run intercepting?
+ *
+ * A run recorded through interception has to be replayed through it. The agent this exists for
+ * talks to its own backend over TLS it establishes itself, so without interception the replay
+ * proxy never sees the request at all: it tunnels the CONNECT to an origin that is offline or,
+ * worse, live. That failed as `reused=0/n` — which reads as a broken recording rather than as a
+ * missing flag, and the flag is one nobody thinks to repeat when the command they type is
+ * `agenticreplay replay last`.
+ *
+ * So the recording decides. It already knows: every intercepted run writes a `tls_intercept` note
+ * naming the hosts it decrypted. Nothing is inferred and nothing is widened — an operator who
+ * never turned interception on gets a replay that never turns it on either, and
+ * `--no-tls-intercept` refuses outright.
+ */
+function interceptionRequested(args, recordedHosts) {
+    const askedFor = args.bool('tls-intercept');
+    // `--no-tls-intercept` is the only way to tell "left unset" apart from "explicitly refused", and
+    // the difference matters: absence means agenticreplay may decide, refusal means it may not.
+    const refused = args.has('tls-intercept') && !askedFor;
+    return askedFor || (!refused && recordedHosts !== undefined);
+}
+export async function setupTlsCapture(req) {
+    const { args, out, writer, writes, recordedHosts } = req;
+    const tlsHosts = args.list('tls-hosts');
+    const interceptTls = interceptionRequested(args, recordedHosts);
+    // Naming hosts without asking for interception captures nothing and says nothing, which reads
+    // as "agenticreplay ignored my traffic" rather than as "agenticreplay ignored my flag".
+    if (!interceptTls && tlsHosts.length > 0) {
+        out.warn('tls.hosts_ignored', { hosts: tlsHosts.join(','), next: 'add --tls-intercept' });
+    }
+    const limits = captureLimits(args);
+    if (!interceptTls)
+        return { proxyOptions: limits };
+    // Resolved before anything is minted, so a contradictory list — one that both replaces the
+    // defaults and adds to them — fails while the run directory still holds no private key.
+    const hosts = resolveTlsHosts(tlsHosts, recordedHosts);
+    HostPolicy.from([...hosts]);
+    const trustedOriginCerts = await extraOriginRoots();
+    const runDir = writer?.runDir ?? req.runDir;
+    if (!runDir)
+        throw new Error('TLS interception needs a run directory');
+    const ca = await RunCa.create({ runDir });
+    // One line per path, not per call: an agent that posts to the same endpoint every turn would
+    // otherwise bury the run in a warning the operator already read.
+    const unclaimed = req.unclaimed ?? new UnclaimedPaths(limits.maxCapturedBytes);
+    const requestTurns = new Map();
+    return {
+        ca,
+        proxyOptions: {
+            ...limits,
+            tls: {
+                ...limits,
+                ca,
+                hosts: [...hosts],
+                trustedOriginCerts,
+                onRequestStart: async (request) => {
+                    if (req.onRequestStart)
+                        return req.onRequestStart(request);
+                    const turn = req.turn();
+                    requestTurns.set(request.requestId, turn);
+                    if (writer)
+                        await persistNetRequestStart(writer, turn, request);
+                },
+                onNetExchange: (exchange) => {
+                    if (req.onNetExchange)
+                        return req.onNetExchange(exchange);
+                    unclaimed.note(out, exchange);
+                    const turn = requestTurns.get(exchange.requestId) ?? req.turn();
+                    requestTurns.delete(exchange.requestId);
+                    if (writer)
+                        writes.push(() => persistNetExchange(writer, turn, exchange));
+                },
+                onTunnel: (tunnel) => {
+                    if (writer)
+                        writes.push(() => persistTunnel(writer, req.turn(), tunnel));
+                },
+                onFailure: (failure) => {
+                    writer?.markCaptureIncomplete('transport_interception_failed');
+                    if (writer)
+                        writes.push(async () => {
+                            await writer.append({
+                                type: 'note',
+                                actor: 'agenticreplay',
+                                turn: req.turn(),
+                                attrs: { rule: 'transport_interception_failed', ...failure },
+                            });
+                        });
+                    reportInterceptFailure(out, failure);
+                },
+            },
+        },
+    };
+}
+export async function persistNetRequestStart(writer, turn, request) {
+    await writer.append({
+        type: 'net.request',
+        actor: 'agent',
+        turn,
+        occurredAt: new Date(request.requestStartedAt),
+        attrs: {
+            phase: 'start',
+            request_id: request.requestId,
+            boundary: 'tls-intercept',
+            host: request.host,
+            port: request.port,
+            method: request.method,
+            path: request.path,
+            headers: request.requestHeaders,
+            bytes: request.requestBytes.byteLength,
+            truncated: request.requestTruncated,
+        },
+    });
+}
+/**
+ * The paths a run forwarded but could not interpret, warned about once each.
+ *
+ * Two callers, which is the point. Interception has reported this since it shipped; the ordinary
+ * plaintext route — a harness redirected by a base-URL variable, posting to an endpoint no
+ * dialect claims — reported nothing at all, and that is the commoner case by far. A retrieval
+ * pipeline is entirely made of it: `/v1/embeddings` is not a model exchange, so a run that
+ * captured every embedding call it made printed `capture.empty exchanges=0` and sent the operator
+ * to check a base-URL variable that was set correctly all along.
+ *
+ * It also keeps the list, because the diagnosis at the end of the run needs to name the paths
+ * rather than describe them.
+ */
+export class UnclaimedPaths {
+    bodyLimit;
+    #reported = new Set();
+    #paths = new Set();
+    constructor(bodyLimit = DEFAULT_MAX_CAPTURED_BYTES) {
+        this.bodyLimit = bodyLimit;
+    }
+    /** Warn about this exchange if it is the first on its path, and remember the path. */
+    note(out, exchange) {
+        warnUnclaimed(out, this.#reported, this.#paths, exchange, this.bodyLimit);
+    }
+    /** The distinct paths seen, in the order they were first seen. */
+    list() {
+        return [...this.#paths];
+    }
+    get size() {
+        return this.#paths.size;
+    }
+}
+/**
+ * A call that looked like a model request and was not understood.
+ *
+ * Traffic on a path no dialect claims is recorded as `net.*`: agenticreplay holds the bytes but not their
+ * meaning, so it can neither match the request on replay nor rewrite its model on a fork. Strict
+ * replay says so plainly — and says it one command too late, after the agent has finished and the
+ * chance to record the run properly has gone. This is the same fact, delivered while it is still
+ * actionable.
+ *
+ * Deliberately narrow. A GET, or a POST whose body is not JSON, is ordinary traffic that was never
+ * a model call, and warning about it would teach the operator to ignore the warning that matters.
+ */
+function warnUnclaimed(out, reported, paths, exchange, bodyLimit) {
+    if (exchange.method !== 'POST')
+        return;
+    // A retrieval rule claimed it, so every word of the warning below is false about this call: it
+    // is not unclaimed, it does replay, and there is no dialect to go and write. Recording an
+    // index build printed one of these per endpoint and told the operator the run could not be
+    // reproduced, at the moment agenticreplay had just made sure it could.
+    if (exchange.rule !== undefined || exchange.modelDialect !== undefined)
+        return;
+    // No response ever arrived, so this one is not evidence that a path went unrecognised. It is
+    // kept as network traffic because an exchange with nothing to replay cannot be a model exchange
+    // whatever dialect exists -- and telling the operator to write one would not change that. A
+    // harness that opens a call and leaves would otherwise print this on every turn.
+    if (exchange.status === 0)
+        return;
+    const body = exchange.requestBody.trim();
+    if (!body.startsWith('{'))
+        return;
+    // A truncated body cannot parse — it was cut mid-JSON at the capture limit. Requiring a parse
+    // would suppress the warning for exactly the requests it exists for, since a long conversation
+    // is the one most likely to exceed the limit and the most expensive to have to record again.
+    if (!exchange.requestTruncated) {
+        try {
+            const parsed = JSON.parse(body);
+            if (typeof parsed !== 'object' || parsed === null)
+                return;
+        }
+        catch {
+            // A body agenticreplay could not even parse is not a model call it failed to recognise.
+            return;
+        }
+    }
+    const path = exchange.path.split('?')[0] ?? exchange.path;
+    const key = `${exchange.host}:${exchange.port}${path}`;
+    if (reported.has(key))
+        return;
+    reported.add(key);
+    paths.add(path);
+    // A body cut mid-JSON at the capture limit is a different fact from a path nobody claims, and
+    // the advice differs with it: no dialect can read a truncated body, so writing one changes
+    // nothing. Driving a 1.2 MiB request through an intercepted host printed the wrong one of these
+    // -- `no wire dialect claims this path`, about a path the openai dialect had claimed all along.
+    // `tls.` only where TLS was actually terminated. The same fact reached by the plaintext route
+    // is not a fact about TLS, and a rule named for a mechanism that was not used sends the reader
+    // looking for an interception they never turned on.
+    const rule = exchange.intercepted === false ? 'proxy' : 'tls';
+    if (exchange.requestTruncated) {
+        out.warn(`${rule}.request_too_large`, {
+            host: exchange.host,
+            path: exchange.path,
+            limit_bytes: bodyLimit,
+            detail: 'the request body was cut at the capture limit, so no dialect could read it',
+            consequence: 'capture is incomplete; the omitted body is not eligible for replay',
+            next: 'increase --max-body-bytes and record again',
+        });
+        return;
+    }
+    out.warn(`${rule}.unclaimed_path`, {
+        host: exchange.host,
+        path: exchange.path,
+        detail: exchange.intercepted === false
+            ? 'forwarded and recorded, but no wire dialect claims this path'
+            : 'decrypted and recorded, but no wire dialect claims this path',
+        consequence: 'it replays as opaque network traffic and cannot be forked to another model',
+        next: 'docs/plugins.md to add a dialect for it',
+    });
+}
+/**
+ * The hosts a recorded run decrypted, read back out of its own trace.
+ *
+ * `trustRunCa` writes this note on every intercepted run — a digest and a host list, never the
+ * certificate and never the key — so the trace is self-describing about the one thing a faithful
+ * replay cannot guess. Returns undefined for a run recorded without interception, which is the
+ * signal that the replay must not turn it on either.
+ */
+export function recordedTlsHosts(events) {
+    for (const event of events) {
+        if (event.type !== 'note' || event.attrs?.['rule'] !== 'tls_intercept')
+            continue;
+        const hosts = event.attrs['hosts'];
+        if (typeof hosts !== 'string')
+            continue;
+        const parsed = hosts
+            .split(',')
+            .map((h) => h.trim())
+            .filter((h) => h !== '');
+        if (parsed.length > 0)
+            return parsed;
+    }
+    return undefined;
+}
+/**
+ * What the launched agent needs in its environment to be intercepted, and the disclosure the
+ * operator needs before it happens.
+ *
+ * Lived in `agenticreplay record` alongside the setup, so a fork that minted a CA would have decrypted
+ * nothing: the child was never pointed at the proxy and never told to trust the root. Interception
+ * is only two halves working together, so both halves belong in one place.
+ */
+export async function trustRunCa(writer, proxyTls, proxyUrl, env, out) {
+    // The child trusts the run CA through its own environment and through nothing else. Nothing here
+    // touches a system or browser trust store, and agenticreplay will not offer to: interception ends when
+    // this process does, which is the property that makes it defensible at all.
+    env.HTTPS_PROXY = proxyUrl;
+    env.https_proxy = proxyUrl;
+    // NODE_EXTRA_CA_CERTS *adds* to Node's trust store. The rest of these *replace* an OpenSSL
+    // client's store outright, so they get the bundle — the run CA plus the public roots — or the
+    // child would lose its ability to reach every host agenticreplay deliberately does not intercept.
+    env.NODE_EXTRA_CA_CERTS = proxyTls.caCertPath;
+    // Python OS truststore clients may ignore SSL_CERT_FILE. The process-local bootstrap
+    // adds this CA to their contexts while retaining platform roots and verification.
+    env.AGENTICREPLAY_TLS_CA = proxyTls.caCertPath;
+    for (const variable of [
+        'SSL_CERT_FILE',
+        'REQUESTS_CA_BUNDLE',
+        'CURL_CA_BUNDLE',
+        'AWS_CA_BUNDLE',
+        'DENO_CERT',
+    ]) {
+        env[variable] = proxyTls.caBundlePath;
+    }
+    // The agent also talks to the recording proxy directly over plain HTTP via the base-URL
+    // variables. Sending those through the proxy as well would be a loop.
+    const existing = process.env.NO_PROXY ?? process.env.no_proxy ?? '';
+    const noProxy = [existing, 'localhost', '127.0.0.1', '::1'].filter(Boolean).join(',');
+    env.NO_PROXY = noProxy;
+    env.no_proxy = noProxy;
+    out.warn('tls.intercepting', {
+        hosts: proxyTls.hosts,
+        ca_sha256: proxyTls.fingerprint,
+        ca_dir: dirname(proxyTls.caCertPath),
+    });
+    out.plain('  TLS interception is on for this run. Traffic to the hosts above is decrypted,');
+    out.plain('  recorded and re-encrypted; everything else is tunnelled unread. The certificate');
+    out.plain('  authority is unique to this run, trusted only by the agent agenticreplay launches, and');
+    out.plain('  deleted when the run ends. It is not installed anywhere.');
+    // A digest, never the certificate and never the key. The CA is deleted when the run ends, so
+    // this line is the only lasting evidence of which authority signed what — enough to match a
+    // certificate someone finds later to the run that minted it, and useless for anything else.
+    if (writer) {
+        await writer.append({
+            type: 'note',
+            actor: 'agenticreplay',
+            turn: 0,
+            attrs: {
+                rule: 'tls_intercept',
+                hosts: proxyTls.hosts,
+                ca_sha256: proxyTls.fingerprint,
+                python_trust: 'process-local truststore CA addition; verification remains enabled',
+            },
+        });
+    }
+}
+/**
+ * One decrypted HTTP exchange agenticreplay did not recognise as a model call.
+ *
+ * `net.request` / `net.response` have been in the spec since v0 and nothing has ever emitted them;
+ * this is what makes them real. The pair is deliberately shaped like `model.request` /
+ * `model.response` so the timeline reads the same either way.
+ */
+export async function persistNetExchange(writer, turn, exchange) {
+    const failedBeforeHeaders = exchange.status === 0 && Boolean(exchange.responseError) && exchange.responseBytes === 0;
+    const incomplete = exchange.requestTruncated ||
+        exchange.responseTruncated ||
+        (!exchange.responseComplete && !failedBeforeHeaders) ||
+        Boolean(exchange.abandoned);
+    if (incomplete)
+        writer.markCaptureIncomplete('incomplete_transport_body');
+    const requestChanges = (exchange.transformations ?? []).filter((t) => t.location.startsWith('request'));
+    const responseChanges = (exchange.transformations ?? []).filter((t) => t.location.startsWith('response'));
+    const translated = responseChanges.some((t) => t.rule === 'provider-protocol-translation');
+    const request = await writer.append({
+        type: 'net.request',
+        // The agent made the call. No actor names "some server on the internet", so the reply is
+        // attributed to agenticreplay, which is the only party that witnessed it.
+        actor: 'agent',
+        turn,
+        occurredAt: new Date(exchange.requestStartedAt),
+        attrs: {
+            phase: 'body',
+            request_id: exchange.requestId,
+            boundary: exchange.intercepted === false ? 'http-proxy' : 'tls-proxy',
+            capture_incomplete: exchange.requestTruncated,
+            host: exchange.host,
+            port: exchange.port,
+            method: exchange.method,
+            path: exchange.path,
+            ...(exchange.alpn === undefined ? {} : { alpn: exchange.alpn }),
+            // Absent means intercepted — every exchange the interceptor produces. The proxy's plaintext
+            // passthrough says so explicitly, because it decrypted nothing.
+            intercepted: exchange.intercepted ?? true,
+            // The two fields that make a `net.*` pair replayable rather than merely recorded: which
+            // rule claimed the call, and what a later run looks it up by. Purely additive — a reader
+            // that does not know about them sees the same pair it always did, and their absence means
+            // what it has always meant: agenticreplay holds these bytes and not their meaning.
+            ...(exchange.rule === undefined ? {} : { rule: exchange.rule }),
+            ...(exchange.modelDialect === undefined ? {} : { model_dialect: exchange.modelDialect }),
+            ...(translated
+                ? {
+                    replay_eligible: false,
+                    replay_ineligible_reason: 'origin_response_translated_for_client',
+                }
+                : {}),
+            ...(exchange.replayKey === undefined ? {} : { replay_key: exchange.replayKey }),
+            ...(exchange.batchKey === undefined ? {} : { batch_key: exchange.batchKey }),
+            headers: exchange.requestHeaders,
+            bytes: exchange.requestBytes,
+            truncated: exchange.requestTruncated,
+        },
+        ...(exchange.requestTruncated
+            ? {
+                transformations: [
+                    ...requestChanges,
+                    {
+                        kind: 'omission',
+                        location: 'request.body',
+                        rule: 'capture_limit',
+                        count: 1,
+                        reason: 'body exceeds capture resource limit',
+                    },
+                ],
+            }
+            : { payload: exchange.requestBody, transformations: requestChanges }),
+    });
+    await writer.append({
+        type: 'net.response',
+        actor: 'agenticreplay',
+        turn,
+        causes: [request.seq],
+        attrs: {
+            request_id: exchange.requestId,
+            capture_incomplete: incomplete,
+            response_complete: exchange.responseComplete,
+            transport_outcome: exchange.abandoned
+                ? 'client_aborted'
+                : exchange.responseError
+                    ? 'origin_error'
+                    : 'completed',
+            ...(exchange.responseError ? { error: exchange.responseError } : {}),
+            host: exchange.host,
+            port: exchange.port,
+            status: exchange.status,
+            intercepted: exchange.intercepted ?? true,
+            headers: exchange.responseHeaders,
+            bytes: exchange.responseBytes,
+            // What agenticreplay decompressed, next to the header set that no longer describes it. `bytes` is
+            // still the wire count, so the two together say how much the encoding was worth.
+            ...(exchange.responseDecodedFrom === undefined
+                ? {}
+                : { decoded_from: exchange.responseDecodedFrom }),
+            truncated: exchange.responseTruncated,
+            // Only when it happened, so a normal exchange carries no field saying it was normal. It
+            // reads differently from `truncated`: the agent stopped reading, agenticreplay did not stop keeping.
+            ...(exchange.abandoned ? { abandoned: true } : {}),
+            ...(exchange.rule === undefined ? {} : { rule: exchange.rule }),
+            ...(exchange.replayKey === undefined ? {} : { replay_key: exchange.replayKey }),
+            // A digest of the answer. Under `--retrieval-store=digest` it is *instead* of the answer,
+            // and `stored` says which, so nothing has to infer the difference from an empty payload.
+            ...(exchange.responseDigest === undefined
+                ? {}
+                : {
+                    response_sha256: exchange.responseDigest,
+                    stored: exchange.responseBody === '' ? 'digest' : 'full',
+                }),
+            duration_ms: exchange.durationMs,
+        },
+        ...(exchange.responseTruncated
+            ? {
+                transformations: [
+                    ...responseChanges,
+                    {
+                        kind: 'omission',
+                        location: 'response.body',
+                        rule: 'capture_limit',
+                        count: 1,
+                        reason: 'body exceeds capture resource limit',
+                    },
+                ],
+            }
+            : { payload: exchange.responseBody, transformations: responseChanges }),
+    });
+}
+/**
+ * A connection agenticreplay refused to decrypt.
+ *
+ * Recorded because the refusal is itself the evidence — and because an operator whose harness talks
+ * to an endpoint nobody predicted finds it here, in a line naming the host and nothing else, rather
+ * than by guessing. No path, no headers, no payload: there is nothing to write, because agenticreplay never
+ * held the plaintext.
+ */
+async function persistTunnel(writer, turn, tunnel) {
+    writer.markCaptureIncomplete('unobserved_tunnel_body');
+    const request = await writer.append({
+        type: 'net.request',
+        actor: 'agent',
+        turn,
+        attrs: {
+            host: tunnel.host,
+            port: tunnel.port,
+            intercepted: false,
+            reason: 'host not in the TLS interception allowlist',
+            capture_incomplete: true,
+        },
+        transformations: [
+            {
+                kind: 'omission',
+                location: 'request.body',
+                rule: 'unsupported_transport',
+                count: 1,
+                reason: 'TLS tunnel was forwarded without body interception',
+            },
+        ],
+    });
+    await writer.append({
+        type: 'net.response',
+        actor: 'agenticreplay',
+        turn,
+        causes: [request.seq],
+        attrs: {
+            host: tunnel.host,
+            port: tunnel.port,
+            intercepted: false,
+            bytes_to_origin: tunnel.bytesToOrigin,
+            bytes_to_client: tunnel.bytesToClient,
+            duration_ms: tunnel.durationMs,
+            ...(tunnel.error === undefined ? {} : { error: tunnel.error }),
+        },
+    });
+}
+/**
+ * Extra roots to trust when connecting onward to the real origin.
+ *
+ * An intercepting proxy terminates TLS, so it also has to make the outbound connection itself. In a
+ * corporate environment that connection goes through another intercepting proxy whose root Node
+ * does not ship, and the run fails at the first request with an opaque certificate error.
+ */
+async function extraOriginRoots(env = process.env) {
+    const configured = env.AGENTICREPLAY_TLS_UPSTREAM_CA;
+    if (!configured)
+        return [];
+    const roots = [];
+    for (const path of configured
+        .split(',')
+        .map((p) => p.trim())
+        .filter(Boolean)) {
+        roots.push(await readFile(path, 'utf8'));
+    }
+    return roots;
+}
+/**
+ * ONE EVENT NAME PER THING THAT ACTUALLY HAPPENED.
+ *
+ * `tls.handshake_failed` was every failure interception could produce — a body that would not
+ * decompress, a WebSocket upgrade declined, an h2 stream faulting, and, buried among them, the one
+ * an operator most needs to recognise: the client refusing OUR certificate.
+ *
+ * That last one is why the name mattered. It is reported on the client side of the proxy, but
+ * "handshake failed" with an `h2 session:` prefix reads as a problem between agenticreplay and the origin —
+ * so the operator goes looking at the network, the upstream, the proxy variables. The fix is on the
+ * other side of the connection entirely: the run CA is not in the agent's trust store. Meanwhile
+ * nothing from that host is recorded, and the trace looks merely quiet rather than broken.
+ *
+ * The name is what people grep and alert on, so it is the name that has to be true.
+ */
+export function reportInterceptFailure(out, failure) {
+    const { kind, ...fields } = failure;
+    switch (kind) {
+        case 'client_handshake':
+            out.warn('tls.handshake_failed', {
+                ...fields,
+                cause: 'the agent refused the certificate agenticreplay presented — this run’s CA is not in its trust store',
+                effect: `nothing from ${failure.host} is being recorded; the trace will simply be missing it`,
+                next: 'trust the run CA in the agent: NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, SSL_CERT_FILE, or the language runtime’s own store — `agenticreplay record --tls-intercept` prints the path',
+            });
+            return;
+        case 'upstream_session':
+            out.warn('tls.upstream_failed', {
+                ...fields,
+                cause: 'agenticreplay could not establish or keep the TLS session to the origin',
+                next: 'check the host is reachable from this machine, and that any corporate root it needs is in AGENTICREPLAY_TLS_UPSTREAM_CA',
+            });
+            return;
+        case 'body_opaque':
+            // Not a failure of the connection at all: the exchange is recorded, the body just could not
+            // be decoded, so it is kept as it arrived. Saying "handshake" here sent people to the wrong
+            // layer for something that lost no data.
+            out.warn('net.body_opaque', {
+                ...fields,
+                effect: 'the exchange is recorded; this body is kept as it arrived rather than decoded',
+            });
+            return;
+        case 'upgrade_refused':
+            out.warn('net.upgrade_refused', {
+                ...fields,
+                next: 'take the host off --tls-hosts so the whole connection is tunnelled untouched',
+            });
+            return;
+        case 'session':
+            out.warn('tls.session_error', fields);
+            return;
+    }
+}
+//# sourceMappingURL=tls-capture.js.map

package/packages/cli/dist/tls-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-capture.js","sourceRoot":"","sources":["../src/tls-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,KAAK,EACL,eAAe,GAMhB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmDpD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAgB,EAChB,aAAiC;IAEjC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO;IACxD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,gBAAgB,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,qBAAqB,CAAC,IAAgB,EAAE,aAAiC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5C,iGAAiG;IACjG,4FAA4F;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvD,OAAO,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,aAAa,KAAK,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAsB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAEhE,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAEnD,2FAA2F;IAC3F,wFAAwF;IACxF,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC5B,MAAM,kBAAkB,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAE1C,6FAA6F;IAC7F,iEAAiE;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,OAAO;QACL,EAAE;QACF,YAAY,EAAE;YACZ,GAAG,MAAM;YACT,GAAG,EAAE;gBACH,GAAG,MAAM;gBACT,EAAE;gBACF,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;gBACjB,kBAAkB;gBAClB,cAAc,EAAE,KAAK,EAAE,OAAmB,EAAE,EAAE;oBAC5C,IAAI,GAAG,CAAC,cAAc;wBAAE,OAAO,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;oBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;oBACxB,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC1C,IAAI,MAAM;wBAAE,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAClE,CAAC;gBACD,aAAa,EAAE,CAAC,QAAqB,EAAE,EAAE;oBACvC,IAAI,GAAG,CAAC,aAAa;wBAAE,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBAC1D,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACxC,IAAI,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBACD,QAAQ,EAAE,CAAC,MAAoB,EAAE,EAAE;oBACjC,IAAI,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC3E,CAAC;gBACD,SAAS,EAAE,CAAC,OAAyB,EAAE,EAAE;oBACvC,MAAM,EAAE,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,IAAI,MAAM;wBACR,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;4BACrB,MAAM,MAAM,CAAC,MAAM,CAAC;gCAClB,IAAI,EAAE,MAAM;gCACZ,KAAK,EAAE,eAAe;gCACtB,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;gCAChB,KAAK,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,OAAO,EAAE;6BAC7D,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACL,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACvC,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAmB,EACnB,IAAY,EACZ,OAAmB;IAEnB,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,OAAO;QACd,IAAI;QACJ,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC9C,KAAK,EAAE;YACL,KAAK,EAAE,OAAO;YACd,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,cAAc;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,UAAU;YACtC,SAAS,EAAE,OAAO,CAAC,gBAAgB;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IAGI;IAFpB,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,YAA6B,YAAY,0BAA0B;QAAtC,cAAS,GAAT,SAAS,CAA6B;IAAG,CAAC;IAEvE,sFAAsF;IACtF,IAAI,CAAC,GAAW,EAAE,QAAqB;QACrC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED,kEAAkE;IAClE,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,GAAW,EACX,QAAqB,EACrB,KAAkB,EAClB,QAAqB,EACrB,SAAiB;IAEjB,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IACvC,+FAA+F;IAC/F,0FAA0F;IAC1F,2FAA2F;IAC3F,uEAAuE;IACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO;IAC/E,6FAA6F;IAC7F,gGAAgG;IAChG,4FAA4F;IAC5F,iFAAiF;IACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAClC,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;YACxF,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhB,8FAA8F;IAC9F,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,+FAA+F;IAC/F,oDAAoD;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE;YACpC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,4EAA4E;YACpF,WAAW,EAAE,oEAAoE;YACjF,IAAI,EAAE,4CAA4C;SACnD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,EAAE;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EACJ,QAAQ,CAAC,WAAW,KAAK,KAAK;YAC5B,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,8DAA8D;QACpE,WAAW,EAAE,4EAA4E;QACzF,IAAI,EAAE,yCAAyC;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA6B;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,eAAe;YAAE,SAAS;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,KAAK;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAA+B,EAC/B,QAA0B,EAC1B,QAAgB,EAChB,GAA2B,EAC3B,GAAW;IAEX,iGAAiG;IACjG,uGAAuG;IACvG,4EAA4E;IAC5E,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC;IAC3B,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC;IAC3B,2FAA2F;IAC3F,8FAA8F;IAC9F,kGAAkG;IAClG,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC9C,qFAAqF;IACrF,kFAAkF;IAClF,GAAG,CAAC,oBAAoB,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI;QACrB,eAAe;QACf,oBAAoB;QACpB,gBAAgB;QAChB,eAAe;QACf,WAAW;KACZ,EAAE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,wFAAwF;IACxF,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;IACvB,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,WAAW;QAC/B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC7F,GAAG,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAC/F,GAAG,CAAC,KAAK,CACP,0FAA0F,CAC3F,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAExE,6FAA6F;IAC7F,4FAA4F;IAC5F,4FAA4F;IAC5F,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,WAAW;gBAC/B,YAAY,EAAE,oEAAoE;aACnF;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAmB,EACnB,IAAY,EACZ,QAAqB;IAErB,MAAM,mBAAmB,GACvB,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,CAAC;IAC3F,MAAM,UAAU,GACd,QAAQ,CAAC,gBAAgB;QACzB,QAAQ,CAAC,iBAAiB;QAC1B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,UAAU;QAAE,MAAM,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACnE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CACjC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAClC,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAClC,IAAI,EAAE,aAAa;QACnB,yFAAyF;QACzF,0EAA0E;QAC1E,KAAK,EAAE,OAAO;QACd,IAAI;QACJ,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC/C,KAAK,EAAE;YACL,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,QAAQ,CAAC,SAAS;YAC9B,QAAQ,EAAE,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW;YACrE,kBAAkB,EAAE,QAAQ,CAAC,gBAAgB;YAC7C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,4FAA4F;YAC5F,gEAAgE;YAChE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;YACzC,wFAAwF;YACxF,yFAAyF;YACzF,0FAA0F;YAC1F,mFAAmF;YACnF,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxF,GAAG,CAAC,UAAU;gBACZ,CAAC,CAAC;oBACE,eAAe,EAAE,KAAK;oBACtB,wBAAwB,EAAE,uCAAuC;iBAClE;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/E,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC5E,OAAO,EAAE,QAAQ,CAAC,cAAc;YAChC,KAAK,EAAE,QAAQ,CAAC,YAAY;YAC5B,SAAS,EAAE,QAAQ,CAAC,gBAAgB;SACrC;QACD,GAAG,CAAC,QAAQ,CAAC,gBAAgB;YAC3B,CAAC,CAAC;gBACE,eAAe,EAAE;oBACf,GAAG,cAAc;oBACjB;wBACE,IAAI,EAAE,UAAmB;wBACzB,QAAQ,EAAE,cAAc;wBACxB,IAAI,EAAE,eAAe;wBACrB,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,qCAAqC;qBAC9C;iBACF;aACF;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI;QACJ,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE;YACL,UAAU,EAAE,QAAQ,CAAC,SAAS;YAC9B,kBAAkB,EAAE,UAAU;YAC9B,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB;YAC5C,iBAAiB,EAAE,QAAQ,CAAC,SAAS;gBACnC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,QAAQ,CAAC,aAAa;oBACtB,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,WAAW;YACjB,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;YACzC,OAAO,EAAE,QAAQ,CAAC,eAAe;YACjC,KAAK,EAAE,QAAQ,CAAC,aAAa;YAC7B,kGAAkG;YAClG,iFAAiF;YACjF,GAAG,CAAC,QAAQ,CAAC,mBAAmB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACnD,SAAS,EAAE,QAAQ,CAAC,iBAAiB;YACrC,wFAAwF;YACxF,qGAAqG;YACrG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/E,0FAA0F;YAC1F,yFAAyF;YACzF,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,eAAe,EAAE,QAAQ,CAAC,cAAc;oBACxC,MAAM,EAAE,QAAQ,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;iBACzD,CAAC;YACN,WAAW,EAAE,QAAQ,CAAC,UAAU;SACjC;QACD,GAAG,CAAC,QAAQ,CAAC,iBAAiB;YAC5B,CAAC,CAAC;gBACE,eAAe,EAAE;oBACf,GAAG,eAAe;oBAClB;wBACE,IAAI,EAAE,UAAmB;wBACzB,QAAQ,EAAE,eAAe;wBACzB,IAAI,EAAE,eAAe;wBACrB,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,qCAAqC;qBAC9C;iBACF;aACF;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;KAC1E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAmB,EACnB,IAAY,EACZ,MAAoB;IAEpB,MAAM,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAClC,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,OAAO;QACd,IAAI;QACJ,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,4CAA4C;YACpD,kBAAkB,EAAE,IAAI;SACzB;QACD,eAAe,EAAE;YACf;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,oDAAoD;aAC7D;SACF;KACF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI;QACJ,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,MAAM,CAAC,aAAa;YACrC,eAAe,EAAE,MAAM,CAAC,aAAa;YACrC,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SAC/D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,6BAA6B,CAAC;IACrD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,UAAU;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,OAAyB;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,kBAAkB;YACrB,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAC/B,GAAG,MAAM;gBACT,KAAK,EACH,qGAAqG;gBACvG,MAAM,EAAE,gBAAgB,OAAO,CAAC,IAAI,yDAAyD;gBAC7F,IAAI,EAAE,qLAAqL;aAC5L,CAAC,CAAC;YACH,OAAO;QACT,KAAK,kBAAkB;YACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC9B,GAAG,MAAM;gBACT,KAAK,EAAE,yEAAyE;gBAChF,IAAI,EAAE,yHAAyH;aAChI,CAAC,CAAC;YACH,OAAO;QACT,KAAK,aAAa;YAChB,4FAA4F;YAC5F,4FAA4F;YAC5F,yCAAyC;YACzC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC1B,GAAG,MAAM;gBACT,MAAM,EAAE,+EAA+E;aACxF,CAAC,CAAC;YACH,OAAO;QACT,KAAK,iBAAiB;YACpB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC9B,GAAG,MAAM;gBACT,IAAI,EAAE,8EAA8E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,KAAK,SAAS;YACZ,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO;IACX,CAAC;AACH,CAAC"}

package/packages/cli/dist/upstream.d.ts

@@ -0,0 +1,29 @@
+import type { ParsedArgs } from './args.js';
+/**
+ * Where live model calls go, and what they carry.
+ *
+ * Needed by record *and* by replay: `--loose` and any fork continue live, and a fork that ignored
+ * the override would quietly talk to the real provider instead of the gateway the user pointed it
+ * at. Same precedence whichever command is running — flag, then environment, then the gateway from
+ * `agenticreplay setup`.
+ *
+ * The headers are the half that makes `agenticreplay setup` worth having: a gateway needs a key, and this
+ * is the only place one is attached. It goes on the *outbound* request only. What gets recorded is
+ * built from the incoming request with auth stripped, so a key agenticreplay injects cannot reach a trace
+ * by construction rather than by a rule someone has to remember.
+ */
+export interface UpstreamPlan {
+    upstream: Record<string, string> | undefined;
+    headers: Record<string, string> | undefined;
+    /**
+     * The origin the headers belong to, when they belong to one.
+     *
+     * The gateway key is attached per request rather than to every outbound call, because a
+     * forwarded request can legitimately go somewhere the gateway is not — a `/forward/` path names
+     * its own destination, and sending the gateway's credential there hands a third party a key
+     * they were never meant to see, which is the one outcome this plan exists to make impossible.
+     */
+    headersOrigin: string | undefined;
+}
+export declare function upstreamPlan(args: ParsedArgs, env?: NodeJS.ProcessEnv): Promise<UpstreamPlan>;
+//# sourceMappingURL=upstream.d.ts.map

package/packages/cli/dist/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAI5C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,YAAY,CAAC,CAwCvB"}