agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/upstream-visible.test.ts

@@ -1,314 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { TraceReader } from '@agenticreplay/core';
-import { parseArgs } from '../src/args.js';
-import { upstreamPlan } from '../src/upstream.js';
-import { writeConfig } from '../src/config.js';
-import { Output } from '../src/out.js';
-import { recordCommand, distinctOrigins } from '../src/commands/record.js';
-import { showCommand, upstreamsIn } from '../src/commands/inspect.js';
-import { startFakeModel } from './fixtures/fake-model.mjs';
-
-const run = promisify(execFile);
-const here = dirname(fileURLToPath(import.meta.url));
-const FAKE_AGENT = join(here, 'fixtures', 'fake-agent.mjs');
-
-/**
- * Where did the traffic go.
- *
- * The trace recorded what was sent and what came back, and never who answered — and `agenticreplay record`
- * printed `proxy=http://127.0.0.1:PORT`, which is agenticreplay's own address, not the model's. So the
- * question asked first of a recording that looks wrong could not be answered from the recording:
- * a gateway left behind in `~/.agenticreplay/config.json` redirects every run on the machine, and nothing
- * anywhere said so.
- *
- * Three surfaces, because the answer is wanted at three moments: on the line printed as the run
- * starts, in the trace, and in `agenticreplay show` when someone comes back to it later.
- */
-describe('a run says where its traffic went', () => {
-  let workspace: string;
-  let model: Awaited<ReturnType<typeof startFakeModel>>;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-upstream-'));
-    model = await startFakeModel();
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-    await run('git', ['init', '-q'], { cwd: workspace });
-    await run('git', ['config', 'user.email', 'test@example.com'], { cwd: workspace });
-    await run('git', ['config', 'user.name', 'Test'], { cwd: workspace });
-    await writeFile(join(workspace, 'auth.ts'), 'export const fixed = false;\n');
-    process.env.FAKE_AGENT_TURNS = '2';
-    delete process.env.FAKE_AGENT_CWD;
-  });
-
-  afterEach(async () => {
-    await model.close();
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  async function record() {
-    const args = parseArgs([
-      'record',
-      'generic-openai',
-      '--upstream-anthropic',
-      model.url,
-      '--',
-      'node',
-      FAKE_AGENT,
-    ]);
-    return recordCommand(args, out, workspace);
-  }
-
-  it('prints the upstream as the run starts, beside the proxy that is not it', async () => {
-    await record();
-    const recording = lines.find((l) => l.includes('recording'));
-
-    expect(recording, 'no recording line was printed at all').toBeDefined();
-    // Both, and the point is the pair: `proxy` is where the agent calls, `upstream` is where that
-    // call goes on to, and printing only the first is what made a redirected run look ordinary.
-    expect(recording).toMatch(/proxy=http:\/\/127\.0\.0\.1:\d+/);
-    expect(recording).toContain(`upstream=${model.url}`);
-  });
-
-  it('records on each exchange which origin answered it', async () => {
-    const result = await record();
-    const reader = await TraceReader.open(result.runDir);
-    const responses = (await reader.events()).filter((e) => e.type === 'model.response');
-
-    expect(responses.length).toBeGreaterThan(0);
-    for (const response of responses) {
-      expect(response.attrs?.['upstream'], `seq ${response.seq} does not say who answered`).toBe(
-        model.url,
-      );
-    }
-  });
-
-  it('answers it in agenticreplay show, where someone comes back to the run later', async () => {
-    const result = await record();
-    lines.length = 0;
-    await showCommand(parseArgs(['show', result.runId]), out, workspace);
-
-    expect(lines.join('')).toContain(`upstream ${model.url}`);
-  });
-});
-
-/**
- * `resolveUpstream` writes one entry per dialect, and `openai` and `openai-responses` always carry
- * the same value — so the raw map renders one gateway twice on a line meant to be read at a glance.
- */
-describe('distinctOrigins', () => {
-  it('collapses the dialects that share an origin', () => {
-    expect(
-      distinctOrigins({
-        openai: 'https://gw.example',
-        'openai-responses': 'https://gw.example',
-        anthropic: 'https://gw.example',
-      }),
-    ).toEqual(['https://gw.example']);
-  });
-
-  it('keeps a run that really does reach two places as two', () => {
-    // Naming one dialect's origin leaves the other on whatever was configured before it, which is
-    // exactly the case the line exists to make visible.
-    expect(
-      distinctOrigins({
-        openai: 'http://127.0.0.1:4000',
-        'openai-responses': 'http://127.0.0.1:4000',
-        anthropic: 'https://gw.example',
-      }),
-    ).toEqual(['http://127.0.0.1:4000', 'https://gw.example']);
-  });
-
-  it('says nothing when nothing was configured', () => {
-    // Not `['default']` or an empty string: each dialect has its own vendor default, so there is
-    // no single value to print, and `upstream=` on every ordinary run would train people to skip
-    // the line. The trace still records the resolved origin per exchange.
-    expect(distinctOrigins(undefined)).toEqual([]);
-  });
-});
-
-describe('upstreamsIn', () => {
-  it('reads the origins off the responses, first seen first', () => {
-    expect(
-      upstreamsIn([
-        { type: 'model.response', attrs: { upstream: 'https://a.example' } },
-        { type: 'model.request', attrs: {} },
-        { type: 'model.response', attrs: { upstream: 'https://b.example' } },
-        { type: 'model.response', attrs: { upstream: 'https://a.example' } },
-      ]),
-    ).toEqual(['https://a.example', 'https://b.example']);
-  });
-
-  /**
-   * A trace is something you are given, so it is sanitised on the way out of the file too.
-   *
-   * The write path strips the credential now, but a trace recorded by a build from between the
-   * first commit of this branch and the one that added the stripping carries one — and `agenticreplay show`
-   * printed it back. Found by hand-editing an `upstream` attribute and running `agenticreplay show`, which
-   * is also what a trace someone hands you looks like.
-   */
-  it('strips a credential out of an upstream a trace already holds', () => {
-    expect(
-      upstreamsIn([
-        { type: 'model.response', attrs: { upstream: 'https://u:TRACELEAK@gw.example/v1' } },
-        { type: 'model.response', attrs: { upstream: 'https://gw.example/v1?key=TRACELEAK' } },
-      ]),
-      'both spellings collapse to the origin, and neither carries the secret',
-    ).toEqual(['https://gw.example/v1']);
-  });
-
-  /**
-   * The case the comment above this test used to name while the input tested something else.
-   *
-   * `'not a url'` fails `new URL` and is dropped by any version of this function, so it passed
-   * against a body that had no `unusableOrigin` guard at all. The shape that needed asserting is
-   * the one that *parses*: a scheme-less URL whose username becomes the protocol.
-   */
-  it.each([
-    {
-      what: 'the username parses as the protocol',
-      upstream: 'myuser:PASSWORD@gw.example/v1',
-      secret: 'PASSWORD',
-    },
-    { what: 'the scheme is not http', upstream: 'mailto:someone@gw.example', secret: 'someone' },
-    { what: 'it is not a URL at all', upstream: 'not a url', secret: undefined },
-  ])('drops an upstream with no readable origin: $what', ({ upstream, secret }) => {
-    const out = upstreamsIn([{ type: 'model.response', attrs: { upstream } }]);
-    expect(out).toEqual([]);
-    if (secret !== undefined) expect(JSON.stringify(out)).not.toContain(secret);
-  });
-
-  it('is empty for a trace recorded before agenticreplay wrote this down', () => {
-    // Which is why `agenticreplay show` prints no line at all rather than "upstream unknown": absence here
-    // is an old trace, and a run that reached nothing has no model.response to read anyway.
-    expect(upstreamsIn([{ type: 'model.response', attrs: { model: 'x' } }])).toEqual([]);
-  });
-});
-
-/**
- * And the line must not print the gateway's key back.
- *
- * `config.ts` says of the file that holds it: "nothing ever prints it back". A gateway that
- * authenticates by URL is configured as `https://user:pw@gw.example` or `https://gw.example?key=…`,
- * so a line rendering the configured upstream verbatim is printing it back — onto a terminal, and
- * into every CI log that captures one.
- */
-describe('distinctOrigins keeps a credential off the line', () => {
-  const SECRET = 'SUPERSECRET';
-
-  it('strips userinfo and query from what is printed', () => {
-    const printed = distinctOrigins({
-      openai: `https://u:${SECRET}@gw.example`,
-      'openai-responses': `https://u:${SECRET}@gw.example`,
-      anthropic: `https://gw.example?key=${SECRET}`,
-    }).join(',');
-
-    expect(printed).not.toContain(SECRET);
-    // And still says the thing it is there to say.
-    expect(printed).toBe('https://gw.example');
-  });
-
-  /**
-   * The shape that is refused rather than stripped, asserted here because this is the filter that
-   * used to be trusted to make it safe.
-   *
-   * A gateway typed without a scheme parses with the username as the protocol, so
-   * `recordableOrigin` returns a value — `myuser://SUPERSECRET@gw.example` — and a filter keeping
-   * everything `!== undefined` kept it. It cannot be sanitised into an origin, because there is no
-   * telling which half of `a:b` was meant as the host, so `upstreamPlan` refuses it before any of
-   * this runs. Kept as a unit assertion too: this filter should not be the only thing standing
-   * between that value and the line.
-   */
-  it('does not pass a scheme-less URL whose username parses as the protocol', () => {
-    const printed = distinctOrigins({ openai: `myuser:${SECRET}@gw.example/v1` }).join(',');
-    expect(printed, 'refused upstream reached the printed line').not.toContain(SECRET);
-  });
-
-  it('collapses to one entry once the differing secrets are gone', () => {
-    // Two config values that differ only by credential are one destination. Printing them as two
-    // would say a run reaches two places when it reaches one.
-    expect(
-      distinctOrigins({
-        openai: `https://gw.example?key=${SECRET}`,
-        anthropic: 'https://gw.example',
-      }),
-    ).toEqual(['https://gw.example']);
-  });
-});
-
-/**
- * An upstream that is not an origin, from each of the three places one can come from.
- *
- * `agenticreplay setup` refuses one on the way in, and that left three doors open: a config written before
- * it did, an environment variable, and a flag. On the record path the value is not only sent but
- * *printed* — on the recording line, and inside undici's TypeError when `doFetch` cannot parse it,
- * which the proxy hands to the agent as a 500 body. Asserted on the message rather than on a field
- * because both leaks were "the sanitiser handled the shape it was written against".
- */
-describe('upstreamPlan refuses an upstream that is not an origin', () => {
-  const SECRET = 'SUPERSECRET';
-  let home: string;
-
-  beforeEach(async () => {
-    home = await mkdtemp(join(tmpdir(), 'agenticreplay-upstream-'));
-  });
-  afterEach(async () => {
-    await rm(home, { recursive: true, force: true });
-  });
-
-  // Only the shapes that cannot be an origin at all. A query-authenticated gateway works and a
-  // userinfo one is sanitisable, so both are sent and stripped from every display rather than
-  // refused — see setup.test.ts, which pins that half.
-  const shapes = [
-    { what: 'no scheme at all', url: `my.gateway.example?key=${SECRET}` },
-    { what: 'no scheme, username read as one', url: `myuser:${SECRET}@gw.example/v1` },
-  ];
-
-  it.each(shapes)('from --upstream-openai: $what', async ({ url }) => {
-    const call = () =>
-      upstreamPlan(parseArgs(['record', '--upstream-openai', url]), { XDG_CONFIG_HOME: home });
-    await expect(call()).rejects.toThrow(/is not an origin agenticreplay can use/);
-    await expect(call()).rejects.not.toThrow(new RegExp(SECRET));
-  });
-
-  it.each(shapes)('from AGENTICREPLAY_UPSTREAM_OPENAI: $what', async ({ url }) => {
-    const env = { XDG_CONFIG_HOME: home, AGENTICREPLAY_UPSTREAM_OPENAI: url };
-    await expect(upstreamPlan(parseArgs(['record']), env)).rejects.toThrow(
-      /is not an origin agenticreplay can use/,
-    );
-  });
-
-  it.each(shapes)('from the gateway in a hand-edited config: $what', async ({ url }) => {
-    // readConfig deliberately accepts a hand-edited file, and a config written by a pre-change
-    // `agenticreplay setup` holds whatever it was handed.
-    const env = { XDG_CONFIG_HOME: home };
-    await writeConfig({ gateway: { url, api_key_env: 'FAKE_KEY' } }, env);
-    await expect(upstreamPlan(parseArgs(['record']), env)).rejects.toThrow(
-      /is not an origin agenticreplay can use/,
-    );
-  });
-
-  it('sends a query-authenticated gateway rather than refusing it', async () => {
-    // The regression this narrowing undoes: refusing this broke a configuration that works.
-    const env = { XDG_CONFIG_HOME: home };
-    await writeConfig({ gateway: { url: `https://gw.example/v1?key=${SECRET}` } }, env);
-    const plan = await upstreamPlan(parseArgs(['record']), env);
-    expect(plan.upstream?.openai).toBe(`https://gw.example/v1?key=${SECRET}`);
-    // And it is the display that keeps it quiet, asserted next door in distinctOrigins.
-  });
-
-  it('lets an ordinary gateway through, so the guard is not refusing everything', async () => {
-    const env = { XDG_CONFIG_HOME: home };
-    await writeConfig({ gateway: { url: 'https://gw.example/team-a/v1' } }, env);
-    const plan = await upstreamPlan(parseArgs(['record']), env);
-    expect(plan.upstream?.openai).toBe('https://gw.example/team-a/v1');
-  });
-});

package/packages/cli/test/vercel-sdk-e2e.test.ts

@@ -1,105 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { TraceReader } from '@agenticreplay/core';
-import { validateEvent } from '@agenticreplay/schema';
-import { parseArgs } from '../src/args.js';
-import { Output } from '../src/out.js';
-import { recordCommand } from '../src/commands/record.js';
-import { replayCommand } from '../src/commands/replay.js';
-import { startResponsesModel } from './fixtures/responses-model.mjs';
-
-const run = promisify(execFile);
-const here = dirname(fileURLToPath(import.meta.url));
-const AGENT = join(here, 'fixtures', 'vercel-agent.mjs');
-
-/**
- * An agent that reads no base-URL variable, recorded anyway.
- *
- * This is the last of the five named integrations, and the only one that could not be reached by
- * setting an environment variable — its origin is compiled into source. The pair of tests below
- * is the whole point: the same agent, the same fixture, one adapter that captures it and one
- * that cannot.
- */
-describe('end to end: an agent with a hardcoded provider origin', () => {
-  let workspace: string;
-  let model: Awaited<ReturnType<typeof startResponsesModel>>;
-  let out: Output;
-  let lines: string[];
-
-  beforeEach(async () => {
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-vercel-'));
-    model = await startResponsesModel();
-    lines = [];
-    out = new Output({ write: (s) => void lines.push(s), isTTY: false });
-    await run('git', ['init', '-q'], { cwd: workspace });
-    await run('git', ['config', 'user.email', 'test@example.com'], { cwd: workspace });
-    await run('git', ['config', 'user.name', 'Test'], { cwd: workspace });
-    await writeFile(join(workspace, 'auth.ts'), 'export const fixed = false;\n');
-    process.env.VERCEL_AGENT_TIMEOUT_MS = '1500';
-  });
-
-  afterEach(async () => {
-    await model.close();
-    await rm(workspace, { recursive: true, force: true });
-    delete process.env.VERCEL_AGENT_TIMEOUT_MS;
-  });
-
-  const record = (adapter: string) =>
-    recordCommand(
-      parseArgs(['record', adapter, '--upstream-openai', model.url, '--', process.execPath, AGENT]),
-      out,
-      workspace,
-    );
-
-  it('captures nothing under an adapter that only sets environment variables', async () => {
-    // The control. Not a strawman: this is what `agenticreplay record` did for every AI SDK agent.
-    await record('generic-openai');
-
-    expect(model.calls).toHaveLength(0);
-    const warning = lines.find((l) => l.includes('capture.empty'));
-    expect(warning).toBeDefined();
-  });
-
-  it('captures the run under the node adapter', async () => {
-    const result = await record('node');
-
-    expect(model.calls.length).toBeGreaterThan(0);
-    expect(model.calls[0]!.url).toBe('/v1/responses');
-    expect(lines.find((l) => l.includes('capture.empty'))).toBeUndefined();
-    expect(result.exitCode).toBe(0);
-  });
-
-  it('captures the turn the agent made through a Request object, not just the string one', async () => {
-    // Two turns: the first passes a URL string, the second a Request. A hook that rewrites only
-    // strings captures exactly half a run and looks like it worked.
-    await record('node');
-    expect(model.calls.length).toBe(2);
-  });
-
-  it('writes a schema-valid trace with the tool call and the file it changed', async () => {
-    const result = await record('node');
-    const events = await (await TraceReader.open(result.runDir)).events();
-    for (const event of events) {
-      expect(validateEvent(event).valid, JSON.stringify(event).slice(0, 160)).toBe(true);
-    }
-    expect(events.filter((e) => e.type === 'tool.call')[0]?.attrs?.name).toBe('edit_file');
-    expect(await readFile(join(workspace, 'auth.ts'), 'utf8')).toContain('fixed = true');
-  });
-
-  it('replays offline, which is the whole reason to have captured it', async () => {
-    const result = await record('node');
-    const before = model.calls.length;
-
-    const replay = await replayCommand(parseArgs(['replay', result.runId]), out, workspace);
-
-    expect(replay.exitCode).toBe(0);
-    expect(replay.canonicalExact).toBe(2);
-    expect(replay.liveCalls).toBe(0);
-    expect(model.calls.length).toBe(before);
-  });
-});

package/packages/cli/test/version.test.ts

@@ -1,20 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { describe, expect, it } from 'vitest';
-import { AGENTICREPLAY_VERSION } from '../src/version.js';
-
-/**
- * `npm version --workspaces` moves package.json and nothing else, so the constant the CLI prints
- * — and stamps into every trace's `agenticreplay_version` — silently keeps the previous release's number.
- * 0.2.0 shipped saying 0.1.2.
- *
- * The existing assertion in api.test.ts compares the constant against itself, so it cannot catch
- * this. This one compares it against the manifest npm actually publishes.
- */
-describe('AGENTICREPLAY_VERSION', () => {
-  it('matches the version npm publishes', () => {
-    const manifest = fileURLToPath(new URL('../package.json', import.meta.url));
-    const { version } = JSON.parse(readFileSync(manifest, 'utf8')) as { version: string };
-    expect(AGENTICREPLAY_VERSION).toBe(version);
-  });
-});

package/packages/cli/tsconfig.json

@@ -1,40 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src/**/*.ts"],
-  "references": [
-    {
-      "path": "../schema"
-    },
-    {
-      "path": "../plugin-api"
-    },
-    {
-      "path": "../core"
-    },
-    {
-      "path": "../proxy"
-    },
-    {
-      "path": "../providers"
-    },
-    {
-      "path": "../adapters"
-    },
-    {
-      "path": "../fs-capture"
-    },
-    {
-      "path": "../viewer"
-    },
-    {
-      "path": "../mcp-shim"
-    },
-    {
-      "path": "../shell-shim"
-    }
-  ]
-}

package/packages/core/package.json

@@ -1,26 +0,0 @@
-{
-  "name": "@agenticreplay/core",
-  "version": "0.5.0",
-  "type": "module",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/askdkc/AgenticReplay.git",
-    "directory": "packages/core"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": "./dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "dependencies": {
-    "@agenticreplay/plugin-api": "0.5.0",
-    "@agenticreplay/schema": "0.5.0"
-  },
-  "engines": {
-    "node": ">=24.0.0"
-  }
-}

package/packages/core/src/blobs.ts

@@ -1,109 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import type { BlobRef } from '@agenticreplay/schema';
-
-/** Traces are sensitive material (design §7), so nothing is group- or world-readable. */
-const FILE_MODE = 0o600;
-const DIR_MODE = 0o700;
-
-const HEX64 = /^[0-9a-f]{64}$/;
-const PREFIX = 'sha256:';
-
-/** Accepts `sha256:<hex>` or a bare hex digest and returns the bare hex. */
-function bareDigest(ref: BlobRef | string): string {
-  const raw = typeof ref === 'string' ? ref : ref.$blob;
-  const hex = raw.startsWith(PREFIX) ? raw.slice(PREFIX.length) : raw;
-  if (!HEX64.test(hex)) throw new Error(`invalid blob digest: ${JSON.stringify(raw)}`);
-  return hex;
-}
-
-function toBytes(data: Uint8Array | string): Uint8Array {
-  return typeof data === 'string' ? new Uint8Array(Buffer.from(data, 'utf8')) : data;
-}
-
-/**
- * Content-addressed blob store, laid out as `<dir>/<first two hex>/<full hex>` (spec §2.2).
- *
- * Every model turn resends the whole conversation, so identical content arrives over and over.
- * Addressing by digest is what keeps a trace O(n) in new content instead of O(n²) in turns —
- * hence `put` of existing content must not touch the file at all.
- */
-export class BlobStore {
-  readonly #dir: string;
-
-  /** @param dir The blob root, conventionally `<runDir>/blobs`. */
-  constructor(dir: string) {
-    this.#dir = dir;
-  }
-
-  get dir(): string {
-    return this.#dir;
-  }
-
-  async put(data: Uint8Array | string, mediaType?: string): Promise<BlobRef> {
-    const bytes = toBytes(data);
-    const hex = createHash('sha256').update(bytes).digest('hex');
-    const ref: BlobRef = { $blob: `${PREFIX}${hex}`, bytes: bytes.byteLength };
-    if (mediaType !== undefined) ref.media_type = mediaType;
-
-    const shard = join(this.#dir, hex.slice(0, 2));
-    const path = join(shard, hex);
-    if (await exists(path)) return ref;
-
-    await mkdir(shard, { recursive: true, mode: DIR_MODE });
-    // Write then rename so a reader never sees a half-written blob under its final digest.
-    const tmp = `${path}.${randomBytes(6).toString('hex')}.tmp`;
-    try {
-      await writeFile(tmp, bytes, { mode: FILE_MODE, flag: 'wx' });
-      await rename(tmp, path);
-    } finally {
-      await rm(tmp, { force: true });
-    }
-    return ref;
-  }
-
-  async get(ref: BlobRef | string): Promise<Uint8Array> {
-    const hex = bareDigest(ref);
-    const path = join(this.#dir, hex.slice(0, 2), hex);
-    let buf: Buffer;
-    try {
-      buf = await readFile(path);
-    } catch {
-      throw new Error(`blob not found: ${PREFIX}${hex} (looked in ${path})`);
-    }
-    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-  }
-
-  async has(digest: BlobRef | string): Promise<boolean> {
-    const hex = bareDigest(digest);
-    return exists(join(this.#dir, hex.slice(0, 2), hex));
-  }
-
-  async count(): Promise<number> {
-    let n = 0;
-    for (const shard of await readdir(this.#dir, { withFileTypes: true }).catch(() => [])) {
-      if (!shard.isDirectory()) continue;
-      const files = await readdir(join(this.#dir, shard.name)).catch(() => []);
-      n += files.filter((f) => HEX64.test(f)).length;
-    }
-    return n;
-  }
-}
-
-/** SHA-256 of a whole file, streamed — this is the integrity root of a run (spec §6). */
-export async function sha256File(path: string): Promise<string> {
-  const hash = createHash('sha256');
-  for await (const chunk of createReadStream(path)) hash.update(chunk as Buffer);
-  return hash.digest('hex');
-}
-
-async function exists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}

package/packages/core/src/fetch.ts

@@ -1,48 +0,0 @@
-/**
- * fetch with the DESTINATION PINNED — a redirect is a hard failure, never a hand-off.
- *
- * THE ORIGIN CHECK VALIDATES THE URL WE PASS, NOT THE URL THE REQUEST REACHES (orcacode-review).
- * `resolveGateway` decides whether the key may go to this host, and then `fetch` was free to follow
- * a `Location` anywhere. undici strips `authorization` across origins but NOT `x-api-key`, and
- * gatewayHeaders sets both to the same key — so one header from whoever answers for the gateway
- * carried the replay-scoped credential to a host it was never issued for, defeating the promise the
- * README makes in writing: "Never a key to a host it was not set up for."
- *
- * Push had a second failure on top: a 301/302/303 is re-issued as a GET with no body, so the
- * target's 200 satisfied `res.ok` and the CLI printed `push.done` for a run that went nowhere. A
- * 307/308 instead failed with an opaque "fetch failed", because undici cannot replay a detached
- * body — so a legitimately redirecting gateway could not be talked to either.
- *
- * `manual` rather than `error`: Node resolves it with the real status and Location, so the refusal
- * can NAME the destination. `error` rejects with a bare TypeError whose only distinguishing mark is
- * an undici-internal cause string ("unexpected redirect"), which a genuine connection failure
- * ("bad port") is indistinguishable from without matching on that string.
- *
- * Following a same-origin redirect would be safe and is deliberately not implemented: no gateway
- * this CLI talks to issues one, and an unused branch that forwards credentials is the wrong thing
- * to carry.
- *
- * IT LIVES IN core, NOT IN THE PACKAGE THAT FIRST NEEDED IT (orcacode-review, twice).
- *
- * The first version was local to the CLI's sync.ts, so push and pull were pinned and `probeModels`
- * — the third request carrying the same header pair — was not. The second lived beside
- * gatewayHeaders in the CLI's config.ts, which fixed that and left the RECORDING PROXY out: it is
- * handed the very same credential as `upstreamHeaders` and attaches it to both of its live call
- * sites, on the path every `agenticreplay record` / `replay --loose` / `compare` / fork takes.
- *
- * Both times the pin sat in the package that noticed the problem rather than in the one every
- * carrier of the credential depends on. core is that package, so this is the last place it can
- * move to.
- */
-export async function fetchPinned(target: string, init: RequestInit): Promise<Response> {
-  const res = await fetch(target, { ...init, redirect: 'manual' });
-  if (res.status >= 300 && res.status < 400) {
-    const to = res.headers.get('location') ?? '(no Location header)';
-    throw new Error(
-      `${target} answered ${res.status} redirecting to ${to}. agenticreplay does not follow it: your key is ` +
-        `attached to the host you named, and following would hand it to whatever answers there. ` +
-        `Point --gateway (or AGENTICREPLAY_GATEWAY_URL) at the final address instead.`,
-    );
-  }
-  return res;
-}