agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/proxy/dist/server.js

@@ -0,0 +1,2291 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createServer } from 'node:http';
+import { AUTH_REQUEST_HEADERS, AUTH_RESPONSE_HEADERS, BINARY_BODY_PREFIX, Redactor, fetchPinned, } from '@agenticreplay/core';
+import { anthropicToCanonicalRequest, anthropicToCanonicalResponse, canonicalToAnthropicRequest, canonicalToAnthropicResponse, canonicalToAnthropicSse, canonicalToOpenaiRequest, canonicalToOpenaiResponse, canonicalToOpenaiSse, canonicalToResponsesRequest, canonicalToResponsesResponse, canonicalToResponsesSse, openaiToCanonicalRequest, openaiToCanonicalResponse, parseAnthropicSse, parseOpenaiSse, parseResponsesSse, responsesToCanonicalRequest, responsesToCanonicalResponse, } from '@agenticreplay/providers';
+import { anthropicDialect, codexDialect, openaiDialect, responsesDialect, selectDialect, } from './dialects.js';
+import { decodeForwardPath } from './forward.js';
+import { consume, defaultRetrievalRules, indexRetrievals, selectRetrievalRule, } from './retrieval.js';
+import { attachTlsIntercept, decodeBody, DEFAULT_MAX_CAPTURED_BYTES, } from './intercept.js';
+import { RequestMatcher } from './matching.js';
+function scalarHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        out[key] = Array.isArray(value) ? value.join(', ') : value;
+    }
+    return out;
+}
+function captureHeaderTransformations(original, recorded) {
+    const excluded = Object.keys(original).filter((name) => !(name in recorded));
+    if (excluded.length === 0)
+        return [];
+    return [
+        {
+            kind: 'header_excluded',
+            location: 'request.headers',
+            rule: 'authentication-and-hop-by-hop-header-exclusion',
+            count: excluded.length,
+            reason: excluded
+                .map((name) => name.toLowerCase())
+                .sort()
+                .join(', '),
+        },
+    ];
+}
+function captureResponseHeaders(headers, decoded = false) {
+    const result = {};
+    headers.forEach((value, name) => {
+        const key = name.toLowerCase();
+        if (AUTH_RESPONSE_HEADERS.includes(key))
+            return;
+        if (decoded && (key === 'content-encoding' || key === 'content-length'))
+            return;
+        result[key] = value;
+    });
+    return result;
+}
+function captureResponseHeaderTransformations(headers) {
+    const excluded = [];
+    headers.forEach((_value, name) => {
+        if (AUTH_RESPONSE_HEADERS.includes(name.toLowerCase()))
+            excluded.push(name.toLowerCase());
+    });
+    return [
+        ...(excluded.length === 0
+            ? []
+            : [
+                {
+                    kind: 'header_excluded',
+                    location: 'response.headers',
+                    rule: 'authentication-header-exclusion',
+                    count: excluded.length,
+                    reason: [...new Set(excluded)].sort().join(', '),
+                },
+            ]),
+        {
+            kind: 'encoding',
+            location: 'response.headers',
+            rule: 'fetch-headers-boundary-normalization',
+            count: 1,
+            reason: 'fetch Headers lowercases names and combines repeated fields before capture',
+        },
+    ];
+}
+function captureEncodingTransformation(location, encoding) {
+    const values = (encoding ?? '')
+        .split(',')
+        .map((value) => value.trim().toLowerCase())
+        .filter((value) => value !== '' && value !== 'identity');
+    if (values.length === 0)
+        return [];
+    return [
+        {
+            kind: 'decompression',
+            location,
+            rule: 'content-encoding',
+            count: values.length,
+            reason: values.join(', '),
+        },
+    ];
+}
+function protocolTranslationTransformation(from, to, location = 'response.body') {
+    return {
+        kind: 'encoding',
+        location,
+        rule: 'provider-protocol-translation',
+        count: 1,
+        reason: `${from} response translated to ${to} for the client`,
+    };
+}
+function modelOverrideTransformation(from, to) {
+    return {
+        kind: 'encoding',
+        location: 'request.body',
+        rule: 'model-override-and-serialization',
+        count: 1,
+        reason: `${from} request model overridden with ${to} and serialized for the live fork`,
+    };
+}
+function captureUrlTransformations(origin) {
+    const scrubbed = recordableOrigin(origin);
+    if (scrubbed === undefined || scrubbed === origin)
+        return [];
+    return [
+        {
+            kind: 'url_scrubbed',
+            location: 'destination.url',
+            rule: 'credential-and-query-secret-scrub',
+            count: 1,
+            reason: 'destination credentials or secret query parameters removed before persistence',
+        },
+    ];
+}
+function binaryBodyTransformation(location, body) {
+    if (!body.startsWith(BINARY_BODY_PREFIX))
+        return [];
+    return [
+        {
+            kind: 'encoding',
+            location,
+            rule: 'binary-body-base64-persistence',
+            count: 1,
+            reason: 'invalid UTF-8 preserved as base64 because the transport body is binary',
+        },
+    ];
+}
+/**
+ * Beta flags that belong to the model that was recorded, not to the request.
+ *
+ * `anthropic-beta` is a header, so substituting a model in the body leaves it untouched — and a
+ * fork of a run made on a 1M-context model onto one without that entitlement comes back
+ * `400 The long context beta is not yet available for this subscription`. The failure names the
+ * subscription rather than the flag, so it reads as an account problem and not as agenticreplay carrying
+ * over something it should have dropped.
+ *
+ * Only entitlement-gated flags are removed. The rest of the header is what the harness needs to
+ * speak its own protocol — tool shapes, output formats — and dropping those would break the fork
+ * in a way that is much harder to see than a 400.
+ */
+const MODEL_GATED_BETAS = [/^context-\d+m\b/i];
+/** `anthropic-beta` with the recorded model's entitlements taken out, or undefined if empty. */
+export function betasForModelChange(value) {
+    const kept = value
+        .split(',')
+        .map((flag) => flag.trim())
+        .filter((flag) => flag !== '' && !MODEL_GATED_BETAS.some((re) => re.test(flag)));
+    return kept.length > 0 ? kept.join(',') : undefined;
+}
+/** The outbound headers for a live call, reconciled with a model the recording did not use. */
+function headersForModel(headers, forkModel) {
+    if (forkModel === undefined)
+        return headers;
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== 'anthropic-beta') {
+            out[key] = value;
+            continue;
+        }
+        const kept = betasForModelChange(value);
+        if (kept !== undefined)
+            out[key] = kept;
+    }
+    return out;
+}
+/**
+ * An origin with the parts a credential rides in taken out.
+ *
+ * `agenticreplay setup --gateway` accepts whatever URL it is handed and stores it in `~/.agenticreplay/config.json`,
+ * and a gateway that authenticates by URL rather than by header is handed one that carries the key:
+ * `https://user:pw@gw.example` or `https://gw.example?key=…`. The proxy has to *send* that — it is
+ * how the request authenticates — but recording it verbatim would have written the key into every
+ * trace made on that machine, breaking the promise stated where the key is read:
+ *
+ *   > the proxy adds it to the outbound request only, while what gets recorded is derived from the
+ *   > *incoming* request with auth stripped, so a gateway key agenticreplay injects is invisible to the
+ *   > recording by construction rather than by a rule someone has to remember.
+ *
+ * So the stripping happens here, in the one place an exchange is built, rather than at each call
+ * site — for the same reason that sentence gives.
+ *
+ * The path is kept. It is not a credential, and it is load-bearing: a gateway serving tenants at
+ * `/team-a/v1` and `/team-b/v1` answers from two different places, and the exchange's own `path`
+ * is the *client's* (`/chat/completions`), not the upstream's base. Only userinfo, query and
+ * fragment come out.
+ *
+ * An origin that will not parse is dropped rather than passed through: it cannot be sanitised, and
+ * absent already means "not recorded".
+ */
+export function recordableOrigin(origin) {
+    if (origin === undefined)
+        return undefined;
+    try {
+        const url = new URL(origin);
+        const port = url.port === '' ? '' : `:${url.port}`;
+        // `new URL('https://h').pathname` is '/', which is not part of how anyone writes an origin.
+        const path = url.pathname === '/' ? '' : url.pathname.replace(/\/$/, '');
+        return `${url.protocol}//${url.hostname}${port}${path}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Why a string cannot be used as an origin at all, or nothing if it can.
+ *
+ * Narrower than it first was, because the first version refused configurations that work. A
+ * gateway that authenticates by query — `https://gw.example/v1?key=…` — is an ordinary way to
+ * configure one, and undici sends it without complaint; refusing it broke a working setup to close
+ * a leak that was never about sending. Userinfo is the same story one step along: undici does
+ * reject `https://u:pw@gw` at request time, but it is *sanitisable* — {@link recordableOrigin}
+ * removes it cleanly — and the recording path already accepts it and keeps it out of the trace.
+ *
+ * What is left is the case where there is nothing to sanitise, because there is no origin. A
+ * gateway typed without a scheme parses with the username as the protocol:
+ *
+ *     new URL('myuser:PASSWORD@gw.example/v1')   // protocol 'myuser:', pathname the rest
+ *
+ * so {@link recordableOrigin} answers `myuser://PASSWORD@gw.example/v1` — a value, which means a
+ * caller guarding with `?? url` never notices, and the password is on the line anyway. There is no
+ * fixing that by rewriting: with no scheme there is no telling which half of `a:b` was meant as
+ * the host. And nothing refused here could have worked — undici cannot parse it either.
+ */
+export function unusableOrigin(origin) {
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return 'it is not a URL — an origin needs a scheme, like https://gateway.example';
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        // Named without echoing the value: a scheme-less URL puts the username here, so `protocol` is
+        // the one part of it that is safe to quote back.
+        return `its scheme is "${url.protocol.replace(/:$/, '')}" — an origin has to be http or https`;
+    }
+    return undefined;
+}
+/**
+ * Free text with the credential taken out of any URL it names.
+ *
+ * For error messages, which nobody composes and everybody prints. A failed `fetch` reports the URL
+ * it was given, so an origin configured as `https://user:pw@gw` or `https://gw?key=…` arrives
+ * inside the exception text and goes straight to a terminal:
+ *
+ *     warn gateway.unreachable why="Request cannot be constructed from a URL that includes
+ *       credentials: http://someone:PASSWORD@127.0.0.1:50164/v1/models"
+ *
+ * {@link recordableOrigin} cannot help there — it takes a URL, and this is prose with a URL in it.
+ *
+ * The query goes as well as the userinfo. That loses the occasional harmless parameter from an
+ * error message, which is the right trade: a key in a query is the commonest way a gateway
+ * authenticates by URL, and an error string is not where anyone should be reading parameters back.
+ */
+export function withoutCredentials(text) {
+    return (text
+        // Up to the *last* `@` before the path, not the first. `[^/\s@]*` could not cross an `@`, so
+        // an ordinary password containing one — `p@ssw0rd` — ended the match early and the remainder
+        // stayed in userinfo position: `https://myuser:p@ssw0rd@gw` came out as `https://ssw0rd@gw`.
+        // `[^\s/]*` may cross `@` and backtracks to the last one, and still cannot reach past the
+        // path, so an `@` in a path segment (`/v1/@scope/pkg`) is not mistaken for userinfo.
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/]*@/gi, '$1')
+        .replace(/([a-z][a-z0-9+.-]*:\/\/[^\s?#"']*)\?[^\s#"']*/gi, '$1')
+        // And once more without a scheme. undici reports an origin it could not parse verbatim —
+        // `Failed to parse URL from my.gateway.example?key=…` — and both rules above need a
+        // `scheme://` to fire, so that string went through untouched into the 500 body the agent
+        // prints. A host-shaped token is one with a dot in it and no whitespace. The cost is that
+        // an error naming a file ending in '?' loses the question mark, which is a fair price in
+        // prose nobody reads for punctuation.
+        .replace(/([a-z0-9][a-z0-9.-]*\.[a-z][a-z0-9-]*(?::\d+)?[^\s?#"']*)\?[^\s#"']*/gi, '$1'));
+}
+/**
+ * An origin agenticreplay could not parse, reduced to the host it names and nothing else.
+ *
+ * Three rounds of review here, each finding a shape the last one let through, and the lesson is
+ * the same each time: a string no parser accepted has no structure to rely on, so nothing may be
+ * kept because of where it sits — only because of what it is made of.
+ *
+ * `withoutCredentials` went first. It is written for prose and its rules need prose shapes: a
+ * dotted host for the scheme-less query rule, no whitespace inside userinfo. `gw?key=SECRET123`,
+ * `localhost?key=…`, `192.168.0.1?key=…` and `https://user:pa ss@gw` all went through it whole.
+ *
+ * Cutting by position went second, and left `https://gw key=SECRET123`: a secret in a
+ * whitespace-separated token after the host is still "after the last `@`", so it was kept as part
+ * of the host.
+ *
+ * So the last step is a whitelist — the characters a host and a port are made of, and the first
+ * one that is not ends it. A path is not returned at all: the success branch of `originParts`
+ * gives `url.hostname`, the exchange records its request path in its own field, and a path that
+ * reached here unparsed could carry a secret as easily as a query could.
+ *
+ * An origin with no host left — `https://user:pass@` — yields the empty string, which is the
+ * honest answer: there was no host in it to name.
+ *
+ * `redactString` still runs over the result at the call site, as a backstop for a long key rather
+ * than the thing doing the work: its shape rules and 20-character entropy floor catch neither
+ * `hunter2` nor `SECRET123`.
+ */
+export function scrubOrigin(origin) {
+    const withoutQuery = origin.replace(/[?#][\s\S]*$/, '');
+    const schemeEnd = withoutQuery.indexOf('://');
+    const rest = schemeEnd === -1 ? withoutQuery : withoutQuery.slice(schemeEnd + 3);
+    const pathStart = rest.indexOf('/');
+    const authority = pathStart === -1 ? rest : rest.slice(0, pathStart);
+    const at = authority.lastIndexOf('@');
+    const host = at === -1 ? authority : authority.slice(at + 1);
+    // A host, then a port only if it is one. Allowing a bare `:` for the port let a whole
+    // `user:password` through when the origin had no `@` to cut at — `https://myuser:hunter2`
+    // came back whole — because userinfo and host:port are the same shape until something
+    // says which it is. Digits after the colon say it. An IPv6 literal keeps its brackets,
+    // which is what separates its colons from that one.
+    return /^(?:\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._-]+)(?::[0-9]+)?/.exec(host)?.[0] ?? '';
+}
+/**
+ * Hop-by-hop headers, dropped before forwarding because they describe *this* connection.
+ *
+ * The full RFC 7230 §6.1 set, plus `host` and `accept-encoding`, which describe this hop for the
+ * same reason. `transfer-encoding` is the one that was missing and the one that bites: an SDK
+ * that hands `fetch` a `Request` — or any stream body — sends `transfer-encoding: chunked` and no
+ * `content-length`, and agenticreplay then copied that header onto an outbound call whose body it had
+ * already buffered. undici refuses the contradiction, so the agent got
+ * `500 {"error":{"message":"TypeError: fetch failed"}}` on every such turn, with nothing in the
+ * message pointing at a header, at agenticreplay, or at the agent.
+ */
+const HOP_BY_HOP_HEADERS = new Set([
+    'host',
+    'connection',
+    'content-length',
+    'accept-encoding',
+    'transfer-encoding',
+    'te',
+    'trailer',
+    'upgrade',
+    'keep-alive',
+    'proxy-connection',
+    'proxy-authenticate',
+]);
+/**
+ * Auth material. Forwarded upstream — an agent that cannot authenticate is an agent that cannot
+ * run — but never written into a trace. Claude Code under a subscription login sends its own
+ * `authorization: Bearer` and ignores any injected key, so dropping these would break it outright.
+ * §7 says never *write* auth material, which is a different requirement from never relaying it.
+ *
+ * From core, not restated here: this list had drifted from the interceptor's copy of it, and the
+ * two headers only the interceptor knew about were an Azure key and a Google one.
+ */
+const SECRET_REQUEST_HEADERS = new Set(AUTH_REQUEST_HEADERS);
+export function defaultDialects() {
+    return [
+        codexDialect(),
+        anthropicDialect({
+            toCanonicalRequest: anthropicToCanonicalRequest,
+            toCanonicalResponse: anthropicToCanonicalResponse,
+            parseSse: parseAnthropicSse,
+            fromCanonicalRequest: canonicalToAnthropicRequest,
+            fromCanonicalResponse: canonicalToAnthropicResponse,
+            toSse: canonicalToAnthropicSse,
+        }),
+        openaiDialect({
+            toCanonicalRequest: openaiToCanonicalRequest,
+            toCanonicalResponse: openaiToCanonicalResponse,
+            parseSse: parseOpenaiSse,
+            fromCanonicalRequest: canonicalToOpenaiRequest,
+            fromCanonicalResponse: canonicalToOpenaiResponse,
+            toSse: canonicalToOpenaiSse,
+        }),
+        // After the chat dialect deliberately: see the note on `responsesDialect`.
+        responsesDialect({
+            toCanonicalRequest: responsesToCanonicalRequest,
+            toCanonicalResponse: responsesToCanonicalResponse,
+            parseSse: parseResponsesSse,
+            fromCanonicalRequest: canonicalToResponsesRequest,
+            fromCanonicalResponse: canonicalToResponsesResponse,
+            toSse: canonicalToResponsesSse,
+        }),
+    ];
+}
+class BodyLimitError extends Error {
+    bytes;
+    limit;
+    constructor(bytes, limit) {
+        super(`request body exceeded capture limit of ${limit} bytes`);
+        this.bytes = bytes;
+        this.limit = limit;
+    }
+}
+async function readBody(req, limit) {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of req) {
+        const buffer = chunk;
+        bytes += buffer.length;
+        if (bytes > limit) {
+            req.resume();
+            throw new BodyLimitError(bytes, limit);
+        }
+        chunks.push(buffer);
+    }
+    return { body: Buffer.concat(chunks), bytes };
+}
+/** Is this something a dialect could parse at all? Cheap guard, run before anything is forwarded. */
+function isReadable(rawBody) {
+    try {
+        const parsed = JSON.parse(rawBody);
+        return typeof parsed === 'object' && parsed !== null;
+    }
+    catch {
+        return false;
+    }
+}
+function json(res, status, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, { 'content-type': 'application/json' });
+    res.end(text);
+}
+/**
+ * Whether two origin strings name the same scheme, host and port — the test a credential must
+ * pass before travelling with a request. Same shape as the copy in the CLI's upstream plan,
+ * which cannot be imported from here: the proxy is a leaf, and the comparison is two lines.
+ */
+function sameOrigin(a, b) {
+    try {
+        return new URL(a).origin === new URL(b).origin;
+    }
+    catch {
+        return a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
+    }
+}
+export async function createProxy(options) {
+    const dialects = options.dialects ?? defaultDialects();
+    // PINNED BY DEFAULT (orcacode-review). This proxy is handed the stored gateway
+    // key as `upstreamHeaders` and attaches it to both live call sites, so it is a
+    // carrier of exactly the credential fetchPinned exists to protect — and it
+    // escaped the CLI's fence twice over: that fence walked only packages/cli/src,
+    // and this call is an ALIAS, so a scan for a bare `fetch(` would not have seen
+    // it even with the wider scope.
+    //
+    // `fetchImpl` stays the seam the tests inject through; only the default moves.
+    const doFetch = options.fetchImpl ?? fetchPinned;
+    const recorded = options.exchanges ?? [];
+    const captured = [];
+    // Plain base-URL traffic needs the same aggregate bound as intercepted traffic. This counter
+    // covers bodies retained by concurrent fetch responses while each response still streams to the
+    // caller; it is released only after that response has been materialized into evidence.
+    let plainBufferedBytes = 0;
+    const plainBufferLimit = options.maxBufferedBytes ?? 256 * 1024 * 1024;
+    const stats = {
+        mode: options.mode,
+        recorded: recorded.length,
+        matchedExact: 0,
+        matchedInexact: 0,
+        divergences: 0,
+        liveCalls: 0,
+        unmatched: 0,
+        intercepted: 0,
+        tunnelled: 0,
+        passedThrough: 0,
+        retrievalServed: 0,
+        retrievalTotal: 0,
+        retrievalLive: 0,
+        retrievalReordered: 0,
+        reordered: 0,
+    };
+    // In hybrid mode only the exchanges below the fork point are replayable; everything at or above
+    // it must go live, which is exactly what makes a fork a fork.
+    const replayable = options.mode === 'hybrid' ? recorded.slice(0, options.forkAt ?? recorded.length) : recorded;
+    /**
+     * The most requests this proxy has had open at once, and the count it is derived from.
+     *
+     * Only the proxy can know this, and the matcher needs it: a pipeline that issues ten requests
+     * together is answered in whatever order the origin finished them, so a replay's request can
+     * arrive up to nine positions from the cursor. See {@link LOOKAHEAD}.
+     */
+    let inFlight = 0;
+    let peakInFlight = 0;
+    function opened() {
+        inFlight += 1;
+        if (inFlight > peakInFlight)
+            peakInFlight = inFlight;
+    }
+    function closed() {
+        if (inFlight > 0)
+            inFlight -= 1;
+    }
+    // The recorded requests carry placeholders where secrets were; a live replay request carries the
+    // secrets themselves. Without a redactor on this side the two are never in the same
+    // representation, and a recording of any real harness — whose own system prompt carries a
+    // session id — cannot match itself.
+    // Shared with the passthrough failure path, which writes an upstream's own error message into
+    // the trace: a gateway that quotes the call it refused can quote the credential with it, and §7
+    // says never write it — not "write it and let a later layer catch it".
+    const redactor = new Redactor();
+    const matcher = new RequestMatcher(replayable.map((e) => e.canonicalRequest), { redactor, concurrency: () => peakInFlight });
+    /**
+     * The recording's retrieval calls, by key, ready to be consumed one at a time.
+     *
+     * Not filtered by the fork point. A fork keeps replaying these past the cursor on purpose: the
+     * vector for a paragraph does not depend on which chat model answers the question afterwards,
+     * so re-embedding it live would spend money to recompute an identical value and leave the
+     * fork's index differing from its parent's for no reason. See `RetrievalRule.forkable`.
+     */
+    const retrievalRules = options.retrievalRules ?? defaultRetrievalRules();
+    const retrievalIndex = indexRetrievals(options.retrievals ?? []);
+    stats.retrievalTotal = (options.retrievals ?? []).length;
+    const server = createServer((req, res) => {
+        opened();
+        void handle(req, res)
+            .catch((err) => {
+            // Whatever failed, its message may name the origin it was given — and this body reaches
+            // the agent, which prints it. See {@link withoutCredentials}.
+            json(res, 500, { error: { message: withoutCredentials(String(err)) } });
+        })
+            .finally(closed);
+    });
+    /**
+     * A decrypted exchange that turns out to be a model call is recorded as one.
+     *
+     * This is the reason the feature exists rather than a refinement of it: a harness that ignores
+     * base-URL variables produces a trace indistinguishable from one captured the ordinary way,
+     * which means replay, fork and compare all work on it. Anything the dialects do not recognise
+     * falls through to `net.request` / `net.response`, where it is described but not interpreted.
+     */
+    function onDecrypted(exchange) {
+        // On the path alone. A dialect matches an endpoint, and a query string is not part of the
+        // endpoint -- Azure OpenAI's are all `?api-version=...`, so matching the raw path recorded
+        // those runs as opaque network traffic that cannot be replayed or forked, while telling the
+        // operator no dialect claimed the path. `onInterceptedRequest` below has always split it off
+        // for exactly this reason; the recording side had not.
+        const dialect = selectDialect(dialects, exchange.path.split('?')[0] ?? exchange.path);
+        // `status === 0` means no response header was ever seen: the client abandoned the call before
+        // the origin answered. The request is still worth keeping -- it is what the agent asked --
+        // but a model exchange with no response is not one, and inserting it in the replay set gives
+        // the matcher an entry that can answer nothing and cannot be forked. It goes below as network
+        // traffic instead, which is what it is.
+        if (dialect &&
+            exchange.method === 'POST' &&
+            !exchange.requestTruncated &&
+            exchange.responseComplete &&
+            !exchange.responseTruncated &&
+            exchange.status !== 0) {
+            try {
+                // Codex's HTTPS fallback currently labels this SSE body as application/json. The wire
+                // framing is authoritative when the provider header is not, otherwise we lose the
+                // canonical response and replay sends the right bytes with the wrong content type.
+                const streamed = (exchange.responseHeaders['content-type'] ?? '').includes('event-stream') ||
+                    exchange.responseBody.startsWith('event:');
+                const built = buildExchange({
+                    dialect,
+                    path: exchange.path,
+                    rawRequest: exchange.requestBody,
+                    rawResponse: exchange.responseBody,
+                    status: exchange.status,
+                    streamed,
+                    headers: scalarHeaders(exchange.requestHeaders),
+                    seq: captured.length,
+                    requestId: exchange.requestId,
+                    requestStartedAt: exchange.requestStartedAt,
+                    durationMs: exchange.durationMs,
+                    // The two things only the interceptor witnessed. Without them a promoted exchange is
+                    // indistinguishable from one captured over the base-URL route, which is the point --
+                    // except where the difference is the thing being debugged.
+                    alpn: exchange.alpn,
+                    responseDecodedFrom: exchange.responseDecodedFrom,
+                    // Under interception agenticreplay did not choose this origin, the agent did — which is the
+                    // case where "who answered" is least obvious from the command line, and so the one most
+                    // worth having in the trace. The port is kept only where https does not imply it.
+                    upstream: `https://${exchange.host}${exchange.port === 443 ? '' : `:${exchange.port}`}`,
+                });
+                captured.push(built);
+                options.onExchange?.(built);
+                // Keep the authoritative wire record even when the dialect projection succeeds. The
+                // model event is a convenient replay view; the net event retains headers, framing and
+                // transport completion details needed to audit capture fidelity.
+                options.tls?.onNetExchange?.({ ...exchange, modelDialect: dialect.id });
+                return;
+            }
+            catch {
+                // Not a model call after all — a path that merely looks like one, or a body this dialect
+                // cannot read. Describing it as plain network traffic is honest; guessing is not.
+            }
+        }
+        options.tls?.onNetExchange?.(exchange);
+    }
+    /**
+     * Replay hook for requests inside an intercepted TLS session. The ordinary HTTP proxy reaches
+     * `handle()` below, but the TLS interceptor has already terminated the outer CONNECT and needs
+     * the same matcher before it opens an origin connection.
+     *
+     * Live calls used to return `undefined` here, which forwarded the client's bytes unchanged —
+     * so `agenticreplay replay --from N --model X` on a TLS-intercepted recording echoed `model=X` and then
+     * called the recorded model. `replayed=0 live=0` was the tell: `goLive` never ran, substitution
+     * never had a chance. Same-provider `--model` now rewrites the body and still talks to the
+     * intercepted origin (the only origin that origin's credential can reach). A cross-provider
+     * target would have to leave that host, which this path cannot do; that fails loudly instead of
+     * succeeding with the old model.
+     */
+    function onInterceptedRequest(request) {
+        const path = request.path.split('?')[0] ?? '/';
+        const dialect = selectDialect(dialects, path);
+        if (!dialect || request.method !== 'POST' || request.requestTruncated)
+            return undefined;
+        let rawBody;
+        try {
+            rawBody = decodeBody(request.requestBytes, Array.isArray(request.requestHeaders['content-encoding'])
+                ? request.requestHeaders['content-encoding'].join(', ')
+                : request.requestHeaders['content-encoding'], options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES);
+        }
+        catch (err) {
+            if (options.mode !== 'replay' || !options.loose) {
+                stats.unmatched += 1;
+                return replayError(`cannot decode intercepted request body: ${String(err)}`);
+            }
+            return undefined;
+        }
+        const result = tryReplay(dialect, rawBody);
+        if (result?.exchange) {
+            return {
+                status: result.exchange.status,
+                headers: {
+                    'content-type': result.exchange.streamed ? 'text/event-stream' : 'application/json',
+                },
+                body: result.exchange.rawResponse,
+            };
+        }
+        if (result?.error)
+            return replayError(result.error);
+        return liveIntercepted(dialect, request, rawBody);
+    }
+    /**
+     * A decrypted model call the recording will not serve — past the fork point, or unmatched on a
+     * hybrid / `--loose` run. Counted as live the way `handle()` → `goLive` is, so `fork.done`
+     * `live=N` is the number of exchanges the fork actually owned.
+     */
+    function liveIntercepted(dialect, request, rawBody) {
+        if (options.forkModel === undefined) {
+            stats.liveCalls += 1;
+            return undefined;
+        }
+        const target = dialect.ownsModel(options.forkModel)
+            ? dialect
+            : (dialects.find((d) => d.ownsModel(options.forkModel)) ?? dialect);
+        const crossProvider = target.id !== dialect.id;
+        if (crossProvider) {
+            return replayError(`--model ${options.forkModel} is served by ${target.id}, not the intercepted ` +
+                `${dialect.id} origin ${request.host}:${request.port}. A TLS-intercepted fork cannot ` +
+                `leave the host the recording talked to. Pick a model that origin serves`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(rawBody);
+        }
+        catch (err) {
+            return replayError(`unparseable request body: ${String(err)}`);
+        }
+        const outboundBody = Buffer.from(JSON.stringify(dialect.withModel(parsed, options.forkModel)), 'utf8');
+        stats.liveCalls += 1;
+        const origin = `https://${request.host}${request.port === 443 ? '' : `:${request.port}`}`;
+        const recordable = recordableOrigin(origin);
+        options.onRoute?.({
+            model: options.forkModel,
+            target: target.id,
+            recorded: dialect.id,
+            ...(recordable === undefined ? {} : { origin: recordable }),
+            crossProvider: false,
+            reason: `served by the recorded dialect ${dialect.id}`,
+        });
+        return { outboundBody };
+    }
+    function tryReplay(dialect, rawBody) {
+        let canonical;
+        try {
+            canonical = dialect.toCanonicalRequest(JSON.parse(rawBody));
+        }
+        catch (err) {
+            return { error: `unparseable request body: ${String(err)}` };
+        }
+        const beyondFork = options.mode === 'hybrid' && matcher.cursor >= (options.forkAt ?? replayable.length);
+        if (beyondFork)
+            return undefined;
+        const result = matcher.match(canonical);
+        if (result.matched) {
+            const exchange = replayable[result.index];
+            if (result.reordered)
+                stats.reordered += 1;
+            if (result.divergence) {
+                stats.matchedInexact += 1;
+                stats.divergences += 1;
+                options.onDivergence?.({ ...result.divergence, seq: exchange.seq });
+            }
+            else {
+                stats.matchedExact += 1;
+            }
+            return { exchange };
+        }
+        stats.unmatched += 1;
+        if (options.mode === 'hybrid' || options.loose) {
+            stats.divergences += 1;
+            options.onDivergence?.({
+                level: 'major',
+                rung: 4,
+                distance: -1,
+                detail: result.reason ?? 'request does not match the recording; served live instead',
+                seq: replayable[result.index]?.seq ?? -1,
+            });
+            return undefined;
+        }
+        const reason = result.reason ?? 'request does not match the recording';
+        options.onUnmatched?.({
+            seq: replayable[result.index]?.seq ?? -1,
+            index: result.index,
+            reason,
+        });
+        return { error: `agenticreplay: replay halted — ${reason}` };
+    }
+    function replayError(message) {
+        return {
+            status: 400,
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                type: 'error',
+                error: {
+                    type: 'invalid_request_error',
+                    message: `${message}. Re-run with \`agenticreplay replay <run> --loose\` to continue live from this point, ` +
+                        'or `agenticreplay show <run>` to see what was recorded.',
+                },
+            }),
+        };
+    }
+    const interception = options.tls
+        ? attachTlsIntercept(server, {
+            ...options.tls,
+            ...(options.maxCapturedBytes === undefined
+                ? {}
+                : { maxCapturedBytes: options.maxCapturedBytes }),
+            ...(options.maxBufferedBytes === undefined
+                ? {}
+                : { maxBufferedBytes: options.maxBufferedBytes }),
+            onRequestStart: options.onRequestStart,
+            ...(options.mode === 'record' ? {} : { onRequest: onInterceptedRequest }),
+            onNetExchange: onDecrypted,
+        }, stats)
+        : undefined;
+    /**
+     * The configured extra headers for one outbound call — only when the call is going where they
+     * belong.
+     *
+     * `upstreamHeaders` exist to put a gateway's credential on calls to that gateway. With a
+     * forwarded request naming its own destination, "every live call" would put the credential on
+     * someone else's origin, so the origin the headers name is attached to them and compared here.
+     * Callers that set headers without an origin get the old behaviour: on every call, their
+     * responsibility.
+     */
+    function headersForOrigin(origin) {
+        const extra = options.upstreamHeaders;
+        if (extra === undefined)
+            return {};
+        if (options.upstreamHeadersOrigin === undefined)
+            return extra;
+        return sameOrigin(origin, options.upstreamHeadersOrigin) ? extra : {};
+    }
+    async function goLive(dialect, path, rawBody, 
+    /** Sent upstream, auth included. */
+    headers, 
+    /** Written to the trace, auth removed. */
+    recordableHeaders, res, startedAt, requestId, requestEncoding, 
+    /**
+     * The base URL the request itself names, from a `/forward/` path. It restores the destination
+     * agenticreplay took the call away from, so it outranks only the dialect's vendor default — an upstream
+     * the operator configured is an instruction and wins. Dropped on a cross-provider fork, where
+     * the model asked for is being served by a different origin on purpose.
+     */
+    forwardBase) {
+        stats.liveCalls += 1;
+        // Which dialect actually serves the model we are about to ask for. Without this the origin
+        // came from the *recorded* request, so forking an Anthropic run onto gpt-5.2 posted an
+        // Anthropic body to api.anthropic.com naming a model that does not exist there — the
+        // cross-provider comparison the tool is pitched on could not have worked.
+        // The recorded dialect wins whenever it can serve the model, and only then do we go looking.
+        // Two dialects now share a provider — chat completions and Responses both answer for anything
+        // that is not Claude — so a bare `find` would route every Responses fork to chat completions
+        // and translate a turn that never needed translating.
+        const target = options.forkModel === undefined || dialect.ownsModel(options.forkModel)
+            ? dialect
+            : (dialects.find((d) => d.ownsModel(options.forkModel)) ?? dialect);
+        const crossProvider = target.id !== dialect.id;
+        let parsed = JSON.parse(rawBody);
+        if (crossProvider) {
+            // Through canonical, which is the only representation both dialects agree on.
+            const canonical = dialect.toCanonicalRequest(parsed);
+            parsed = target.fromCanonicalRequest({ ...canonical, model: options.forkModel });
+        }
+        else if (options.forkModel) {
+            parsed = dialect.withModel(parsed, options.forkModel);
+        }
+        // A recording must retain the provider's serialized bytes. Re-serializing an unchanged
+        // request silently loses whitespace, field ordering, and unknown textual fields before the
+        // endpoint oracle can compare it. Only a model/provider fork is allowed to construct a new
+        // request body.
+        const outboundBody = options.forkModel === undefined ? rawBody : JSON.stringify(parsed);
+        const requestTranslation = options.forkModel === undefined
+            ? []
+            : [
+                crossProvider
+                    ? protocolTranslationTransformation(dialect.id, target.id, 'request.body')
+                    : modelOverrideTransformation(dialect.id, options.forkModel),
+            ];
+        // Prefer an override for the provider we are actually calling; fall back to the override for
+        // the recorded provider before the vendor default. That fallback is the gateway case, and it
+        // is the common one: someone who passed --upstream-anthropic pointed *this run* at a specific
+        // origin, and a gateway serves both dialects from it. Going to api.openai.com instead because
+        // the fork changed model would ignore an instruction the user gave explicitly.
+        // Where this call goes, in strict order of who decided it. A `/forward/` path names its own
+        // destination — that is the whole point of the encoding — so on a live call that agenticreplay is
+        // merely relaying (record, or a loose replay continuing past its recording) the request's own
+        // base outranks every configured origin: a gateway picked up from `agenticreplay setup` is a default
+        // for calls agenticreplay would otherwise have to guess at, not a licence to readdress one that
+        // announces where it was headed. A fork is different: substituting the model is the operator
+        // choosing where answers come from, so the fork target's explicit upstream — or the gateway —
+        // decides, and the forwarded base is dropped as incoherent for the substitution.
+        const relaying = options.forkModel === undefined && !crossProvider;
+        const origin = relaying && forwardBase !== undefined
+            ? forwardBase
+            : (options.upstream?.[target.id] ??
+                options.upstream?.[dialect.id] ??
+                (target.id === 'openai-responses' || target.id === 'codex'
+                    ? options.upstream?.openai
+                    : undefined) ??
+                target.defaultUpstream);
+        // A relayed call keeps the path the client appended, because the base it names expects
+        // exactly that. Everything else is answered by an origin agenticreplay chose, which expects the
+        // dialect's own path — and the incoming path cannot be trusted to be it: a bare base url
+        // (no `/v1`) reaches this proxy as `/chat/completions`, and a gateway handed that without the
+        // version segment answers 404.
+        //
+        // The query survives the substitution either way, because it is not part of the endpoint's
+        // shape. A path says which endpoint; a query says how to call it, and the client set it —
+        // `?api-version=` is required on every Azure OpenAI call, and dropping it turns a working
+        // configuration into `404 Resource not found` with nothing in the run explaining why.
+        // Replacing a path is agenticreplay normalising an address it chose; replacing the parameters would
+        // be agenticreplay editing the request.
+        const queryAt = path.indexOf('?');
+        const query = queryAt === -1 ? '' : path.slice(queryAt);
+        const upstreamPath = relaying && forwardBase !== undefined ? path : `${target.requestPath}${query}`;
+        // Spec §2: "a gateway chose a model". AgenticReplay *is* the gateway on this path — it substitutes the
+        // model, picks the wire format that serves it, and picks the origin — and it was making all
+        // three of those choices silently. Which is the one thing a comparison must not do: reading
+        // `claude-opus-5 vs gpt-5.2` in a verdict table tells you nothing about where either went, and
+        // a fork that quietly fell back to the recorded provider's origin looked identical to one that
+        // did not. Emitted only when a decision was actually taken, so an ordinary recording — where
+        // agenticreplay forwards what it was given — stays free of an event saying "nothing was chosen".
+        if (options.forkModel !== undefined) {
+            // Sanitised here for the reason {@link buildExchange} sanitises the exchange's `upstream`,
+            // and it is the same value: an origin that came from configuration rather than off the wire,
+            // so a gateway that authenticates by URL carries its key in it. This payload is not just
+            // reported — `agenticreplay replay --model` and `agenticreplay compare --models` write it into the fork's
+            // trace as `route.decision.attrs` unchanged, and the trace redactor cannot help, because it
+            // matches key shapes and field names and this is a password inside a URL under `origin`.
+            // Omitted rather than replaced when it will not parse: no consumer reads it — the viewer
+            // renders model, target and reason — and a placeholder in a field others may parse as a URL
+            // is worse than the field being absent.
+            const recordable = recordableOrigin(origin);
+            options.onRoute?.({
+                model: options.forkModel,
+                target: target.id,
+                recorded: dialect.id,
+                ...(recordable === undefined ? {} : { origin: recordable }),
+                crossProvider,
+                // Deliberately does not open with the model name: the viewer already renders that as the
+                // row's label, so a reason that repeats it produces `gpt-5.2  gpt-5.2 is served by…` and
+                // spends the row's width saying the same thing twice.
+                reason: crossProvider
+                    ? `served by ${target.id}, not the recorded ${dialect.id}`
+                    : `served by the recorded dialect ${dialect.id}`,
+            });
+        }
+        let upstreamRes;
+        try {
+            upstreamRes = await doFetch(`${origin}${upstreamPath}`, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    ...headersForModel(headers, options.forkModel),
+                    ...headersForOrigin(origin),
+                },
+                body: outboundBody,
+            });
+        }
+        catch (err) {
+            // An upstream that never answered, on the path agenticreplay *does* understand.
+            //
+            // `passThrough` learned this already; this is the same fact one branch over, and it was the
+            // worse half. A call agenticreplay recognised as a model exchange and could not forward left no
+            // event at all: `run.start`, a snapshot, `run.end`. The agent got its 500 and the run then
+            // warned `capture.empty ... "the agent never called the proxy — it may not read a base-URL
+            // variable"` — which is the opposite of what happened, and sends the operator to check
+            // environment variables when the upstream is simply unreachable.
+            //
+            // Recorded as an exchange rather than as network traffic, because that is what it is: the
+            // same call, recorded the same way, whether the upstream answered 503 or never answered at
+            // all. `status: 500` is what the agent receives from the catch-all above, so a replay of
+            // this trace reproduces the failure the way §4 asks — and `>= 400` is what makes
+            // `capture.errors` count it, where `0` would have filed a failed call as a healthy one.
+            //
+            // The body is `reasonFor`'s, not the catch-all's: both name the origin they were given, and
+            // this one is the copy that gets written down. See `scrubOrigin`.
+            //
+            // Answered here rather than rethrown into the catch-all, so the bytes the agent receives
+            // and the bytes the trace holds are the same ones. Rethrowing gave the agent the
+            // catch-all's `TypeError: fetch failed` while the trace held this scrubbed reason, and a
+            // replay then served the trace's version — a recording that did not reproduce itself.
+            // The agent also gets the better of the two messages: one that names agenticreplay and the origin.
+            const body = JSON.stringify({
+                error: { message: `agenticreplay did not forward this call: ${reasonFor(err, origin)}` },
+            });
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                intercepted: false,
+                method: 'POST',
+                path,
+                requestHeaders: recordableHeaders,
+                requestBody: outboundBody,
+                requestBytes: Buffer.byteLength(outboundBody),
+                requestTruncated: false,
+                status: 0,
+                responseHeaders: {},
+                responseBody: '',
+                responseTruncated: false,
+                responseComplete: false,
+                responseError: reasonFor(err, origin),
+                responseBytes: 0,
+                durationMs: Date.now() - startedAt,
+                transformations: [
+                    ...captureHeaderTransformations(headers, recordableHeaders),
+                    ...captureEncodingTransformation('request.body', requestEncoding),
+                    ...captureUrlTransformations(origin),
+                    ...binaryBodyTransformation('request.body', outboundBody),
+                    ...binaryBodyTransformation('response.body', body),
+                ],
+            });
+            recordExchange(body, 500, false);
+            res.writeHead(500, { 'content-type': 'application/json' });
+            res.end(body);
+            return;
+        }
+        const upstreamType = upstreamRes.headers.get('content-type') ?? 'application/json';
+        const upstreamStreamed = upstreamType.includes('event-stream');
+        const responseEncoding = upstreamRes.headers.get('content-encoding') ?? undefined;
+        const responseDecoded = responseEncoding !== undefined && responseEncoding.trim() !== '';
+        // The agent asked one provider and must be answered in that provider's shape, whatever served
+        // the request. Handing an agent a `chat.completion` body it cannot parse is indistinguishable
+        // from the model having failed.
+        //
+        // A cross-provider reply cannot be teed: translating it means having all of it, so this path
+        // buffers where the same-provider path streams. That is a real cost and it only applies to a
+        // fork that deliberately changed provider — the recording path, which is what an interactive
+        // session runs through, still streams.
+        if (crossProvider) {
+            const received = await readBoundedResponse(upstreamRes, options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES, plainBufferLimit);
+            if (received.truncated) {
+                emitNetExchange({
+                    path: upstreamPath,
+                    responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+                    responseBody: received.text,
+                    responseBytes: received.bytes,
+                    responseTruncated: true,
+                    status: upstreamRes.status,
+                    responseComplete: false,
+                    responseError: 'cross-provider response exceeded capture limit',
+                    streamed: upstreamStreamed,
+                    modelDialect: target.id,
+                    extraTransformations: [protocolTranslationTransformation(target.id, dialect.id)],
+                });
+                res.writeHead(502, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: { message: 'cross-provider response exceeded capture limit' } }));
+                return;
+            }
+            const raw = received.text;
+            // Keep the origin bytes even when protocol translation fails. The client receives an error,
+            // but the recorder must still prove that the origin answered and preserve the response that
+            // caused the translation failure.
+            let body;
+            const wantsStream = requestedStream(rawBody);
+            try {
+                const canonical = upstreamStreamed
+                    ? target.parseStream(raw)
+                    : target.toCanonicalResponse(JSON.parse(raw));
+                // Match the shape the agent asked for, not the shape the other provider happened to send.
+                body = dialect.fromCanonicalResponse(canonical, wantsStream);
+            }
+            catch (err) {
+                emitNetExchange({
+                    path: upstreamPath,
+                    responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+                    responseBody: raw,
+                    responseBytes: received.bytes,
+                    responseTruncated: false,
+                    status: upstreamRes.status,
+                    responseComplete: received.encodingError === undefined,
+                    responseError: received.encodingError ?? `cross-provider response translation failed: ${String(err)}`,
+                    streamed: upstreamStreamed,
+                    modelDialect: target.id,
+                    extraTransformations: [protocolTranslationTransformation(target.id, dialect.id)],
+                });
+                res.writeHead(502, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: { message: 'cross-provider response translation failed' } }));
+                return;
+            }
+            if (Buffer.byteLength(body) > (options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES)) {
+                emitNetExchange({
+                    path: upstreamPath,
+                    responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+                    responseBody: raw,
+                    responseBytes: received.bytes,
+                    responseTruncated: false,
+                    status: upstreamRes.status,
+                    responseComplete: false,
+                    responseError: 'cross-provider translated response exceeded capture limit',
+                    streamed: wantsStream,
+                    modelDialect: target.id,
+                    extraTransformations: [protocolTranslationTransformation(target.id, dialect.id)],
+                });
+                res.writeHead(502, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: { message: 'cross-provider translated response exceeded capture limit' },
+                }));
+                return;
+            }
+            res.writeHead(upstreamRes.status, {
+                'content-type': wantsStream ? 'text/event-stream' : 'application/json',
+            });
+            res.end(body);
+            emitNetExchange({
+                path: upstreamPath,
+                responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+                responseBody: raw,
+                responseBytes: received.bytes,
+                status: upstreamRes.status,
+                responseComplete: received.encodingError === undefined,
+                ...(received.encodingError === undefined ? {} : { responseError: received.encodingError }),
+                streamed: wantsStream,
+                modelDialect: target.id,
+                extraTransformations: [protocolTranslationTransformation(target.id, dialect.id)],
+            });
+            recordExchange(body, upstreamRes.status, wantsStream);
+            return;
+        }
+        const contentType = upstreamType;
+        const streamed = upstreamStreamed;
+        res.writeHead(upstreamRes.status, { 'content-type': contentType });
+        // Tee rather than buffer. A model response arrives over seconds, and reading it to completion
+        // before writing a byte makes every turn of an interactive session appear to hang for its full
+        // duration — the agent's own progressive rendering stops working because there is nothing
+        // progressive left to render. Chunks go straight through; the copy we keep is assembled on the
+        // way past, so the recording is still the complete body.
+        let piped;
+        try {
+            piped = await pipeThrough(upstreamRes, res, options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES, plainBufferLimit);
+        }
+        catch (err) {
+            const partial = err instanceof ResponsePipeAbortedError
+                ? err.partial
+                : err.partial;
+            emitNetExchange({
+                responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+                responseBody: partial?.text ?? '',
+                responseBytes: partial?.bytes ?? 0,
+                status: upstreamRes.status,
+                responseComplete: false,
+                responseTruncated: partial?.truncated ?? false,
+                responseError: String(err),
+                streamed,
+                abandoned: err instanceof ResponsePipeAbortedError,
+            });
+            if (err instanceof ResponsePipeAbortedError)
+                return;
+            throw err;
+        }
+        emitNetExchange({
+            responseHeaders: captureResponseHeaders(upstreamRes.headers, responseDecoded),
+            responseBody: piped.text,
+            responseBytes: piped.bytes,
+            responseTruncated: piped.truncated,
+            status: upstreamRes.status,
+            responseComplete: piped.encodingError === undefined,
+            ...(piped.encodingError === undefined ? {} : { responseError: piped.encodingError }),
+            streamed,
+        });
+        if (!piped.truncated && piped.encodingError === undefined)
+            recordExchange(piped.text, upstreamRes.status, streamed);
+        function emitNetExchange(input) {
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                intercepted: false,
+                method: 'POST',
+                path: input.path ?? path,
+                requestHeaders: recordableHeaders,
+                requestBody: outboundBody,
+                requestBytes: Buffer.byteLength(outboundBody),
+                requestTruncated: false,
+                status: input.status,
+                responseHeaders: input.responseHeaders,
+                responseBody: input.responseBody,
+                responseComplete: input.responseComplete,
+                responseTruncated: input.responseTruncated ?? false,
+                ...(input.abandoned === true ? { abandoned: true } : {}),
+                ...(input.responseError === undefined ? {} : { responseError: input.responseError }),
+                responseBytes: input.responseBytes,
+                durationMs: Date.now() - startedAt,
+                modelDialect: input.modelDialect ?? dialect.id,
+                transformations: [
+                    ...captureHeaderTransformations(headers, recordableHeaders),
+                    ...requestTranslation,
+                    ...captureEncodingTransformation('request.body', requestEncoding),
+                    ...captureResponseHeaderTransformations(upstreamRes.headers),
+                    ...captureEncodingTransformation('response.body', responseEncoding),
+                    ...(input.extraTransformations ?? []),
+                    ...captureUrlTransformations(origin),
+                    ...binaryBodyTransformation('request.body', outboundBody),
+                    ...binaryBodyTransformation('response.body', input.responseBody),
+                ],
+            });
+        }
+        /**
+         * Recorded whatever the status. A run that died on rate limits used to produce a trace with no
+         * evidence of it — and replay would then be short exactly the exchanges that explain the
+         * failure you are trying to reproduce.
+         *
+         * The recorded body is what the *agent* received, so a cross-provider fork replays as a run of
+         * the dialect the agent speaks. Recording the other provider's bytes would produce a trace
+         * that no adapter could replay.
+         */
+        function recordExchange(rawResponse, status, isStreamed) {
+            const exchange = buildExchange({
+                dialect,
+                path,
+                rawRequest: outboundBody,
+                rawResponse,
+                status,
+                streamed: isStreamed,
+                headers: scalarHeaders(recordableHeaders),
+                seq: captured.length,
+                requestId,
+                requestStartedAt: startedAt,
+                durationMs: Date.now() - startedAt,
+                // The origin resolved above, not the one configured: a relayed call keeps the base the
+                // client announced, and a fork's substitution can send it somewhere else again.
+                upstream: origin,
+            });
+            captured.push(exchange);
+            options.onExchange?.(exchange);
+        }
+    }
+    /**
+     * Where a request agenticreplay could not read should have gone.
+     *
+     * Explicit first, then the gateway: someone who pointed this run at one origin pointed *all* of
+     * it there, and splitting a run across two origins because agenticreplay could not read one call is not a
+     * choice they made. Only then the guess — and the guess is narrow, because it is not choosing a
+     * destination so much as restoring one. AgenticReplay took this request away from a provider by rewriting
+     * a base URL; the client's own headers say which provider that was, and its own credential is
+     * already on the request addressed to them.
+     */
+    function passthroughOrigin(headers, forwardBase, opts = {}) {
+        if (options.passthroughUpstream !== undefined)
+            return options.passthroughUpstream;
+        // A relayed request's own destination, before anything configured: on a live call with no
+        // model substitution, the request says where it was headed, and a gateway picked up from
+        // setup is a default for calls agenticreplay would otherwise guess at — not a readdressing of one that
+        // announces its own. A fork is a substitution, and its configured origins decide instead.
+        //
+        // `verbatim` is for a call the fork does *not* substitute anything in. A retrieval call is
+        // forwarded byte for byte — same headers, same body, no `withModel` — so the substitution the
+        // fork rule exists for never happens to it, and dropping its announced destination on account
+        // of one is how a fork's live embedding call left for the chat origin carrying the embedding
+        // provider's own key: a 401 at best, and at worst an OpenAI-compatible gateway that answers
+        // `/v1/embeddings` from a different model, putting foreign vectors in the fork's index.
+        if (forwardBase !== undefined && (opts.verbatim === true || options.forkModel === undefined)) {
+            return forwardBase;
+        }
+        const configured = [...new Set(Object.values(options.upstream ?? {}))];
+        if (configured.length === 1)
+            return configured[0];
+        const names = new Set(Object.keys(headers).map((h) => h.toLowerCase()));
+        // `x-api-key` alongside the version headers: this request carries the caller's own credential,
+        // and a wrong guess does not merely fail — it hands one vendor a key issued by another.
+        // Anthropic's client is the one that announces itself, so absence of a signal means OpenAI.
+        const anthropic = names.has('anthropic-version') || names.has('anthropic-beta') || names.has('x-api-key');
+        // The origin configured for the family this request belongs to, before any vendor default.
+        // Two configured values only means the run has more than one destination — not that this
+        // request's own destination is unknown — and picking a vendor default over an origin the
+        // operator named is how a run configured with `--upstream-openai <stub>` alongside a gateway
+        // left in `~/.agenticreplay/config.json` sent its embedding calls to `api.openai.com`: a third place,
+        // neither of the two configured, carrying the agent's own credential. For a team whose
+        // gateway is the point of the gateway, that is every retrieval call bypassing it silently.
+        const forFamily = anthropic ? options.upstream?.['anthropic'] : options.upstream?.['openai'];
+        if (forFamily !== undefined)
+            return forFamily;
+        return anthropic ? 'https://api.anthropic.com' : 'https://api.openai.com';
+    }
+    /**
+     * Serve a retrieval call: from the recording where there is one, live where there is not.
+     *
+     * The lookup is by the request itself rather than by a cursor. Two reasons, and both matter.
+     * The answer is a function of the request, so position carries no information — the same text
+     * embedded on turn 3 and on turn 40 has the same vector. And an index build issues these
+     * hundreds at a time from a worker pool, so there is no order for a cursor to follow.
+     *
+     * A recorded call is consumed once, earliest first, so a run that asked the same thing twice
+     * gets both of its answers back and `retrieval=N/N` means every recorded call was reused —
+     * rather than one of them being served twice while another was never asked for.
+     */
+    async function serveRetrieval(rule, path, rawBody, headers, recordableHeaders, res, startedAt, requestId, forwardBase) {
+        let key;
+        let parsed;
+        try {
+            parsed = JSON.parse(rawBody);
+            key = rule.key(parsed);
+        }
+        catch (err) {
+            // A body this rule cannot key is a body agenticreplay cannot promise anything about. Passthrough is
+            // the honest fallback: forward it, record the bytes, say it is not replayable.
+            if (options.mode === 'replay') {
+                stats.unmatched += 1;
+                const reason = `${path} could not be keyed for replay: ${String(err)}`;
+                options.onUnmatched?.({ seq: -1, index: -1, reason });
+                json(res, 502, {
+                    error: { message: `agenticreplay replay cannot reproduce ${path}: ${reason}` },
+                });
+                return;
+            }
+            await passThrough(path, rawBody, headers, recordableHeaders, res, startedAt, requestId, forwardBase);
+            return;
+        }
+        // Across the fork cursor deliberately, in every mode that has a recording. A fork asks the
+        // same documents about a different chat model; re-embedding them live would spend money to
+        // recompute a value that cannot have changed, and would make the fork's index differ from the
+        // parent's for no reason anyone asked for. `RetrievalRule.forkable` is `false` for the same
+        // reason, one level up.
+        //
+        // Exact first, then the batch. A pipeline assembles its batch from a worker pool, so the same
+        // set of texts arrives in a different order on every run and an exact key alone found nothing
+        // — measured: two replays of one recording, two different keys, neither recorded. Where the
+        // endpoint's own contract says `data[i]` answers `input[i]`, the recorded answer for each
+        // text can be handed back against that text's new position, which is not an approximation.
+        // See {@link BatchRetrieval}.
+        let match = retrievalIndex.byKey.get(key)?.[0];
+        let rebuilt;
+        if (match === undefined) {
+            const batchKey = rule.batch?.key(parsed);
+            const candidate = batchKey === undefined ? undefined : retrievalIndex.byBatch.get(batchKey)?.[0];
+            if (candidate !== undefined && candidate.rawResponse !== '') {
+                rebuilt = rule.batch?.reorder(safeParse(candidate.rawRequest), candidate.rawResponse, parsed);
+                // An inexact reorder is no match at all. Filling the gaps would put another document's
+                // vector in the index, and nothing downstream could tell.
+                if (rebuilt !== undefined)
+                    match = candidate;
+            }
+            else if (candidate !== undefined) {
+                match = candidate;
+            }
+        }
+        if (match !== undefined) {
+            // Consumed only where it is actually served. A recorded call agenticreplay cannot serve is still the
+            // answer to this request, and dropping it turned a client's retry — langchain retries a 502
+            // — into "no recorded retrieval call matches this request", which is false and sends the
+            // reader looking for a mismatch that is not there.
+            if (rebuilt !== undefined) {
+                consume(retrievalIndex, match);
+                stats.retrievalServed += 1;
+                stats.retrievalReordered += 1;
+                res.writeHead(match.status, { 'content-type': match.contentType });
+                res.end(rebuilt);
+                return;
+            }
+            if (match.rawResponse === '') {
+                // Recorded with `--retrieval-store=digest`: agenticreplay kept proof of the answer, not the answer.
+                const reason = `${path} was recorded with --retrieval-store=digest, so the trace holds a digest of ` +
+                    'the response and not the response. Re-record with the default (full) to replay it';
+                if (options.mode === 'replay' && !options.loose) {
+                    stats.unmatched += 1;
+                    options.onUnmatched?.({ seq: match.seq, index: -1, reason });
+                    json(res, 502, {
+                        error: { message: `agenticreplay replay cannot reproduce ${path}: ${reason}` },
+                    });
+                    return;
+                }
+            }
+            else {
+                consume(retrievalIndex, match);
+                stats.retrievalServed += 1;
+                res.writeHead(match.status, { 'content-type': match.contentType });
+                res.end(match.rawResponse);
+                return;
+            }
+        }
+        if (options.mode === 'replay' && !options.loose) {
+            stats.unmatched += 1;
+            const reason = `no recorded retrieval call matches this request (rule ${rule.id}, key ` +
+                `${key.slice(0, 12)}…). The recording holds ${stats.retrievalTotal} retrieval ` +
+                `call${stats.retrievalTotal === 1 ? '' : 's'}, and this is not one of them`;
+            options.onUnmatched?.({ seq: -1, index: -1, reason });
+            json(res, 502, {
+                error: { message: `agenticreplay replay cannot reproduce ${path}: ${reason}` },
+            });
+            return;
+        }
+        // Record, a fork past what it can serve, or a loose replay: make the call and keep the answer.
+        if (options.mode !== 'record')
+            stats.retrievalLive += 1;
+        await forwardRetrieval(rule, key, rule.batch?.key(parsed), path, rawBody, headers, recordableHeaders, res, startedAt, requestId, forwardBase);
+    }
+    /** A body that has already parsed once. Undefined rather than a throw where it has not. */
+    function safeParse(raw) {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Make a retrieval call for real, and file it as a replayable `net.*` pair. */
+    async function forwardRetrieval(rule, key, batchKey, path, rawBody, headers, recordableHeaders, res, startedAt, requestId, forwardBase) {
+        stats.passedThrough += 1;
+        // On a recording, the count of retrieval calls *captured*. It is the same field replay uses
+        // for "how many the recording holds", which is the same quantity one command later — and it
+        // is what lets `capture.empty` tell an index build, whose every call is a retrieval call and
+        // every one of them replayable, apart from a run that captured nothing at all.
+        if (options.mode === 'record')
+            stats.retrievalTotal += 1;
+        // Verbatim: everything below forwards this request unchanged, so where it says it was going
+        // stands, fork or no fork. See `passthroughOrigin`.
+        const origin = passthroughOrigin(headers, forwardBase, { verbatim: true });
+        let upstreamRes;
+        try {
+            upstreamRes = await doFetch(`${origin}${path}`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', ...headers, ...headersForOrigin(origin) },
+                body: rawBody,
+            });
+        }
+        catch (err) {
+            // The third of the three forwarding paths, and it had the same hole. An index build issues
+            // these hundreds at a time; a gateway that stops answering half way through used to leave
+            // a trace that simply had fewer retrieval calls in it than the run made, with nothing
+            // saying which ones or why.
+            //
+            // `status: 0` and the `net.*` shape, matching `passThrough`: no response header was ever
+            // seen, and a retrieval call is already recorded as network traffic rather than as a
+            // replayable model exchange.
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                method: 'POST',
+                path,
+                intercepted: false,
+                rule: rule.id,
+                replayKey: key,
+                ...(batchKey === undefined ? {} : { batchKey }),
+                requestHeaders: recordableHeaders,
+                requestBody: rawBody,
+                requestBytes: Buffer.byteLength(rawBody),
+                requestTruncated: false,
+                status: 0,
+                responseHeaders: {},
+                responseBody: `agenticreplay did not forward this call: ${reasonFor(err, origin)}`,
+                responseTruncated: false,
+                responseComplete: false,
+                responseError: reasonFor(err, origin),
+                responseBytes: 0,
+                durationMs: Date.now() - startedAt,
+            });
+            throw err;
+        }
+        const responseEncoding = upstreamRes.headers.get('content-encoding') ?? undefined;
+        const responseHeaders = captureResponseHeaders(upstreamRes.headers, responseEncoding !== undefined && responseEncoding.trim() !== '');
+        res.writeHead(upstreamRes.status, {
+            'content-type': responseHeaders['content-type'] ?? 'application/json',
+        });
+        let piped;
+        try {
+            piped = await pipeThrough(upstreamRes, res, options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES, plainBufferLimit);
+        }
+        catch (err) {
+            const partial = err instanceof ResponsePipeAbortedError
+                ? err.partial
+                : err.partial;
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                method: 'POST',
+                path,
+                intercepted: false,
+                rule: rule.id,
+                replayKey: key,
+                ...(batchKey === undefined ? {} : { batchKey }),
+                requestHeaders: recordableHeaders,
+                requestBody: rawBody,
+                requestBytes: Buffer.byteLength(rawBody),
+                requestTruncated: false,
+                status: upstreamRes.status,
+                responseHeaders,
+                responseBody: partial?.text ?? '',
+                responseTruncated: partial?.truncated ?? false,
+                responseComplete: false,
+                responseError: String(err),
+                responseBytes: partial?.bytes ?? 0,
+                ...(err instanceof ResponsePipeAbortedError ? { abandoned: true } : {}),
+                durationMs: Date.now() - startedAt,
+            });
+            if (err instanceof ResponsePipeAbortedError)
+                return;
+            throw err;
+        }
+        const body = piped.text;
+        const digest = createHash('sha256').update(body).digest('hex');
+        const keepBody = (options.retrievalStore ?? 'full') === 'full';
+        const { host, port } = originParts(origin);
+        options.onNetExchange?.({
+            requestId,
+            requestStartedAt: startedAt,
+            host,
+            port,
+            method: 'POST',
+            path,
+            intercepted: false,
+            rule: rule.id,
+            replayKey: key,
+            // Only where the rule offers one. Its absence in a trace means exactly what it says: this
+            // call can be found again by its own body and by nothing else.
+            ...(batchKey === undefined ? {} : { batchKey }),
+            requestHeaders: recordableHeaders,
+            requestBody: rawBody,
+            requestBytes: Buffer.byteLength(rawBody),
+            requestTruncated: false,
+            status: upstreamRes.status,
+            responseHeaders,
+            // Dropped rather than trimmed under `digest`: half a vector is not a smaller answer, it is
+            // a wrong one, and the digest already says whether a later run agreed.
+            responseBody: keepBody ? body : '',
+            responseDigest: digest,
+            responseTruncated: piped.truncated,
+            responseComplete: !piped.truncated && piped.encodingError === undefined,
+            ...(piped.truncated
+                ? { responseError: 'response exceeded capture limit' }
+                : piped.encodingError === undefined
+                    ? {}
+                    : { responseError: piped.encodingError }),
+            responseBytes: piped.bytes,
+            durationMs: Date.now() - startedAt,
+            transformations: [
+                ...captureHeaderTransformations(headers, recordableHeaders),
+                ...captureResponseHeaderTransformations(upstreamRes.headers),
+                ...captureEncodingTransformation('response.body', responseEncoding),
+                ...captureUrlTransformations(origin),
+                ...binaryBodyTransformation('request.body', rawBody),
+                ...binaryBodyTransformation('response.body', body),
+            ],
+        });
+    }
+    /** Split a configured origin into the host and port an exchange records. */
+    function originParts(origin) {
+        try {
+            const url = new URL(origin);
+            return {
+                host: url.hostname,
+                port: url.port !== '' ? Number(url.port) : url.protocol === 'http:' ? 80 : 443,
+            };
+        }
+        catch {
+            // An origin that does not parse is still worth recording under the string we were given —
+            // less anything secret in it. `host` goes into the trace verbatim (`persistNetExchange`
+            // writes it as a `net.request` attr), and §7 says a credential never gets written down.
+            // The trace's own redactor does not cover this: `hunter2` and `key=SECRET123` are under
+            // the 20-character entropy floor and match no shape rule.
+            //
+            // Dead above, live below. A caller that already has a response held a URL undici parsed,
+            // so the fallback cannot run on the success path; `passThrough`'s failure path is the one
+            // place it does, because an origin `new URL` rejects is exactly what made `doFetch` throw.
+            //
+            // `redactString` after the cut, not instead of it: its shape rules and 20-character
+            // entropy floor catch neither `hunter2` nor `key=SECRET123`, so it is a backstop for a
+            // real key that happens to be in there, not the thing doing the work.
+            return { host: redactor.redactString(scrubOrigin(origin)).value, port: 443 };
+        }
+    }
+    /**
+     * Forward a POST no dialect claims, and record that it happened.
+     *
+     * It is recorded as `NetExchange` rather than `RecordedExchange` on purpose: agenticreplay holds the bytes
+     * but not the meaning, so it cannot match this request on replay or rewrite its model on a fork.
+     * Filing it with the model exchanges would inflate `reused=n/m` with turns replay will never
+     * serve, and an operator would be reading a fidelity number that is not one.
+     */
+    /**
+     * An origin string as a host and a port, for the two places that record one.
+     *
+     * An origin that does not parse is still worth recording under the string we were given.
+     */
+    /**
+     * Why the call did not go out, with the origin in it made safe first.
+     *
+     * The message names the request, so it carries the origin — and undici quotes it verbatim:
+     * `Failed to parse URL from gw?key=SECRET123/v1/...`. Running only the prose rules over that
+     * leaves the key in, for the same shapes `scrubOrigin` exists to handle, so the known origin is
+     * replaced by its scrubbed form before the prose pass ever looks at the sentence.
+     */
+    function reasonFor(err, origin) {
+        const scrubbed = String(err).split(origin).join(scrubOrigin(origin));
+        return redactor.redactString(withoutCredentials(scrubbed)).value;
+    }
+    async function passThrough(path, rawBody, headers, recordableHeaders, res, startedAt, requestId, forwardBase, requestEncoding) {
+        // `hybrid` is a fork, and a fork runs a live agent — so it forwards, exactly as `record` does.
+        // Refusing here killed the fork on the first call agenticreplay could not read, which is the failure
+        // passthrough exists to prevent, reintroduced one mode over.
+        if (options.mode === 'replay') {
+            // Strict replay has the network blocked and no recording to serve from — agenticreplay never
+            // understood this call well enough to match it. Say so: a bare 502 mid-replay reads as agenticreplay
+            // being broken, when the honest fact is narrower and more useful than that.
+            stats.unmatched += 1;
+            const reason = `${path} was captured as opaque network traffic, not as a model exchange, so it ` +
+                'cannot be replayed. Recorded with --tls-intercept, or on a path no dialect claims.';
+            options.onUnmatched?.({ seq: -1, index: -1, reason });
+            json(res, 502, {
+                error: { message: `agenticreplay replay cannot reproduce ${path}: ${reason}` },
+            });
+            return;
+        }
+        stats.passedThrough += 1;
+        const origin = passthroughOrigin(headers, forwardBase);
+        let upstreamRes;
+        try {
+            upstreamRes = await doFetch(`${origin}${path}`, {
+                method: 'POST',
+                // `upstreamHeaders` too, as `goLive` does. Omitting them sent a gateway the agent's own
+                // credential — often the `agenticreplay-recorded` placeholder — and the call came back 401 for a
+                // reason nothing in the trace explained.
+                headers: {
+                    'content-type': 'application/json',
+                    ...headers,
+                    ...headersForOrigin(origin),
+                },
+                body: rawBody,
+            });
+        }
+        catch (err) {
+            // An upstream that never answered is still something the agent asked for, and a trace
+            // that leaves it out says the run made fewer calls than it did. Before this the throw
+            // reached the server's catch-all: the agent got its 500 — which was right — and nothing
+            // else happened. No event, no warning, and the replay later blamed "opaque network
+            // traffic" that had never been captured.
+            //
+            // Not an exotic path. `fetchPinned` refuses every redirect on purpose, and a gateway
+            // behind a CDN answers an unknown path with one: `api.orcarouter.ai` sends `301` to its
+            // own marketing site, and MiniMax Code posts to `/v1/responses/input_tokens` before every
+            // call, so two requests per run went missing and said nothing.
+            //
+            // `status: 0` is the same thing it means for an intercepted exchange: no response header
+            // was ever seen. The reason travels in the body, scrubbed, because the message names the
+            // origin it was given.
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                method: 'POST',
+                intercepted: false,
+                path,
+                requestHeaders: recordableHeaders,
+                requestBody: rawBody,
+                requestBytes: Buffer.byteLength(rawBody),
+                requestTruncated: false,
+                status: 0,
+                responseHeaders: {},
+                responseBody: `agenticreplay did not forward this call: ${reasonFor(err, origin)}`,
+                responseTruncated: false,
+                responseComplete: false,
+                responseError: reasonFor(err, origin),
+                responseBytes: 0,
+                durationMs: Date.now() - startedAt,
+            });
+            throw err;
+        }
+        const responseEncoding = upstreamRes.headers.get('content-encoding') ?? undefined;
+        const responseHeaders = captureResponseHeaders(upstreamRes.headers, responseEncoding !== undefined && responseEncoding.trim() !== '');
+        res.writeHead(upstreamRes.status, {
+            'content-type': responseHeaders['content-type'] ?? 'application/json',
+        });
+        let piped;
+        try {
+            piped = await pipeThrough(upstreamRes, res, options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES, plainBufferLimit);
+        }
+        catch (err) {
+            const partial = err instanceof ResponsePipeAbortedError
+                ? err.partial
+                : err.partial;
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                ...originParts(origin),
+                method: 'POST',
+                path,
+                intercepted: false,
+                requestHeaders: recordableHeaders,
+                requestBody: rawBody,
+                requestBytes: Buffer.byteLength(rawBody),
+                requestTruncated: false,
+                status: upstreamRes.status,
+                responseHeaders,
+                responseBody: partial?.text ?? '',
+                responseTruncated: partial?.truncated ?? false,
+                responseComplete: false,
+                responseError: String(err),
+                responseBytes: partial?.bytes ?? 0,
+                ...(err instanceof ResponsePipeAbortedError ? { abandoned: true } : {}),
+                durationMs: Date.now() - startedAt,
+            });
+            if (err instanceof ResponsePipeAbortedError)
+                return;
+            throw err;
+        }
+        const body = piped.text;
+        let host = origin;
+        let port = 443;
+        try {
+            const url = new URL(origin);
+            host = url.hostname;
+            port = url.port !== '' ? Number(url.port) : url.protocol === 'http:' ? 80 : 443;
+        }
+        catch {
+            // An origin that does not parse is still worth recording under the string we were given.
+        }
+        options.onNetExchange?.({
+            requestId,
+            requestStartedAt: startedAt,
+            host,
+            port,
+            method: 'POST',
+            path,
+            // AgenticReplay decrypted nothing here: the harness sent this in plaintext to the local proxy, and
+            // agenticreplay relayed it. Saying otherwise puts a claim about TLS termination in the trace over a
+            // host agenticreplay never terminated TLS for.
+            intercepted: false,
+            // `recordableHeaders`, never `headers`: the auth material was forwarded a moment ago and
+            // must not now be written down. §7 says never write it, which is not the same as never relay it.
+            requestHeaders: recordableHeaders,
+            requestBody: rawBody,
+            requestBytes: Buffer.byteLength(rawBody),
+            requestTruncated: false,
+            status: upstreamRes.status,
+            responseHeaders,
+            responseBody: body,
+            responseTruncated: piped.truncated,
+            responseComplete: !piped.truncated && piped.encodingError === undefined,
+            ...(piped.truncated
+                ? { responseError: 'response exceeded capture limit' }
+                : piped.encodingError === undefined
+                    ? {}
+                    : { responseError: piped.encodingError }),
+            responseBytes: piped.bytes,
+            durationMs: Date.now() - startedAt,
+            transformations: [
+                ...captureHeaderTransformations(headers, recordableHeaders),
+                ...captureEncodingTransformation('request.body', requestEncoding),
+                ...captureResponseHeaderTransformations(upstreamRes.headers),
+                ...captureEncodingTransformation('response.body', responseEncoding),
+                ...captureUrlTransformations(origin),
+                ...binaryBodyTransformation('request.body', rawBody),
+                ...binaryBodyTransformation('response.body', body),
+            ],
+        });
+    }
+    /**
+     * The host a `/forward/` path names, for a rule that wants to tell two vendors apart.
+     *
+     * Only where the request announced its own destination. On an ordinary redirected call agenticreplay knows
+     * where it is *sending* the request but not where the client thought it was going, and inventing
+     * a host would let a rule claim an endpoint on evidence that does not exist.
+     */
+    function forwardHost(forward) {
+        if (forward === undefined)
+            return undefined;
+        try {
+            return new URL(forward.base).hostname;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Did the agent ask for a stream? Both dialects spell it the same way. */
+    function requestedStream(rawBody) {
+        try {
+            return JSON.parse(rawBody).stream === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    function recordableUtf8(bytes) {
+        const text = bytes.toString('utf8');
+        if (Buffer.compare(Buffer.from(text, 'utf8'), bytes) === 0)
+            return { text };
+        return {
+            text: `${BINARY_BODY_PREFIX}${bytes.toString('base64')}`,
+            encodingError: 'unsupported_binary_body',
+        };
+    }
+    class ResponsePipeAbortedError extends Error {
+        partial;
+        constructor(partial, message = 'client closed response') {
+            super(message);
+            this.partial = partial;
+            this.name = 'ResponsePipeAbortedError';
+        }
+    }
+    async function readBoundedResponse(upstream, captureLimit, aggregateLimit) {
+        if (!upstream.body) {
+            const bytesBuffer = Buffer.from(await upstream.arrayBuffer());
+            const bytes = bytesBuffer.byteLength;
+            const decoded = recordableUtf8(bytesBuffer.subarray(0, captureLimit));
+            return {
+                text: decoded.text,
+                bytes,
+                truncated: bytes > captureLimit,
+                ...(decoded.encodingError === undefined ? {} : { encodingError: decoded.encodingError }),
+            };
+        }
+        const reader = upstream.body.getReader();
+        const chunks = [];
+        let capturedBytes = 0;
+        let bytes = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                bytes += value.byteLength;
+                const room = Math.min(captureLimit - capturedBytes, aggregateLimit - plainBufferedBytes);
+                if (room > 0) {
+                    const keep = Math.min(room, value.byteLength);
+                    chunks.push(Buffer.from(value.subarray(0, keep)));
+                    capturedBytes += keep;
+                    plainBufferedBytes += keep;
+                }
+            }
+            const decoded = recordableUtf8(Buffer.concat(chunks));
+            return {
+                text: decoded.text,
+                bytes,
+                truncated: bytes > captureLimit || capturedBytes < bytes,
+                ...(decoded.encodingError === undefined ? {} : { encodingError: decoded.encodingError }),
+            };
+        }
+        finally {
+            plainBufferedBytes = Math.max(0, plainBufferedBytes - capturedBytes);
+        }
+    }
+    async function pipeThrough(upstream, res, captureLimit = Number.MAX_SAFE_INTEGER, aggregateLimit = Number.MAX_SAFE_INTEGER) {
+        const body = upstream.body;
+        if (!body) {
+            const bytesBuffer = Buffer.from(await upstream.arrayBuffer());
+            res.end(bytesBuffer);
+            const bytes = bytesBuffer.byteLength;
+            const decoded = recordableUtf8(bytesBuffer.subarray(0, captureLimit));
+            return {
+                text: decoded.text,
+                bytes,
+                truncated: bytes > captureLimit,
+                ...(decoded.encodingError === undefined ? {} : { encodingError: decoded.encodingError }),
+            };
+        }
+        const reader = body.getReader();
+        const captured = [];
+        let capturedBytes = 0;
+        let bytes = 0;
+        let closed = res.destroyed || res.writableEnded;
+        const onClose = () => {
+            closed = true;
+            void reader.cancel();
+        };
+        res.once('close', onClose);
+        const partial = () => {
+            const buffer = Buffer.concat(captured);
+            const decoded = recordableUtf8(buffer);
+            return {
+                text: decoded.text,
+                bytes,
+                truncated: bytes > captureLimit || capturedBytes < bytes,
+                ...(decoded.encodingError === undefined ? {} : { encodingError: decoded.encodingError }),
+            };
+        };
+        try {
+            for (;;) {
+                if (closed)
+                    throw new ResponsePipeAbortedError(partial());
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                bytes += value.byteLength;
+                if (capturedBytes < captureLimit) {
+                    const aggregateRoom = Math.max(0, aggregateLimit - plainBufferedBytes);
+                    const keep = Math.min(value.byteLength, captureLimit - capturedBytes, aggregateRoom);
+                    if (keep > 0) {
+                        captured.push(Buffer.from(value.subarray(0, keep)));
+                        capturedBytes += keep;
+                        plainBufferedBytes += keep;
+                    }
+                }
+                // Backpressure: if the socket says it is full, wait for it rather than buffering in memory
+                // on the agent's behalf.
+                if (!res.write(value)) {
+                    await new Promise((resolve, reject) => {
+                        const onDrain = () => {
+                            cleanup();
+                            resolve();
+                        };
+                        const onResponseClose = () => {
+                            cleanup();
+                            closed = true;
+                            reject(new ResponsePipeAbortedError(partial()));
+                        };
+                        const cleanup = () => {
+                            res.off('drain', onDrain);
+                            res.off('close', onResponseClose);
+                        };
+                        res.once('drain', onDrain);
+                        res.once('close', onResponseClose);
+                        if (res.destroyed || res.writableEnded)
+                            onResponseClose();
+                    });
+                }
+            }
+        }
+        catch (err) {
+            plainBufferedBytes = Math.max(0, plainBufferedBytes - capturedBytes);
+            if (err instanceof ResponsePipeAbortedError)
+                throw err;
+            if (err instanceof Error) {
+                Object.defineProperty(err, 'partial', { value: partial(), enumerable: false });
+                throw err;
+            }
+            const wrapped = new Error(String(err));
+            Object.defineProperty(wrapped, 'partial', { value: partial(), enumerable: false });
+            throw wrapped;
+        }
+        finally {
+            res.off('close', onClose);
+            res.end();
+        }
+        const buffer = Buffer.concat(captured);
+        const decoded = recordableUtf8(buffer);
+        plainBufferedBytes = Math.max(0, plainBufferedBytes - capturedBytes);
+        return {
+            text: decoded.text,
+            bytes,
+            truncated: bytes > captureLimit || capturedBytes < bytes,
+            ...(decoded.encodingError === undefined ? {} : { encodingError: decoded.encodingError }),
+        };
+    }
+    function buildExchange(input) {
+        const canonicalRequest = input.dialect.toCanonicalRequest(JSON.parse(input.rawRequest));
+        let canonicalResponse;
+        try {
+            canonicalResponse = input.streamed
+                ? input.dialect.parseStream(input.rawResponse)
+                : input.dialect.toCanonicalResponse(JSON.parse(input.rawResponse));
+        }
+        catch {
+            // An unparseable response is still worth recording verbatim — the raw bytes are the
+            // authoritative record, and a canonical view we could not build is not a reason to lose them.
+            canonicalResponse = undefined;
+        }
+        return {
+            seq: input.seq,
+            ...(input.requestId === undefined ? {} : { requestId: input.requestId }),
+            ...(input.requestStartedAt === undefined ? {} : { requestStartedAt: input.requestStartedAt }),
+            dialect: input.dialect.id,
+            path: input.path,
+            rawRequest: input.rawRequest,
+            rawResponse: input.rawResponse,
+            status: input.status,
+            streamed: input.streamed,
+            canonicalRequest,
+            canonicalResponse,
+            usage: canonicalResponse?.usage,
+            requestHeaders: input.headers,
+            ...(input.alpn === undefined ? {} : { alpn: input.alpn }),
+            ...(input.responseDecodedFrom === undefined
+                ? {}
+                : { responseDecodedFrom: input.responseDecodedFrom }),
+            ...(recordableOrigin(input.upstream) === undefined
+                ? {}
+                : { upstream: recordableOrigin(input.upstream) }),
+            durationMs: input.durationMs,
+        };
+    }
+    async function handle(req, res) {
+        const startedAt = Date.now();
+        // Split, not discarded. Two different questions are asked of a request line here and they
+        // want different halves of it: *which endpoint is this* is answered by the path alone —
+        // `selectDialect` matches an endpoint and a query is not part of one — while *what do I
+        // send upstream* wants the line as the client wrote it. Dropping the query at the top answered
+        // the first question and silently lost the second: a client calling
+        // `<base>/chat/completions?api-version=2026-02-01` reached its origin as
+        // `/v1/chat/completions`, which is `404 Resource not found` on Azure OpenAI, where that
+        // parameter is required on every call. The trace lost it too, so nothing in the run said why.
+        const rawPath = req.url ?? '/';
+        const requestId = randomUUID();
+        const path = rawPath.split('?')[0] ?? '/';
+        const query = rawPath.slice(path.length);
+        if (path === '/__agenticreplay/health') {
+            json(res, 200, { ok: true, ...stats });
+            return;
+        }
+        // A `/forward/` path carries the base URL the client was actually given — see
+        // `decodeForwardPath`. The dialect reads the real path behind the prefix, and everything
+        // recorded below does too, so the trace shows the conversation the agent had, not the
+        // envelope agenticreplay wrapped it in.
+        const forward = decodeForwardPath(path);
+        const dialectPath = forward?.path ?? path;
+        /** What goes upstream and into the trace: the endpoint agenticreplay resolved, called the way it was. */
+        const requestedPath = `${dialectPath}${query}`;
+        const dialect = selectDialect(dialects, dialectPath);
+        // Only a POST is ever a model call. Relaxing this to `!dialect && …` let a PUT or a DELETE on
+        // a dialect path through to `goLive`, which forwarded it upstream and recorded it as a model
+        // exchange; and it turned `GET /v1/messages` into a 400 about unreadable JSON rather than the
+        // honest answer. Method first, then passthrough decides what to do with a POST agenticreplay cannot read.
+        if (req.method !== 'POST' && req.headers.upgrade === undefined) {
+            json(res, 404, {
+                error: {
+                    message: `agenticreplay proxy does not handle ${req.method ?? 'GET'} ${dialectPath}`,
+                },
+            });
+            return;
+        }
+        const startHeaders = {};
+        for (const [name, value] of Object.entries(req.headers)) {
+            const key = name.toLowerCase();
+            if (HOP_BY_HOP_HEADERS.has(key) || SECRET_REQUEST_HEADERS.has(key) || value === undefined)
+                continue;
+            startHeaders[key] = value;
+        }
+        const configuredDialectOrigin = dialect
+            ? (options.upstream?.[dialect.id] ??
+                (dialect.id === 'openai-responses' || dialect.id === 'codex'
+                    ? options.upstream?.openai
+                    : undefined) ??
+                dialect.defaultUpstream)
+            : undefined;
+        const startOrigin = dialect
+            ? (forward?.base ?? configuredDialectOrigin)
+            : passthroughOrigin(startHeaders, forward?.base);
+        if (startOrigin === undefined)
+            throw new Error('unable to resolve request destination');
+        const startDestination = originParts(startOrigin);
+        const startRequest = {
+            requestId,
+            requestStartedAt: startedAt,
+            host: startDestination.host,
+            port: startDestination.port,
+            method: req.method ?? 'GET',
+            path: requestedPath,
+            requestHeaders: startHeaders,
+            requestBytes: Buffer.alloc(0),
+            requestTruncated: false,
+        };
+        try {
+            await options.onRequestStart?.(startRequest);
+        }
+        catch (err) {
+            try {
+                options.onNetExchange?.({
+                    ...startRequest,
+                    requestBytes: 0,
+                    requestBody: '',
+                    status: 0,
+                    responseHeaders: {},
+                    responseBody: '',
+                    responseTruncated: false,
+                    responseComplete: false,
+                    responseError: `request-start recorder failed: ${String(err)}`,
+                    responseBytes: 0,
+                    intercepted: false,
+                    durationMs: Date.now() - startedAt,
+                });
+            }
+            catch {
+                // Preserve the recorder failure when terminal persistence cannot itself be recorded.
+            }
+            throw err;
+        }
+        if (req.headers.upgrade !== undefined) {
+            const message = 'unsupported WebSocket transport';
+            const responseBody = JSON.stringify({ error: { message } });
+            options.onNetExchange?.({
+                ...startRequest,
+                requestBytes: 0,
+                requestBody: '',
+                status: 501,
+                responseHeaders: { 'content-type': 'application/json' },
+                responseBody,
+                responseBytes: Buffer.byteLength(responseBody),
+                responseComplete: false,
+                responseTruncated: false,
+                responseError: message,
+                intercepted: false,
+                durationMs: Date.now() - startedAt,
+                transformations: [
+                    {
+                        kind: 'omission',
+                        location: 'transport',
+                        rule: 'unsupported_transport',
+                        count: 1,
+                        reason: 'WebSocket frames are not captured',
+                    },
+                ],
+            });
+            json(res, 501, { error: { message } });
+            return;
+        }
+        let rawBody;
+        let requestBytes;
+        let requestReservedBytes = 0;
+        try {
+            const read = await readBody(req, options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES);
+            rawBody = decodeBody(read.body, Array.isArray(req.headers['content-encoding'])
+                ? req.headers['content-encoding'].join(', ')
+                : req.headers['content-encoding'], options.maxCapturedBytes ?? DEFAULT_MAX_CAPTURED_BYTES);
+            requestBytes = read.bytes;
+            requestReservedBytes = Buffer.byteLength(rawBody);
+            if (plainBufferedBytes + requestReservedBytes > plainBufferLimit) {
+                throw new BodyLimitError(requestReservedBytes, plainBufferLimit);
+            }
+            plainBufferedBytes += requestReservedBytes;
+        }
+        catch (err) {
+            if (!(err instanceof BodyLimitError)) {
+                options.onNetExchange?.({
+                    requestId,
+                    requestStartedAt: startedAt,
+                    host: req.headers.host ?? 'local',
+                    port: 0,
+                    intercepted: false,
+                    method: req.method ?? 'POST',
+                    path: requestedPath,
+                    requestHeaders: {},
+                    requestBody: '',
+                    requestBytes: 0,
+                    requestTruncated: true,
+                    status: 0,
+                    responseHeaders: {},
+                    responseBody: '',
+                    responseTruncated: false,
+                    responseComplete: false,
+                    responseError: String(err),
+                    responseBytes: 0,
+                    durationMs: Date.now() - startedAt,
+                });
+                json(res, 400, {
+                    error: { message: `agenticreplay could not decode request body: ${String(err)}` },
+                });
+                return;
+            }
+            options.onNetExchange?.({
+                requestId,
+                requestStartedAt: startedAt,
+                host: req.headers.host ?? 'local',
+                port: 0,
+                intercepted: false,
+                method: req.method ?? 'POST',
+                path: requestedPath,
+                requestHeaders: {},
+                requestBody: '',
+                requestBytes: err.bytes,
+                requestTruncated: true,
+                status: 0,
+                responseHeaders: {},
+                responseBody: '',
+                responseTruncated: false,
+                responseComplete: false,
+                responseError: String(err),
+                responseBytes: 0,
+                durationMs: Date.now() - startedAt,
+            });
+            json(res, 413, { error: { message: String(err) } });
+            return;
+        }
+        const inboundRequestHeader = req.headers['content-encoding'];
+        const inboundRequestEncoding = Array.isArray(inboundRequestHeader)
+            ? inboundRequestHeader.join(', ')
+            : inboundRequestHeader;
+        try {
+            const headers = {};
+            const recordableHeaders = {};
+            for (const [k, v] of Object.entries(req.headers)) {
+                const key = k.toLowerCase();
+                if (HOP_BY_HOP_HEADERS.has(key))
+                    continue;
+                if (v === undefined)
+                    continue;
+                headers[k] = Array.isArray(v) ? v.join(', ') : v;
+            }
+            // Node's parsed headers combine repeated fields. Keep the raw field order and multiplicity
+            // for persisted evidence while retaining the scalar map above for fetch forwarding.
+            for (let index = 0; index + 1 < req.rawHeaders.length; index += 2) {
+                const key = req.rawHeaders[index].toLowerCase();
+                if (HOP_BY_HOP_HEADERS.has(key) || SECRET_REQUEST_HEADERS.has(key))
+                    continue;
+                const value = req.rawHeaders[index + 1];
+                const prior = recordableHeaders[key];
+                recordableHeaders[key] =
+                    prior === undefined ? value : Array.isArray(prior) ? [...prior, value] : [prior, value];
+            }
+            // `decodeBody` above gives the origin the serialized JSON rather than the compressed wire
+            // bytes. Remove the stale framing headers or the origin will try to decompress plaintext.
+            if (headers['content-encoding'] !== undefined) {
+                delete headers['content-encoding'];
+                delete recordableHeaders['content-encoding'];
+                const length = String(Buffer.byteLength(rawBody));
+                headers['content-length'] = length;
+                recordableHeaders['content-length'] = length;
+            }
+            if (!dialect) {
+                // Before passthrough, and only where no dialect claims the path: a dialect is the richer
+                // reading of a call — replayable, forkable, counted in `exact` — and a rule that outranked
+                // one would turn a chat completion into opaque bytes keyed by their own body.
+                const rule = selectRetrievalRule(retrievalRules, dialectPath, forwardHost(forward));
+                if (rule && isReadable(rawBody)) {
+                    await serveRetrieval(rule, requestedPath, rawBody, headers, recordableHeaders, res, startedAt, requestId, forward?.base);
+                    return;
+                }
+                await passThrough(requestedPath, rawBody, headers, recordableHeaders, res, startedAt, requestId, forward?.base, inboundRequestEncoding);
+                return;
+            }
+            // Parsed here rather than inside `goLive`, which read it unguarded — so a body agenticreplay could not
+            // read reached the server's catch-all and came back as `500 SyntaxError: …`. To whoever is
+            // running the agent that reads as agenticreplay falling over, and sends them to agenticreplay's issue tracker
+            // instead of to the line of their own harness that sent it. Replay already answered 400.
+            if (!isReadable(rawBody)) {
+                const errorBody = {
+                    error: {
+                        message: `agenticreplay proxy could not read the body of POST ${dialectPath}: expected JSON, got ` +
+                            `${rawBody === '' ? 'an empty body' : `${rawBody.length} bytes that do not parse`}`,
+                    },
+                };
+                options.onNetExchange?.({
+                    requestId,
+                    requestStartedAt: startedAt,
+                    host: req.headers.host ?? 'local',
+                    port: 0,
+                    intercepted: false,
+                    method: req.method ?? 'POST',
+                    path: requestedPath,
+                    requestHeaders: recordableHeaders,
+                    requestBody: rawBody,
+                    requestBytes,
+                    requestTruncated: false,
+                    status: 400,
+                    responseHeaders: { 'content-type': 'application/json' },
+                    responseBody: JSON.stringify(errorBody),
+                    responseTruncated: false,
+                    responseComplete: true,
+                    responseBytes: Buffer.byteLength(JSON.stringify(errorBody)),
+                    durationMs: Date.now() - startedAt,
+                    transformations: binaryBodyTransformation('request.body', rawBody),
+                });
+                json(res, 400, errorBody);
+                return;
+            }
+            if (options.mode === 'record') {
+                await goLive(dialect, requestedPath, rawBody, headers, recordableHeaders, res, startedAt, requestId, inboundRequestEncoding, forward?.base);
+                return;
+            }
+            // Replay and hybrid: try the recording first.
+            let canonical;
+            try {
+                canonical = dialect.toCanonicalRequest(JSON.parse(rawBody));
+            }
+            catch (err) {
+                json(res, 400, { error: { message: `unparseable request body: ${String(err)}` } });
+                return;
+            }
+            const beyondFork = options.mode === 'hybrid' && matcher.cursor >= (options.forkAt ?? replayable.length);
+            if (!beyondFork) {
+                const result = matcher.match(canonical);
+                if (result.matched) {
+                    const exchange = replayable[result.index];
+                    if (result.reordered)
+                        stats.reordered += 1;
+                    if (result.divergence) {
+                        stats.matchedInexact += 1;
+                        stats.divergences += 1;
+                        options.onDivergence?.({ ...result.divergence, seq: exchange.seq });
+                    }
+                    else {
+                        stats.matchedExact += 1;
+                    }
+                    res.writeHead(exchange.status, {
+                        'content-type': exchange.streamed ? 'text/event-stream' : 'application/json',
+                    });
+                    res.end(exchange.rawResponse);
+                    return;
+                }
+                stats.unmatched += 1;
+                // Hybrid mode is *supposed* to continue live here — that is what forking means — but spec §4
+                // says replay must not silently approximate, and every inexact match is an event in the
+                // trace. Without this a fork could start diverging below its own fork point and every
+                // artifact it produced would look clean. Going live is the right behaviour; being quiet
+                // about it is not.
+                if (options.mode === 'hybrid' || options.loose) {
+                    stats.divergences += 1;
+                    options.onDivergence?.({
+                        level: 'major',
+                        rung: 4,
+                        distance: -1,
+                        detail: result.reason ?? 'request does not match the recording; served live instead',
+                        seq: replayable[result.index]?.seq ?? -1,
+                    });
+                }
+                if (!options.loose && options.mode === 'replay') {
+                    // Halt loudly. Inventing a reply here would make every downstream conclusion worthless.
+                    const reason = result.reason ?? 'request does not match the recording';
+                    options.onUnmatched?.({
+                        seq: replayable[result.index]?.seq ?? -1,
+                        index: result.index,
+                        reason,
+                    });
+                    // 400, emphatically not 409. Every mainstream client retries 408/409/429/5xx by default,
+                    // so a 409 halt is re-sent until the retry budget is gone — the operator gets a stalled
+                    // terminal and no reason, which is strictly worse than a wrong answer because it looks
+                    // like a hang in agenticreplay rather than a mismatch in the recording. 400 is terminal everywhere.
+                    //
+                    // The envelope is the provider's own error shape for the same reason: clients read
+                    // `error.message` and print it, so this sentence is what actually reaches the human.
+                    json(res, 400, {
+                        type: 'error',
+                        error: {
+                            type: 'invalid_request_error',
+                            message: `agenticreplay: replay halted — ${reason}. ` +
+                                'Re-run with `agenticreplay replay <run> --loose` to continue live from this point, ' +
+                                'or `agenticreplay show <run>` to see what was recorded.',
+                        },
+                    });
+                    return;
+                }
+            }
+            await goLive(dialect, requestedPath, rawBody, headers, recordableHeaders, res, startedAt, requestId, inboundRequestEncoding, forward?.base);
+        }
+        finally {
+            plainBufferedBytes = Math.max(0, plainBufferedBytes - requestReservedBytes);
+        }
+    }
+    const host = options.host ?? '127.0.0.1';
+    await new Promise((resolve) => server.listen(options.port ?? 0, host, resolve));
+    const port = server.address().port;
+    return {
+        url: `http://${host}:${port}`,
+        port,
+        stats: () => ({ ...stats }),
+        exchanges: () => captured.slice(),
+        ...(options.tls && interception
+            ? {
+                tls: {
+                    hosts: interception.policy.describe(),
+                    fingerprint: options.tls.ca.fingerprint,
+                    caCertPath: options.tls.ca.certPath,
+                    caBundlePath: options.tls.ca.bundlePath,
+                },
+            }
+            : {}),
+        close: () => new Promise((resolve, reject) => {
+            // Tunnels and decrypted sessions are long-lived by design, and `close` waits for every
+            // open connection. Without this a recorded run would hang on exit behind an agent's idle
+            // keep-alive socket.
+            interception?.close();
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+//# sourceMappingURL=server.js.map