codetac 0.1.0 → 0.2.0

package/src/python/codetac_py/writer.py

@@ -0,0 +1,237 @@
+"""Batched JSONL writer, with the same format and policy as src/runtime.mjs.
+
+Events are queued and written every 25 ms by a daemon thread. Adding an
+event is a single deque append, and the enter/exit events of the capture are
+queued as tuples of values and turned into JSON lines in the batch (stage 5):
+formatting was most of the cost per call, and in a web app the batch is
+written while the app waits. The order inside a file is the order of
+`sequence`. The queue is flushed at exit and on SIGINT/SIGTERM/SIGHUP; a
+SIGKILL or os._exit loses the last 25 ms. At exit the thread is stopped and
+joined before the last flush: a daemon thread that wakes while the
+interpreter shuts down crashed CPython 3.12 (SIGSEGV in take_gil, stage 8;
+the M71 failure of stage 7).
+
+CodeTAC's own batches are written with os.open/os.write/os.close, so they
+never appear as file writes of the app.
+
+Keep it importable on old Pythons (3.8+): the minimal mode uses it too.
+"""
+import atexit
+import collections
+import itertools
+import json
+import os
+import signal
+import sys
+import threading
+import time
+
+from .redact import create_redactor
+
+FLUSH_SECONDS = 0.025
+INSTALL = os.path.realpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', '..', '..'))
+RUN_NAME = r'^[a-zA-Z0-9_-]{1,80}$'
+
+
+def data_directory(env=None):
+    """Same order as src/home.mjs: CODETAC_HOME, the Git checkout, ~/.codetac."""
+    env = os.environ if env is None else env
+    if env.get('CODETAC_HOME'):
+        return os.path.abspath(env['CODETAC_HOME'])
+    if os.path.exists(os.path.join(INSTALL, '.git')):
+        return os.path.join(INSTALL, '.codetac')
+    return os.path.join(os.path.expanduser('~'), '.codetac')
+
+
+class Writer(object):
+    def __init__(self, directory, flush_seconds=FLUSH_SECONDS):
+        self.directory = directory  # created with the first batch
+        self.flush_seconds = flush_seconds
+        self.redact = create_redactor()
+        self.disabled = False
+        self.start_event = None
+        self.header = None
+        # One queue for the life of the process: the capture keeps its append.
+        self.queue = collections.deque()
+        # Reentrant: a signal handler may flush while the main thread is flushing.
+        self.lock = threading.RLock()
+        self.thread = None
+        self.stopping = threading.Event()
+        # Called every 400 ms by the writer's thread (detalhe.json, detail.py).
+        self.periodic = []
+        self._name_process()
+        # Registered first, so it runs after the app's own atexit handlers.
+        atexit.register(self.close)
+        if hasattr(os, 'register_at_fork'):
+            os.register_at_fork(after_in_child=self._after_fork)
+
+    def _name_process(self):
+        """A new file per process, with its own sequence."""
+        pid = os.getpid()
+        self.process = '%d:0' % pid
+        self.file = os.path.join(self.directory, '%d-0-%s.jsonl' % (pid, os.urandom(16).hex()))
+        self.prefix = '{"version":1,"process":"%s","sequence":' % self.process
+        # Node ids are "<process>:<n>"; kept as the opening of a JSON string.
+        self.id_prefix = '"%s:' % self.process
+        self.sequence = itertools.count(1)
+
+    def _after_fork(self):
+        """The child drops the parent's batch and starts its own file, with its own capture-start."""
+        self.queue.clear()
+        self.lock = threading.RLock()
+        self.thread = None
+        self.stopping = threading.Event()
+        self._name_process()
+        if self.start_event is not None:
+            self.header = self.line(self.redact_fragment(self.start_event))
+            self._start_thread()
+
+    def line(self, body):
+        """`body` is a JSON object fragment without braces, already redacted."""
+        return '%s%d,"timeNs":%d,%s}\n' % (self.prefix, next(self.sequence), time.perf_counter_ns(), body)
+
+    def start(self, event):
+        """capture-start: the first line of the file, written with the first real event, so
+        that a process that never runs anything of the project (a supervisor, a helper
+        started by multiprocessing) leaves no file."""
+        self.start_event = event
+        self.header = self.line(self.redact_fragment(event))
+        self._start_thread()
+
+    @property
+    def active(self):
+        """Whether this process has written, or queued, anything beyond capture-start."""
+        return self.start_event is not None and (self.header is None or len(self.queue) > 0)
+
+    def write(self, line):
+        self.queue.append(line)
+
+    def _format(self, parts):
+        """Lines as they are; the capture's tuples as the lines of src/runtime.mjs."""
+        prefix, ids = self.prefix, self.id_prefix
+        lines = []
+        for item in parts:
+            if item.__class__ is str:
+                lines.append(item)
+            elif item[0] == 1:  # (1, sequence, time, node, parent, request, metadata)
+                _, sequence, at, node, parent, request, info = item
+                lines.append('%s%d,"timeNs":%d,"type":"enter","id":%s%d","parentId":%s,"requestId":%s,%s}\n' % (
+                    prefix, sequence, at, ids, node, 'null' if parent is None else '%s%d"' % (ids, parent), request, info))
+            else:  # (0, sequence, time, node, request, error, duration)
+                _, sequence, at, node, request, error, duration = item
+                lines.append('%s%d,"timeNs":%d,"type":"exit","id":%s%d","requestId":%s,"error":%s,"durationNs":%d}\n' % (
+                    prefix, sequence, at, ids, node, request, error, duration))
+        return lines
+
+    def emit(self, event):
+        self.queue.append(self.line(self.redact_fragment(event)))
+
+    def redact_fragment(self, event):
+        """Redacted and serialised once, for metadata repeated in many events."""
+        return json.dumps(self.redact(event), ensure_ascii=False, separators=(',', ':'))[1:-1]
+
+    def _start_thread(self):
+        with self.lock:
+            if self.thread is None:
+                thread = threading.Thread(target=self._loop, name='codetac-writer', daemon=True)
+                thread.start()
+                self.thread = thread
+
+    def _loop(self):
+        queue, stopping = self.queue, self.stopping
+        waited = 0.0
+        while not stopping.wait(self.flush_seconds):
+            if queue:
+                self.flush()
+            waited += self.flush_seconds
+            if waited >= 0.4 and self.periodic:
+                waited = 0.0
+                for task in self.periodic:
+                    try:
+                        task()
+                    except Exception:
+                        pass
+
+    def close(self):
+        """At exit: the thread stops before the interpreter shuts down, then the last flush."""
+        self.stopping.set()
+        thread = self.thread
+        if thread is not None and thread is not threading.current_thread():
+            thread.join(2)
+        self.flush()
+
+    def flush(self):
+        with self.lock:
+            queue = self.queue
+            count = len(queue)
+            if not count:
+                return
+            parts = [queue.popleft() for _ in range(count)]
+            if self.disabled:
+                return
+            lines = self._format(parts)
+            if self.header is not None:
+                lines.insert(0, self.header)
+                self.header = None
+            data = ''.join(lines).encode('utf-8', 'replace')
+            try:
+                if not os.path.isdir(self.directory):
+                    os.makedirs(self.directory, mode=0o700, exist_ok=True)
+                fd = os.open(self.file, os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o600)
+                try:
+                    view = memoryview(data)
+                    while view:
+                        view = view[os.write(fd, view):]
+                finally:
+                    os.close(fd)
+            except OSError:
+                self.disabled = True
+                sys.stderr.write('[CodeTAC] Gravação indisponível; a aplicação continua sem captura.\n')
+
+
+# Signals. The flush runs first, then whatever the app installed. Handlers the
+# app installs later (uvicorn, asyncio, gunicorn...) are wrapped the same way
+# by signal.signal, and signal.getsignal still returns the app's own. With no
+# handler of the app, the default termination follows: the signal is raised
+# again with SIG_DFL.
+SIGNALS = ('SIGINT', 'SIGTERM', 'SIGHUP')
+
+
+def install_signals(flush):
+    if threading.current_thread() is not threading.main_thread():
+        return
+    numbers = set(getattr(signal, name) for name in SIGNALS if hasattr(signal, name))
+    original_signal = signal.signal
+    original_getsignal = signal.getsignal
+
+    def unwrap(handler):
+        return getattr(handler, '__codetac_app_handler__', handler)
+
+    def wrap(handler):
+        def codetac_signal(number, frame):
+            flush()
+            if callable(handler):
+                return handler(number, frame)
+            original_signal(number, signal.SIG_DFL)
+            os.kill(os.getpid(), number)
+        codetac_signal.__codetac_app_handler__ = handler
+        return codetac_signal
+
+    def codetac_signal_signal(number, handler):
+        if number in numbers and handler != signal.SIG_IGN and not hasattr(handler, '__codetac_app_handler__'):
+            handler = wrap(handler)
+        return unwrap(original_signal(number, handler))
+
+    def codetac_getsignal(number):
+        return unwrap(original_getsignal(number))
+
+    codetac_signal_signal.__doc__ = original_signal.__doc__
+    codetac_getsignal.__doc__ = original_getsignal.__doc__
+    for number in numbers:
+        current = original_getsignal(number)
+        # An ignored signal stays ignored (nohup); a handler set outside
+        # Python (None) is left alone.
+        if current is not None and current != signal.SIG_IGN:
+            original_signal(number, wrap(current))
+    signal.signal = codetac_signal_signal
+    signal.getsignal = codetac_getsignal

package/src/python/probe.py

@@ -0,0 +1,99 @@
+"""What the codetac command needs to know about a project's Python (Stage 12):
+its version, the servers and frameworks it can import, and the declared
+dependencies that are not installed. Run with the project's interpreter:
+
+    <python> probe.py <project folder>
+
+Prints one JSON object. Imports nothing of the project: modules are looked up
+with importlib.util.find_spec and distributions with importlib.metadata.
+Keep it runnable on old Pythons (3.8+): below the minimum the command still
+explains the minimal mode.
+"""
+import json
+import os
+import re
+import sys
+
+MODULES = ['fastapi', 'fastapi_cli', 'uvicorn', 'flask', 'gunicorn', 'hypercorn', 'granian', 'waitress', 'starlette']
+NAME = re.compile(r'^\s*([A-Za-z0-9][A-Za-z0-9._-]*)')
+
+
+def normalise(name):
+    return re.sub(r'[-_.]+', '-', name).lower()
+
+
+def pyproject_dependencies(folder):
+    """The [project] dependencies of pyproject.toml, as written (tomllib: 3.11+)."""
+    try:
+        import tomllib
+        with open(os.path.join(folder, 'pyproject.toml'), 'rb') as file:
+            project = tomllib.load(file).get('project') or {}
+        return [str(item) for item in project.get('dependencies') or []]
+    except Exception:
+        return []
+
+
+def requirement_names(folder):
+    """Names from requirements*.txt and pyproject.toml ([project] dependencies)."""
+    names = []
+    for file in sorted(os.listdir(folder)):
+        if not re.match(r'^requirements.*\.txt$', file) or re.search(r'(dev|test|lint|doc)', file):
+            continue
+        try:
+            lines = open(os.path.join(folder, file), encoding='utf-8').read().splitlines()
+        except (OSError, UnicodeDecodeError):
+            continue
+        for line in lines:
+            line = line.split('#', 1)[0].strip()
+            # Options (-r, -e, --index-url) and URLs are not names.
+            if not line or line.startswith('-') or '://' in line:
+                continue
+            match = NAME.match(line)
+            if match:
+                names.append(match.group(1))
+    for item in pyproject_dependencies(folder):
+        match = NAME.match(item)
+        if match:
+            names.append(match.group(1))
+    return names
+
+
+def main():
+    folder = sys.argv[1] if len(sys.argv) > 1 else os.getcwd()
+    import importlib.util
+    found = []
+    for module in MODULES:
+        try:
+            if importlib.util.find_spec(module) is not None:
+                found.append(module)
+        except Exception:
+            pass
+    # `python -m fastapi dev` needs fastapi/__main__.py (FastAPI 0.111+), not only fastapi_cli.
+    if 'fastapi' in found:
+        try:
+            spec = importlib.util.find_spec('fastapi')
+            locations = list(spec.submodule_search_locations or [])
+            if any(os.path.exists(os.path.join(location, '__main__.py')) for location in locations):
+                found.append('fastapi.__main__')
+        except Exception:
+            pass
+    missing = []
+    try:
+        from importlib import metadata
+        installed = set(normalise(dist.metadata['Name'] or '') for dist in metadata.distributions())
+        for name in requirement_names(folder):
+            if normalise(name) not in installed and name not in missing:
+                missing.append(name)
+    except Exception:
+        pass
+    print(json.dumps({
+        'version': '%d.%d.%d' % sys.version_info[:3],
+        'executable': sys.executable,
+        'virtual': sys.prefix != getattr(sys, 'base_prefix', sys.prefix),
+        'modules': found,
+        'missing': missing,
+        'pyproject': pyproject_dependencies(folder),
+    }))
+
+
+main()

package/src/recording.mjs

@@ -47,14 +47,26 @@ export function createSummary() {
   const summary = {
     starts: [], ports: new Set(), addresses: new Map(), pages: 0, requests: 0, withFunctions: new Set(), withBoundaries: new Set(),
     actions: new Set(), files: 0, functions: 0, emptyFiles: 0, failed: [], limitations: new Map(), processes: new Set(),
-    firstAction: null, firstRequest: null, firstPage: null, pagePath: null,
+    firstAction: null, firstRequest: null, firstPage: null, pagePath: null, servers: new Set(), supervisors: new Set(),
   };
+  // Modules per process: a supervisor (the reloader of flask run --debug, fastapi dev)
+  // imports the app too, and its modules would count twice.
+  const modules = new Map();
   summary.add = event => {
     if (event.process) summary.processes.add(event.process);
     switch (event.type) {
-      case 'capture-start': summary.starts.push({ level: event.level, reason: event.reason, root: event.root, node: event.node }); break;
+      case 'capture-start': summary.starts.push({ level: event.level, reason: event.reason, root: event.root, node: event.node, python: event.python, process: event.process }); break;
       case 'listening':
         if (event.port) { summary.ports.add(event.port); summary.addresses.set(event.port, event.address); }
+        if (event.server) summary.servers.add(event.server);
+        break;
+      case 'process':
+        if (event.role === 'supervisor' && !summary.supervisors.has(event.process)) {
+          summary.supervisors.add(event.process);
+          const own = modules.get(event.process);
+          if (own) { summary.files -= own.files; summary.functions -= own.functions; summary.emptyFiles -= own.empty; }
+          if (event.server) summary.servers.add(event.server);
+        }
         break;
       case 'page': summary.pages++; summary.pagePath = event.path; break;
       case 'request':
@@ -67,12 +79,18 @@ export function createSummary() {
         if (!summary.actions.has(event.actionId)) summary.firstAction ??= event;
         summary.actions.add(event.actionId);
         break;
-      case 'module':
-        if (event.cached || isLibraryFile(event.file ?? '')) break;
+      case 'module': {
+        if (event.cached || isLibraryFile(event.file ?? '') || summary.supervisors.has(event.process)) break;
         summary.files++;
         summary.functions += event.functions ?? 0;
         if (!event.functions) summary.emptyFiles++;
+        const own = modules.get(event.process) ?? { files: 0, functions: 0, empty: 0 };
+        own.files++;
+        own.functions += event.functions ?? 0;
+        if (!event.functions) own.empty++;
+        modules.set(event.process, own);
         break;
+      }
       case 'limitation':
         summary.limitations.set(event.reason, (summary.limitations.get(event.reason) ?? 0) + 1);
         if (event.reason === 'module-transform-failed' || event.reason === 'source-map-unreadable') summary.failed.push({ file: event.file, detail: event.detail });

package/src/runtime.mjs

@@ -195,8 +195,11 @@ export function createRuntime(directory, { flushBytes = FLUSH_BYTES, flushMs = F
     const parent = context.getStore();
     const requestId = `${processId}:r${++requests}`;
     const { path, queryKeys } = splitUrl(req.url ?? '/');
+    // A page of another origin calling this server (no proxy): origin and host
+    // (scheme, name and port only) let the store make a probable link.
+    const cross = crossOrigin(req.headers?.origin, req.headers?.host);
     emit({ type: 'request', requestId, parentId: current().parentId, method: req.method, path, queryKeys, at: Date.now(),
-      action: action?.action, actionRequest: action?.actionRequest ?? undefined });
+      action: action?.action, actionRequest: action?.actionRequest ?? undefined, origin: cross?.origin, host: cross?.host });
     const start = process.hrtime.bigint();
     let done = false;
     // Cookies the response sets or deletes: names only, never values. Headers
@@ -268,6 +271,15 @@ export function cookieNames(header, written) {
   return [...result.values()];
 }
 
+// Same rule as cross_origin in src/python/codetac_py/servers.py.
+export function crossOrigin(origin, host) {
+  if (typeof origin !== 'string' || typeof host !== 'string' || origin === 'null') return null;
+  let url;
+  try { url = new URL(origin); } catch { return null; }
+  if (!['http:', 'https:'].includes(url.protocol) || !url.host || url.host === host) return null;
+  return { origin: `${url.protocol}//${url.host}`, host };
+}
+
 // A readable copy of a value for the detail view: plain JSON, bounded in
 // depth, length and size. Getters are not called (they could change state);
 // class instances keep their class name. Redaction happens when it is emitted.

package/src/sentences.mjs

@@ -40,6 +40,8 @@ const PT = {
   // Funções
   calls: items => `chama ${items}`,
   noBoundary: 'Trabalho interno: nenhuma fronteira observada',
+  opaque: 'Não observável: corre em código compilado ou gerado que o CodeTAC não consegue ver por dentro',
+  templatePart: file => `monta HTML a partir de ${file}`,
   error: 'terminou com erro',
   unfinished: 'não terminou durante a gravação',
   dbSetupPart: n => `executa ${n} comandos de estrutura da base de dados`,
@@ -117,6 +119,8 @@ const EN = {
   auth: (provider, operation) => `Authentication with ${provider}${operation ? `: ${operation}` : ''}`,
   calls: items => `calls ${items}`,
   noBoundary: 'Internal work: no boundary observed',
+  opaque: 'Not observable: runs in compiled or generated code that CodeTAC cannot see into',
+  templatePart: file => `renders HTML from ${file}`,
   error: 'ended with an error',
   unfinished: 'did not finish during the recording',
   dbSetupPart: n => `runs ${n} database structure commands`,

package/src/store.mjs

@@ -19,6 +19,15 @@ export function actionLabel(trigger) {
   return `${kind}${text ? ` «${text}»` : ''}${suffix}`;
 }
 
+// The deepest folder that holds both paths (absolute, "/"-separated).
+export function commonFolder(a, b) {
+  const left = a.split('/');
+  const right = b.split('/');
+  let index = 0;
+  while (index < left.length && index < right.length && left[index] === right[index]) index++;
+  return left.slice(0, index).join('/') || '/';
+}
+
 export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
   const directory = resolve(folder);
   // A new installation has no data folder yet (~/.codetac).
@@ -45,6 +54,11 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
   if (!columns.has('cookies')) db.exec('alter table requests add column cookies text;');
   // Phase 5: the request that loaded a page (it received the bar).
   if (!columns.has('document')) db.exec('alter table requests add column document integer;');
+  // Python stage 9: where the request ended in its process, to tell the work
+  // done after the response (background tasks) from the rest.
+  if (!columns.has('end_sequence')) db.exec('alter table requests add column end_sequence integer;');
+  // Python stage 10 (DP3): requests from a page of another origin, for the probable link.
+  if (!columns.has('origin')) db.exec('alter table requests add column origin text; alter table requests add column host text;');
   db.exec('create index if not exists requests_action on requests(action)');
   // Phase 5: why a recording is in minimal mode.
   if (!db.prepare('pragma table_info(runs)').all().some(column => column.name === 'reason')) db.exec('alter table runs add column reason text;');
@@ -65,10 +79,12 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
   const statements = {
     offset: db.prepare('select offset from ingested where file = ?'),
     setOffset: db.prepare('insert into ingested(file, offset) values (?, ?) on conflict(file) do update set offset = excluded.offset'),
-    run: db.prepare('insert into runs(run, root, node, level, reason) values (?, ?, ?, ?, ?) on conflict(run) do update set root = excluded.root, node = excluded.node, level = excluded.level, reason = excluded.reason'),
-    request: db.prepare('insert or ignore into requests(request_id, run, process, method, path, query_keys, at, action, action_request) values (?, ?, ?, ?, ?, ?, ?, ?, ?)'),
+    run: db.prepare('insert into runs(run, root, node, level, reason) values (?, ?, ?, ?, ?) on conflict(run) do update set root = excluded.root, node = coalesce(excluded.node, runs.node), level = excluded.level, reason = excluded.reason'),
+    runRoot: db.prepare('select root from runs where run = ?'),
+    probable: db.prepare('select request_id, method, at from requests where action is null and origin = ? and host = ? and path = ? and at between ? and ? order by at'),
+    request: db.prepare('insert or ignore into requests(request_id, run, process, method, path, query_keys, at, action, action_request, origin, host) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'),
     action: db.prepare('insert or replace into actions(action_id, segment, run, at, data) values (?, ?, ?, ?, ?)'),
-    requestEnd: db.prepare('update requests set status = ?, duration_ns = ?, aborted = ?, cookies = ?, ended = 1 where request_id = ?'),
+    requestEnd: db.prepare('update requests set status = ?, duration_ns = ?, aborted = ?, cookies = ?, ended = 1, end_sequence = ? where request_id = ? and process = ?'),
     event: db.prepare('insert or ignore into events(request_id, process, sequence, type, id, data) values (?, ?, ?, ?, ?, ?)'),
     limitation: db.prepare('insert or ignore into limitations(run, file, reason, line, detail) values (?, ?, ?, ?, ?)'),
     document: db.prepare('update requests set document = 1 where request_id = ?'),
@@ -97,17 +113,24 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
       let event;
       try { event = JSON.parse(line); } catch { continue; }
       switch (event.type) {
-        case 'capture-start': statements.run.run(run, event.root ?? null, event.node ?? null, event.level ?? null, event.reason ?? null); break;
+        case 'capture-start': {
+          // Several processes may share a recording (a Vite frontend and a
+          // Python API): the root is the folder common to all of theirs.
+          const known = statements.runRoot.get(run)?.root;
+          statements.run.run(run, known && event.root ? commonFolder(known, event.root) : event.root ?? known ?? null,
+            event.node ?? null, event.level ?? null, event.reason ?? null);
+          break;
+        }
         case 'page': pages.set(event.process, event.path); break;
         case 'request':
           if (pages.get(event.process) === event.path) { pages.delete(event.process); documents.add(event.requestId); }
           statements.request.run(event.requestId, run, event.process, event.method, event.path,
-          JSON.stringify(event.queryKeys ?? []), event.at ?? null, event.action ?? null, event.actionRequest ?? null);
+          JSON.stringify(event.queryKeys ?? []), event.at ?? null, event.action ?? null, event.actionRequest ?? null, event.origin ?? null, event.host ?? null);
           if (documents.has(event.requestId)) statements.document.run(event.requestId);
           break;
         case 'browser-action': statements.action.run(event.actionId, event.segment ?? 1, run, event.startedAt ?? null, line); break;
         case 'request-end': statements.requestEnd.run(event.status ?? null, event.durationNs ?? null, event.aborted ? 1 : 0,
-          event.cookies ? JSON.stringify(event.cookies) : null, event.requestId); break;
+          event.cookies ? JSON.stringify(event.cookies) : null, event.sequence ?? null, event.requestId, event.process); break;
         case 'limitation': statements.limitation.run(run, event.file ?? '', event.reason ?? '', event.line ?? null, event.detail ?? null); break;
         case 'enter': case 'exit': case 'boundary': case 'boundary-end': case 'detail':
           if (event.requestId) statements.event.run(event.requestId, event.process, event.sequence, event.type, event.id, line);
@@ -189,6 +212,25 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
     const timeline = [];
     const take = number => server.filter(item => item.number === number && !used.has(item.dossier.request.requestId))
       .map(item => { used.add(item.dossier.request.requestId); return item.dossier; });
+    // DP3 (b): a request of the page to another origin (the API on another
+    // port, without a proxy) cannot carry the action without changing the
+    // app (CORS). It is linked, as probable, to the request that server got
+    // from this page's origin, for the same host, method and path, while the
+    // browser waited for it; the CORS preflight (OPTIONS) goes with it.
+    const claimed = new Set();
+    const linked = new Set();  // browser requests with a probable link: the app's own API, not an outside service
+    const probable = (segment, request) => {
+      if (request.sameOrigin || !request.host || !segment.origin || segment.startedAt == null || request.startMs == null) return [];
+      const start = segment.startedAt + request.startMs;
+      const end = start + (request.durationMs ?? 0);
+      const rows = statements.probable.all(segment.origin, request.host, request.path ?? '', start - 250, end + 250)
+        .filter(row => !claimed.has(row.request_id));
+      const main = rows.filter(row => row.method === request.method).sort((a, b) => Math.abs(a.at - start) - Math.abs(b.at - start))[0];
+      if (!main) return [];
+      const preflight = rows.find(row => row.method === 'OPTIONS' && row.at <= main.at);
+      linked.add(request);
+      return [preflight, main].filter(Boolean).map(row => { claimed.add(row.request_id); return dossier(row.request_id); });
+    };
     segments.forEach((segment, index) => {
       if (index === 0 && segment.trigger) timeline.push({ type: 'trigger', segment: segment.segment, page: segment.page, trigger: segment.trigger });
       if (index > 0 || !segment.trigger) {
@@ -196,7 +238,12 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
         timeline.push({ type: 'document', segment: segment.segment, page: segment.page, server: take(null) });
       }
       const events = [
-        ...(segment.requests ?? []).map(request => ({ at: request.startMs ?? 0, item: { type: 'request', segment: segment.segment, browser: request, server: take(request.n) } })),
+        ...(segment.requests ?? []).map(request => {
+          const server = take(request.n);
+          const guessed = server.length ? [] : probable(segment, request);
+          return { at: request.startMs ?? 0, item: { type: 'request', segment: segment.segment, browser: request, server: server.length ? server : guessed,
+            ...(guessed.length ? { probable: true } : {}) } };
+        }),
         ...(segment.navigations ?? []).filter(item => item.kind !== 'documento')
           .map(navigation => ({ at: navigation.atMs ?? 0, item: { type: 'navigation', segment: segment.segment, ...navigation } })),
       ].sort((a, b) => a.at - b.at);
@@ -215,7 +262,7 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
       const found = combined.find(entry => entry.key === mark.key);
       if (found) found.count += mark.count; else combined.push({ ...mark });
     }
-    for (const request of segments.flatMap(segment => segment.requests ?? []).filter(request => !request.sameOrigin && request.host)) {
+    for (const request of segments.flatMap(segment => segment.requests ?? []).filter(request => !request.sameOrigin && request.host && !linked.has(request))) {
       const key = `browser:${request.host}`;
       const found = combined.find(entry => entry.key === key);
       if (found) found.count++; else combined.push({ key, count: 1, label: `chamada do browser a ${request.host}` });
@@ -260,6 +307,10 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
     const starts = events.filter(event => event.type === 'enter' || event.type === 'boundary');
     const ids = new Set(starts.map(event => event.id));
     const depth = new Map();
+    // After the response: marked by the capture, or recorded after the
+    // request's end in its process (the order inside a process is exact).
+    const after = event => Boolean(event.afterResponse)
+      || (row.end_sequence != null && event.process === row.process && event.sequence > row.end_sequence);
     const steps = starts.map(event => {
       const level = event.parentId && ids.has(event.parentId) ? (depth.get(event.parentId) ?? 0) + 1 : 0;
       depth.set(event.id, level);
@@ -270,11 +321,12 @@ export function openStore(folder, { keep = 500, keepRuns = 20 } = {}) {
         const detail = recordedValues.get(event.id);
         return { ...common, type: 'function', function: event.function, file: event.file, line: event.line,
           endLine: event.endLine ?? null, mapped: event.mapped, async: event.async,
+          opaque: event.opaque || undefined, afterResponse: after(event) || undefined,
           ...(detail ? { detail: { args: detail.args, lines: detail.lines, ...('returned' in detail ? { returned: detail.returned } : { threw: detail.threw }) } } : {}) };
       }
       const { type, id, parentId, requestId: _r, process, sequence, timeNs, version, ...details } = event;
       const { type: _t, id: _i, requestId: _q, durationNs: _d, error: _e, process: _p, sequence: _s, timeNs: _n, version: _v, ...result } = end ?? {};
-      const step = { ...common, type: 'boundary', ...details, result };
+      const step = { ...common, type: 'boundary', ...details, afterResponse: after(event) || undefined, result };
       if (step.kind === 'ia') step.costUsd = estimateCost(result.model ?? step.model, result.usage);
       return step;
     });