cortad 0.3.1-rc.9 → 0.3.2

package/lib/trace.cjs

@@ -1,12 +1,13 @@
 // Loaded into your app by the command that started it (node --require), and only then. It watches
-// for two things. First, a request to your app during which your app called a model: that request is
-// your AI's door, with the exact body it takes and the sign-in it carried, learned from a message you
-// sent yourself rather than guessed from code. Second, every model call your app makes: the host, the
-// model it asked for, the status and the token counts the provider sent back, so a run can say which
-// model answered and what it cost you, which tools it asked for (names and clipped arguments, never a
-// secret) and the passages its prompt was handed as retrieved context. The words of a reply are never
-// written down. Both go to a file only you can read, in the command's own folder on this machine.
-// Nothing here talks to a network.
+// for two things. First, a request to your app during which your app called a model: an exchange,
+// with the exact body it took, the sign-in it carried, what your app answered, the lines of your code
+// that wrote it and the prompt it sent, so the door is proven by a message rather than guessed from
+// code. The first few per route are kept, so two turns of one conversation are both seen. Second,
+// every model call your app makes: the host, the model it asked for, the status, the seconds and the
+// token counts the provider sent back, which tools it asked for (names and clipped arguments, never a
+// secret) and the passages its prompt was handed; the model's words only for a call inside a kept
+// exchange or a run's turn. Both go to a file only you can read, in the command's own folder on this
+// machine. Nothing here talks to a network.
 "use strict";
 const FILE = process.env.CORTAD_TRACE_FILE;
 if (FILE) {
@@ -16,28 +17,8 @@ if (FILE) {
     const http = require("node:http");
     const https = require("node:https");
     const als = new AsyncLocalStorage();
-    // Every value this file writes passes one mask, whichever path wrote it: a key inside a value
-    // ("sk-...", a bearer token, a JWT) and what anyone wrote after "password is" or "token:". The
-    // door row's sign-in headers are kept on purpose: the command replays them from this machine.
-    const SECRET_TEXT = [
-      /((?:pass(?:word|phrase|wd)|pwd|密码|口令)["']?\s*(?:is\b|was\b|[:=：]|是|为)\s*["']?)([^\s"'\\,;}，。；、]+)/gi,
-      /((?:secret(?:[ _-]?key)?|api[ _-]?key|apikey|access[ _-]?key|private[ _-]?key|client[ _-]?secret|(?:auth|access|refresh)[ _-]?token|token)["']?\s*[:=：]\s*["']?)([^\s"'\\,;}，。；、]+)/gi,
-    ];
-    const SECRET_WORD = /\b(?:Bearer\s+(?=[\w.~+/=-]*\d)[\w.~+/=-]{16,}|[spr]k[-_](?=[\w-]*\d)[\w-]{8,}|gh[po]_\w{16,}|github_pat_\w{16,}|xox[abpr]-[\w-]{8,}|AKIA[0-9A-Z]{12,}|AIza[\w-]{20,}|eyJ[\w-]{10,}\.[\w-]{4,}\.[\w-]*)/g;
-    const maskText = (s) => SECRET_TEXT.reduce((t, re) => t.replace(re, "$1[secret]"), s).replace(SECRET_WORD, "[secret]");
-    const scrub = (v, depth = 0) => (typeof v === "string" ? maskText(v)
-      : Array.isArray(v) ? v.map((x) => scrub(x, depth + 1))
-        : v && typeof v === "object" && depth < 12 ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, k === "headers" && depth === 0 ? x : scrub(x, depth + 1)])) : v);
-    // A door's body goes up to the run as JSON, so it is masked as JSON: its string values, never its shape.
-    const bodyScrubbed = (text) => { try { const b = JSON.parse(text); return b && typeof b === "object" ? JSON.stringify(scrub(b)) : maskText(text); } catch { return maskText(text); } };
-    const row = (value) => {
-      try {
-        const plain = value.hello || value.listen || value.routes;
-        const out = plain ? value : scrub(value);
-        if (!plain && typeof value.body === "string") out.body = bodyScrubbed(value.body);
-        fs.appendFileSync(FILE, JSON.stringify(out) + "\n", { mode: 0o600 });
-      } catch { /* the command is gone */ }
-    };
+    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
+    const row = (value) => { try { fs.appendFileSync(FILE, JSON.stringify(scrubbed(value)) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ } };
     // What the app writes into its own folder while a run is on: each file copied once before its
     // first write, so the command puts every one back when the run ends (lib/writes.mjs). Trials
     // wrote carts and tickets into an app's data/*.json and the developer's own tests read them.
@@ -48,7 +29,7 @@ if (FILE) {
       const crypto = require("node:crypto");
       const { fileURLToPath } = require("node:url");
       // Not the app's data: what a build, a package manager or a log writes.
-      const NOT_DATA = /(?:^|\/)(?:node_modules|\.git|\.next|\.nuxt|\.svelte-kit|\.turbo|\.cache|\.parcel-cache|\.venv|venv|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|dist|build|out|coverage|\.cortad)(?:\/|$)|\.(?:log|pyc|tmp|swp)$/;
+      const NOT_DATA = /(?:^|\/)(?:node_modules|\.git|\.next|\.nuxt|\.svelte-kit|\.turbo|\.cache|\.parcel-cache|\.venv|venv|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|dist|build|out|coverage|\.cortad|logs?)(?:\/|$)|\.log(?:\.[\w-]+)?$|\.(?:pyc|tmp|swp)$/;
       const raw = { copyFileSync: fs.copyFileSync, appendFileSync: fs.appendFileSync, existsSync: fs.existsSync, mkdirSync: fs.mkdirSync, statSync: fs.statSync, readFileSync: fs.readFileSync };
       const root = p.resolve(APP_ROOT);
       let run = null, runAt = -1;
@@ -122,28 +103,52 @@ if (FILE) {
     // The frames of the stack it is called from, nearest first, outside this hook and node_modules,
     // relative to the folder the app was started in. An awaited call keeps its awaiting frames in
     // the stack, and an SDK is deeper than the default ten frames.
-    const stackFrames = () => {
-      const limit = Error.stackTraceLimit;
+    // A frame still inside a build folder is a bundle line no one edits: it is kept by its absolute
+    // path and column, and the command places it through the chunk's source map (lib/replay.mjs), so
+    // the app never reads a map on a request's path.
+    const BUILT = /\/(?:\.next|\.nuxt|\.svelte-kit|\.output|\.turbo|\.vercel|dist|build|out)\//;
+    // `typed`: each frame also carries the type of the object it was called on, read off the same
+    // stack as it is formatted; none at all when a formatter of the app's own does not keep one line a
+    // frame.
+    const stackFrames = (typed) => {
+      const limit = Error.stackTraceLimit, prepare = Error.prepareStackTrace;
+      let types = null;
       Error.stackTraceLimit = 60;
-      const stack = String(new Error().stack);
-      Error.stackTraceLimit = limit;
+      if (typed) Error.prepareStackTrace = (err, calls) => { types = calls.map((c) => c.getTypeName()); return typeof prepare === "function" ? prepare(err, calls) : [String(err), ...calls.map((c) => `    at ${c}`)].join("\n"); };
+      let stack;
+      try { stack = String(new Error().stack); } finally { Error.stackTraceLimit = limit; if (typed) Error.prepareStackTrace = prepare; }
+      const lines = stack.split("\n").slice(1);
+      if (typed && lines.length !== types?.length) return [];
       const out = [];
-      for (const line of stack.split("\n")) {
-        const m = /\(?(?:file:\/\/)?(\/[^()]+?):(\d+):\d+\)?$/.exec(line.trim());
-        if (m && m[1] !== __filename && !m[1].includes("/node_modules/")) out.push({ file: nodePath.relative(process.cwd(), decodeURI(m[1])), line: Number(m[2]) });
-      }
+      lines.forEach((line, i) => {
+        const m = /\(?(?:file:\/\/)?(\/[^()]+?):(\d+):(\d+)\)?$/.exec(line.trim());
+        if (!m || m[1] === __filename || m[1].includes("/node_modules/")) return;
+        const type = typed ? { type: types[i] } : {};
+        if (BUILT.test(m[1])) out.push({ file: decodeURI(m[1]), line: Number(m[2]), column: Number(m[3]), built: true, ...type });
+        else out.push({ file: nodePath.relative(process.cwd(), decodeURI(m[1])), line: Number(m[2]), ...type });
+      });
       return out;
     };
     // The file that registered a route: the first frame outside this hook and outside node_modules.
-    const callerFile = () => { const f = stackFrames()[0]; return f && !f.file.startsWith("..") ? f.file : ""; };
+    const callerFile = () => { const f = stackFrames().find((x) => !x.built); return f && !f.file.startsWith("..") ? f.file : ""; };
+    // A built frame is written as its chunk's absolute path, line and column, which no app frame's
+    // relative path can be mistaken for.
+    const atOf = (f) => (f.built ? `${f.file}:${f.line}:${f.column}` : `${f.file}:${f.line}`);
     // Which of the app's own lines made a model call, nearest first: the run names the code path that
-    // ran by it, where the read could only name the door.
+    // ran by it, where the read could only name the door. Five lines: a provider class's stream, post
+    // and retry can be three lines of one file, and the line that says which path ran is past them.
+    // Built frames are handed on past five, since the SDK bundled beside the app's code fills the
+    // first of them; the command keeps five once its map has placed them.
+    const CALLERS_MAX = 5, CALLERS_BUILT = 20;
     const callers = () => {
       const out = [];
+      let own = 0;
       for (const f of stackFrames()) {
-        const at = `${f.file}:${f.line}`;
-        if (!f.file.startsWith("..") && !out.includes(at)) out.push(at);
-        if (out.length === 3) break;
+        const at = atOf(f);
+        if (f.file.startsWith("..") || out.includes(at)) continue;
+        out.push(at);
+        if (!f.built) own++;
+        if (own === CALLERS_MAX || out.length === CALLERS_BUILT) break;
       }
       return out.length ? out : undefined;
     };
@@ -308,408 +313,120 @@ if (FILE) {
       recheck = false;
       setImmediate(() => { try { if (table().routes.length !== routesSaid) sayRoutes(lastPort); } catch { /* as above */ } });
     };
-    const MAX = 65536;
-    // The turn a message came in under, when the run tagged it: one opaque id per request, so a
-    // model call and its prompt can be pinned to the reply they produced even while five turns are
-    // in flight. It is read here and never shown to your app's own code path beyond the header.
-    const TURN = /^[A-Za-z0-9:_.-]{1,80}$/;
-    const turnOf = (headers) => {
-      const t = headers && (typeof headers.get === "function" ? headers.get("x-cortad-turn") : headers["x-cortad-turn"]);
-      return typeof t === "string" && TURN.test(t) ? t : undefined;
-    };
-    // The customer's own rule sentences, written beside the trace by the run, so each model call can
-    // say which of them its prompt carried: a rule is then asked only of a reply whose call was told
-    // it. Absent file, nothing is claimed either way. Reloaded when the file changes.
-    const RULES = process.env.CORTAD_RULES_FILE;
-    let rules = null, rulesAt = -1;
-    const norm = (s) => String(s || "")
-      .replace(/\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)))
-      .replace(/\\[nrt]/g, " ").replace(/\\"/g, '"').replace(/\\\\/g, "\\")
-      .toLowerCase().replace(/\s+/g, " ").trim();
-    // A sentence with a slot in it ("answer in {language}") is matched by its literal parts.
-    const partsOf = (text) => text.split(/\{[^}]*\}|\$\{[^}]*\}|%[sd]|<[^>]{1,40}>/).map(norm).filter((p) => p.length >= 12);
-    const rulesNow = () => {
-      if (!RULES) return null;
-      try {
-        const at = fs.statSync(RULES).mtimeMs;
-        if (at !== rulesAt) {
-          rulesAt = at;
-          const list = JSON.parse(fs.readFileSync(RULES, "utf8"));
-          rules = Array.isArray(list)
-            ? list.filter((r) => r && typeof r.id === "string" && typeof r.text === "string").map((r) => ({ id: r.id, parts: partsOf(r.text) })).filter((r) => r.parts.length)
-            : [];
-        }
-      } catch { /* not written yet, or gone */ }
-      return rules;
-    };
-    // What the app's tools answered, as the prompt of the next model call carries them: the tool
-    // messages of a chat body, the function outputs of a responses body, the tool_result blocks of
-    // an Anthropic one, the functionResponse parts of a Gemini one. They are the material a reply's
-    // facts rest on, and without them a real ticket id read as invented. Bounded per call.
-    const TOOL_TEXT = 3000, TOOLS_MAX = 12;
-    const textOf = (v) => (typeof v === "string" ? v : Array.isArray(v) ? v.map((p) => (p && typeof p === "object" ? (p.text || p.content || "") : String(p || ""))).filter(Boolean).join("\n") : v && typeof v === "object" ? JSON.stringify(v) : "");
-    // Only what came after the person's latest message belongs to this turn: a thread the app
-    // resends whole carries every earlier turn's tool answers too.
-    const list = (v) => (Array.isArray(v) ? v.filter((x) => x && typeof x === "object") : []);
-    const since = (items, isPerson) => { let at = -1; items.forEach((m, i) => { if (isPerson(m)) at = i; }); return items.slice(at + 1); };
-    // A user message that only hands a tool's answer back ("Observation: ...", <tool_response>) is
-    // the agent loop talking, not the person.
-    const HANDED_BACK = /^\s*(?:Observation\s*:|<(?:tool_response|tool_result|function_results?)>)/i;
-    const personSaid = (m) => m.role === "user" && !(Array.isArray(m.content) && m.content.some((c) => c && c.type === "tool_result")) && !HANDED_BACK.test(textOf(m.content));
-    const personAsked = (c) => c.role === "user" && !list(c.parts).some((p) => p.functionResponse);
-    const toolsIn = (sent) => {
-      let body; try { body = JSON.parse(sent); } catch { return undefined; }
-      if (!body || typeof body !== "object") return undefined;
-      const out = [];
-      const names = new Map();
-      const add = (name, text) => { const t = textOf(text).slice(0, TOOL_TEXT); if (t.trim() && out.length < TOOLS_MAX && !out.some((o) => o.text === t)) out.push({ name: String(name || "").slice(0, 80), text: t }); };
-      for (const m of list(body.messages)) {
-        for (const c of list(m.tool_calls)) if (c.id && c.function) names.set(c.id, c.function.name);
-        for (const c of list(m.content)) if (c.type === "tool_use" && c.id) names.set(c.id, c.name);
-      }
-      for (const m of since(list(body.messages), personSaid)) {
-        if (m.role === "tool" || m.role === "function") add(m.name || names.get(m.tool_call_id), m.content);
-        for (const c of list(m.content)) if (c.type === "tool_result") add(names.get(c.tool_use_id), c.content);
-      }
-      const items = list(body.input);
-      for (const it of items) if (it.type === "function_call" && it.call_id) names.set(it.call_id, it.name);
-      for (const it of since(items, (x) => x.role === "user")) if (it.type === "function_call_output") add(names.get(it.call_id), it.output);
-      for (const c of since(list(body.contents), personAsked)) for (const p of list(c.parts)) if (p.functionResponse) add(p.functionResponse.name, p.functionResponse.response);
-      const declared = declaredIn(body);
-      for (const o of observedIn(turnTexts(body, true, declared), declared)) add(o.name, o.text);
-      return out.length ? out : undefined;
-    };
-
-    // What the model asked the app to run: chat tool_calls (a stream's pieces joined by position), a
-    // legacy function_call, a responses function_call item, an Anthropic or Bedrock tool use, a
-    // Gemini functionCall. Read off the model's reply, and off this turn's earlier calls as the
-    // prompt resends them. Names and arguments only: every value clipped, a secret never written.
-    const CALLS_MAX = 12, VALUE_MAX = 200, ARGS_MAX = 1200;
-    const SECRET_KEY = /(?:^|_)(?:pass(?:word|phrase)?|secret|token|api_?key|authorization|cookie|session(?:_id)?|credentials?|private_key)$/;
-    const SECRET_VALUE = /^(?:Bearer\s|Basic\s|sk-|pk_|rk_|ghp_|gho_|github_pat_|xox[abpr]-|AKIA|AIza|eyJ[\w-]{10,}\.)/;
-    const clipped = (v, depth, max = VALUE_MAX) => {
-      if (typeof v === "string") return SECRET_VALUE.test(v) ? "[secret]" : v.length > max ? v.slice(0, max) + "…" : v;
-      if (Array.isArray(v)) return depth > 4 ? [] : v.slice(0, 20).map((x) => clipped(x, depth + 1, max));
-      if (!v || typeof v !== "object") return v;
-      const o = {};
-      if (depth > 4) return o;
-      for (const [k, x] of Object.entries(v).slice(0, 40)) o[k] = SECRET_KEY.test(k.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase()) ? "[secret]" : clipped(x, depth + 1, max);
-      return o;
-    };
-    const argsText = (raw) => {
-      let v = raw;
-      if (typeof raw === "string") { try { v = raw.trim() ? JSON.parse(raw) : {}; } catch { v = raw; } }
-      return JSON.stringify(clipped(v === undefined || v === null ? {} : v, 0)).slice(0, ARGS_MAX);
-    };
-    const callsOf = (events) => {
-      const whole = new Map();
-      const parts = new Map();
-      let n = 0;
-      const put = (key, name, args) => { if (name) whole.set(key || `w${n++}`, { name, args }); };
-      const piece = (key, name, args) => {
-        const p = parts.get(key) || { name: "", args: "" };
-        if (name && !p.name) p.name = name;
-        if (typeof args === "string") p.args += args;
-        parts.set(key, p);
-      };
-      const blocks = (content) => {
-        for (const b of list(content)) {
-          if (b.type === "tool_use") put(b.id, b.name, b.input);
-          if (b.toolUse) put(b.toolUse.toolUseId, b.toolUse.name, b.toolUse.input);
-        }
+    // When the run last sent a request: a write made outside every request (a queue's worker, a
+    // timer) is held while a run is live, since it may be carrying out a trial's ask.
+    let lastTurnAt = -Infinity;
+    const { tied, requestCtx, note, ended, meter } = makeRecorder({
+      row,
+      rulesFile: process.env.CORTAD_RULES_FILE,
+      onTurn: () => { heldWarm(); lastTurnAt = Date.now(); },
+      onEnded: (ctx, steps) => writtenAt(ctx, steps),
+    });
+    // Where in the app's own code each part of a reply was written: the app's line on the stack of the
+    // write, or, for a web stream the app hands back, where its code put the chunk into the stream,
+    // kept when the reply carried it. One entry per line and event name, with the first bytes written
+    // there, so a block in the reply is placed at the write that sent it (lib/pyhook/cortad_sites.py).
+    // ponytail: a reply's first thousand writes are traced; a leak later in a longer stream goes unplaced.
+    const SITES_MAX = 16, SITE_TEXT = 300, SITE_WRITES = 1000, BUILT_WALK = 12;
+    const EVENT = /^event:[ \t]*([\w.:-]{1,40})/m, JSON_EVENT = /"(?:type|event)"\s*:\s*"([\w.:-]{1,40})"/;
+    const siteText = (chunk) => {
+      if (typeof chunk === "string") return chunk.slice(0, SITE_TEXT);
+      if (ArrayBuffer.isView(chunk)) return Buffer.from(chunk.buffer, chunk.byteOffset, Math.min(chunk.byteLength, SITE_TEXT)).toString("utf8").replace(/\uFFFD+$/, "");
+      try { return chunk && typeof chunk === "object" ? String(JSON.stringify(chunk)).slice(0, SITE_TEXT) : ""; } catch { return ""; }
+    };
+    const wrote = (ctx, chunk, streamed) => {
+      if (!ctx || !ctx.sites || ++ctx.traced > SITE_WRITES || ctx.sites.length >= SITES_MAX) return;
+      // A method the app put on the response, such as a res.end that logs and calls the one it replaced,
+      // only hands the write on: the app's line that called it wrote it.
+      const frames = stackFrames(true);
+      const i = frames.findIndex((f) => !f.file.startsWith("..") && f.type !== ctx.responseType);
+      const text = i >= 0 && siteText(chunk);
+      if (!text) return;
+      // In a bundle the first frames are the SDK compiled into the same chunk: the next few are
+      // handed on, and the command keeps the first that its map places in the app's own source.
+      const own = frames[i];
+      const at = own.built ? frames.slice(i, i + BUILT_WALK).filter((f) => f.built).map(atOf) : atOf(own);
+      const m = EVENT.exec(text) || JSON_EVENT.exec(text);
+      const event = m ? m[1] : undefined;
+      if (ctx.sites.some((s) => String(s.at) === String(at) && s.event === event)) return;
+      ctx.sites.push({ at, ...(event ? { event } : {}), text, ...(streamed ? { streamed } : {}) });
+    };
+    for (const Controller of [globalThis.ReadableStreamDefaultController, globalThis.TransformStreamDefaultController]) {
+      const enqueue = Controller && Controller.prototype.enqueue;
+      if (typeof enqueue !== "function") continue;
+      Controller.prototype.enqueue = function (chunk) { try { wrote(als.getStore(), chunk, true); } catch { /* the chunk goes on */ } return enqueue.apply(this, arguments); };
+    }
+    // Written under the id its exchange is written by.
+    const writtenAt = (ctx, steps) => {
+      const asker = (steps && steps.at(-1)) || ctx;
+      const turn = ctx.turn || asker.turn;
+      const list = ctx.sites.filter((s) => !s.streamed || ctx.reply.text.includes(s.text)).map(({ streamed, ...s }) => s);
+      if (list.length && (asker.kept || turn)) row({ sites: { ex: asker.id, ...(turn ? { turn } : {}), list } });
+    };
+    // What the app sends back, as it writes it: its own listeners and pipes see exactly the same.
+    const watchReply = (ctx, res) => {
+      if (!res || typeof res.write !== "function" || typeof res.end !== "function") return;
+      ctx.responseType = res.constructor && res.constructor.name;
+      const got = [];
+      let size = 0, writes = 0;
+      const keep = (chunk, encoding) => {
+        if (chunk == null || typeof chunk === "function") return;
+        writes += 1;
+        wrote(ctx, chunk);
+        if (size >= MAX) return;
+        const b = Buffer.isBuffer(chunk) ? chunk : typeof chunk === "string" ? Buffer.from(chunk, typeof encoding === "string" && Buffer.isEncoding(encoding) ? encoding : "utf8") : Buffer.from(chunk);
+        got.push(b);
+        size += b.length;
       };
-      for (const e of events) {
-        if (!e || typeof e !== "object") continue;
-        for (const c of list(e.choices)) {
-          const m = c.message;
-          if (m) {
-            for (const t of list(m.tool_calls)) if (t.function) put(t.id, t.function.name, t.function.arguments);
-            if (m.function_call) put(null, m.function_call.name, m.function_call.arguments);
-          }
-          const d = c.delta;
-          if (d) {
-            for (const t of list(d.tool_calls)) piece(`c${c.index || 0}.${t.index ?? t.id}`, t.function && t.function.name, t.function && t.function.arguments);
-            if (d.function_call) piece(`f${c.index || 0}`, d.function_call.name, d.function_call.arguments);
-          }
-        }
-        for (const it of [...list(e.output), ...list(e.item ? [e.item] : []), ...list(e.response && e.response.output)]) {
-          if (it.type === "function_call") put(it.call_id || it.id, it.name, it.arguments);
-        }
-        blocks(e.content);
-        blocks(e.message && e.message.content);
-        blocks(e.output && e.output.message && e.output.message.content);
-        if (e.type === "content_block_start" && e.content_block && e.content_block.type === "tool_use") piece(`a${e.index}`, e.content_block.name, "");
-        if (e.type === "content_block_delta" && e.delta && e.delta.type === "input_json_delta") piece(`a${e.index}`, "", e.delta.partial_json);
-        for (const c of list(e.candidates)) for (const p of list(c.content && c.content.parts)) if (p.functionCall) put(null, p.functionCall.name, p.functionCall.args);
-      }
-      return [...whole.values(), ...parts.values()].filter((p) => p.name).map((p) => ({ name: String(p.name).slice(0, 80), arguments: argsText(p.args) }));
-    };
-    // This turn's earlier calls, as the prompt resends them after the person's latest message.
-    const calledBefore = (body) => callsOf([
-      ...since(list(body.messages), personSaid).filter((m) => m.role === "assistant").map((m) => ({ choices: [{ message: m }], content: m.content })),
-      { output: since(list(body.input), (x) => x.role === "user") },
-      ...since(list(body.contents), personAsked).filter((c) => c.role === "model").map((c) => ({ candidates: [{ content: c }] })),
-    ]);
-    // Tool use a model writes in its words instead of as a structured call. A ReAct agent (CrewAI,
-    // LangChain) writes "Action: name" then "Action Input: {...}" and is handed "Observation: ..."
-    // back in its next prompt; others write <tool_call>{...}</tool_call>, <function=name>,
-    // <invoke name="..."> or a JSON object that names the tool. A name counts only when the request
-    // declares that tool, in its tools field or in the tool list its prompt carries, so a thought, a
-    // "Final Answer" or prose that says Action is never a call.
-    const FINAL = /^final[\s_-]*answer$/i;
-    const TOOL_NAME = /^[A-Za-z_][\w.-]{0,79}$/;
-    const promptText = (body) => [
-      ...list(body.messages).filter((m) => m.role !== "assistant").map((m) => textOf(m.content)),
-      textOf(body.system), textOf(body.instructions), typeof body.prompt === "string" ? body.prompt : "", typeof body.input === "string" ? body.input : "",
-      ...list(body.input).filter((x) => x.role && x.role !== "assistant").map((x) => textOf(x.content)),
-      textOf(body.systemInstruction && body.systemInstruction.parts), ...list(body.contents).filter((c) => c.role !== "model").map((c) => textOf(c.parts)),
-    ].join("\n");
-    const declaredIn = (body) => {
-      const out = new Set();
-      const add = (n) => { const s = typeof n === "string" ? n.trim().replace(/^["'`]+|["'`]+$/g, "") : ""; if (TOOL_NAME.test(s) && !FINAL.test(s)) out.add(s); };
-      for (const t of list(body.tools)) { add(t.name); add(t.function && t.function.name); add(t.toolSpec && t.toolSpec.name); for (const d of list(t.functionDeclarations || t.function_declarations)) add(d.name); }
-      for (const f of list(body.functions)) add(f.name);
-      for (const t of list(body.toolConfig && body.toolConfig.tools)) add(t.toolSpec && t.toolSpec.name);
-      const text = promptText(body).slice(0, 200000);
-      for (const m of text.matchAll(/^[ \t]*Tool Name:[ \t]*([^\n]+)/gim)) add(m[1]);
-      for (const m of text.matchAll(/\b(?:one of|name of|names? from)[ \t]*\[([^\]\n]{1,2000})\]/gi)) for (const x of m[1].split(",")) add(x);
-      for (const m of text.matchAll(/valid "?action"? values?:?[ \t]*([^\n]{1,2000})/gi)) for (const x of m[1].split(/,|\bor\b/)) add(x);
-      for (const m of text.matchAll(/<(tools|functions)>([\s\S]*?)<\/\1>/gi)) for (const k of m[2].matchAll(/"name"\s*:\s*"([^"]+)"/g)) add(k[1]);
-      for (const m of text.matchAll(/"name"\s*:\s*"([^"]+)"\s*,\s*"(?:description|parameters|input_schema)"/g)) add(m[1]);
-      for (const m of text.matchAll(/<(?:tool|function)\s+name\s*=\s*["']([^"']+)["']/gi)) add(m[1]);
-      return out;
-    };
-    const REACT = /(?:^|\n)[ \t>*_#]*Action[ \t]*\d*[ \t*_]*:[ \t*_`]*([^\n`*]*?)[ \t*_`]*\n+[ \t>*_#]*Action[ \t]*\d*[ \t_]*Input[ \t*_]*:[ \t*_]*([\s\S]*?)(?=\n[ \t>*_#]*(?:Observation|Thought|Final[ \t]*Answer|Action)\b|\u0000|$)/gi;
-    const TAG_CALL = /<(tool_call|function_call|tool_use)>([\s\S]*?)<\/\1>/gi;
-    const FN_TAG = /<function=([\w.-]+)>([\s\S]*?)<\/function>/gi;
-    const INVOKE = /<invoke\s+name\s*=\s*["']([^"']+)["'][^>]*>([\s\S]*?)<\/invoke>/gi;
-    const OBSERVED = /(?:^|\n)[ \t>*_]*Observation[ \t*_]*:[ \t]*([\s\S]*?)(?=\n[ \t>*_#]*(?:Thought|Action|Final[ \t]*Answer)\b|\u0000|$)|<(tool_response|tool_result|function_results?|observation)>([\s\S]*?)<\/\2>/gi;
-    const paramsOf = (s) => { const o = {}; for (const m of s.matchAll(/<parameter(?:=|\s+name\s*=\s*["'])([\w.-]+)["']?\s*>([\s\S]*?)<\/parameter>/gi)) o[m[1]] = m[2].trim(); return o; };
-    // Each balanced JSON object in the text, outermost first; its insides are not read again.
-    const objectsIn = (text) => {
-      const out = [];
-      for (let i = text.indexOf("{"); i !== -1 && out.length < 20; i = text.indexOf("{", i + 1)) {
-        let depth = 0, str = false, esc = false, end = -1;
-        for (let j = i; j < text.length && j < i + 20000; j++) {
-          const ch = text[j];
-          if (str) { if (esc) esc = false; else if (ch === "\\") esc = true; else if (ch === '"') str = false; continue; }
-          if (ch === '"') str = true; else if (ch === "{") depth++; else if (ch === "}" && --depth === 0) { end = j; break; }
-        }
-        const v = end === -1 ? null : parse(text.slice(i, end + 1));
-        if (v && typeof v === "object") { out.push({ at: i, v }); i = end; }
-      }
-      return out;
-    };
-    // An Action Input that opens with a JSON object is that object: a model that runs on past it
-    // ("Observ: ...") does not put its own invention into the arguments.
-    const leadingJson = (s) => { const t = s.trim(); const o = t[0] === "{" ? objectsIn(t)[0] : null; return o && o.at === 0 ? o.v : t; };
-    // A tool's schema carries a description; a call does not.
-    const jsonCall = (v) => {
-      const f = v.function && typeof v.function === "object" ? v.function : v;
-      if ("description" in f) return null;
-      const name = [f.name, v.tool, v.tool_name, v.action, typeof v.function === "string" ? v.function : undefined].find((x) => typeof x === "string");
-      return name ? { name, args: [f.arguments, f.args, f.parameters, v.action_input, v.tool_input, v.input, v.args, v.arguments, v.parameters].find((x) => x !== undefined) } : null;
-    };
-    const writtenCalls = (text, declared) => {
-      const found = [];
-      if (!text || !declared.size) return found;
-      const s = text.slice(0, 50000);
-      const take = (at, name, args) => { const n = String(name || "").trim(); if (declared.has(n)) found.push({ at, name: n, args: typeof args === "string" ? args.trim() : args }); };
-      for (const m of s.matchAll(REACT)) take(m.index, m[1], leadingJson(m[2]));
-      for (const m of s.matchAll(TAG_CALL)) { const v = parse(m[2].trim()); const c = v && typeof v === "object" && jsonCall(v); if (c) take(m.index, c.name, c.args); }
-      for (const m of s.matchAll(FN_TAG)) { const v = parse(m[2].trim()); take(m.index, m[1], v && typeof v === "object" ? v : paramsOf(m[2])); }
-      for (const m of s.matchAll(INVOKE)) take(m.index, m[1], paramsOf(m[2]));
-      for (const { at, v } of objectsIn(s)) { const c = jsonCall(v); if (c) take(at, c.name, c.args); }
-      return found.sort((a, b) => a.at - b.at);
-    };
-    // What a tool answered, named by the call written just before it.
-    const observedIn = (text, declared) => {
-      const s = String(text || "").slice(0, 50000);
-      const calls = writtenCalls(s, declared);
-      const out = [];
-      if (calls.length) for (const m of s.matchAll(OBSERVED)) { const call = calls.filter((c) => c.at < m.index).pop(); if (call) out.push({ name: call.name, text: (m[1] ?? m[3]).trim() }); }
-      return out;
-    };
-    // The model's own words: the text it answered, whole or streamed, in every provider's shape.
-    const replyText = (events) => {
-      let s = "";
-      for (const e of events) {
-        if (!e || typeof e !== "object") continue;
-        for (const c of list(e.choices)) { if (c.message) s += textOf(c.message.content); if (c.delta && typeof c.delta.content === "string") s += c.delta.content; if (typeof c.text === "string") s += c.text; }
-        if (e.type === "response.output_text.delta" && typeof e.delta === "string") s += e.delta;
-        for (const it of [...list(e.output), ...list(e.response && e.response.output)]) if (it.type === "message") for (const p of list(it.content)) if (typeof p.text === "string") s += p.text;
-        if (e.type === "content_block_delta" && e.delta && typeof e.delta.text === "string") s += e.delta.text;
-        for (const b of [...list(e.content), ...list(e.message && e.message.content), ...list(e.output && e.output.message && e.output.message.content)]) if (typeof b.text === "string") s += b.text;
-        if (e.message && typeof e.message.content === "string" && !e.choices) s += e.message.content;
-        for (const c of list(e.candidates)) for (const p of list(c.content && c.content.parts)) if (typeof p.text === "string" && !p.thought) s += p.text;
-        if (typeof e.response === "string") s += e.response;
+      for (const name of ["write", "end"]) {
+        const orig = res[name];
+        res[name] = function (chunk, encoding) { try { keep(chunk, encoding); if (name === "end") tied.replied(ctx, res.statusCode, () => decoded(Buffer.concat(got), sentHeader("content-encoding"))); } catch { /* the reply goes on */ } return orig.apply(this, arguments); };
       }
-      return s;
-    };
-    // This turn as the prompt carries it: the model's earlier words after the person's latest
-    // message, and everything from that message on, where a single-prompt agent keeps its scratchpad.
-    // A user message right after the model wrote a tool call is the agent loop's nudge ("Analyze the
-    // tool result"), never the person: after a call, only the loop speaks.
-    const turnTexts = (body, withPerson, declared) => {
-      const from = (items, isPerson) => { const at = items.findLastIndex(isPerson); return items.slice(withPerson ? Math.max(0, at) : at + 1); };
-      const ours = (r) => withPerson ? r !== "system" && r !== "developer" : r === "assistant" || r === "model";
-      const ms = list(body.messages);
-      const person = (m) => personSaid(m) && !(ms[ms.indexOf(m) - 1] && ms[ms.indexOf(m) - 1].role === "assistant" && writtenCalls(textOf(ms[ms.indexOf(m) - 1].content), declared).length);
-      return [
-        ...from(ms, person).filter((m) => ours(m.role)).map((m) => textOf(m.content)),
-        ...from(list(body.input), (x) => x.role === "user").filter((x) => ours(x.role)).map((x) => textOf(x.content ?? x.output)),
-        ...from(list(body.contents), personAsked).filter((c) => ours(c.role)).map((c) => textOf(c.parts)),
-        ...(withPerson ? [typeof body.prompt === "string" ? body.prompt : "", typeof body.input === "string" ? body.input : ""] : []),
-      ].join("\u0000\n");
-    };
-
-    const calledIn = (sent, events) => {
-      const body = parse(sent);
-      const out = [];
-      const declared = body && typeof body === "object" ? declaredIn(body) : new Set();
-      const written = [...writtenCalls(body && typeof body === "object" ? turnTexts(body, false, declared) : "", declared), ...writtenCalls(replyText(events), declared)].map((c) => ({ name: c.name, arguments: argsText(c.args) }));
-      for (const c of [...(body && typeof body === "object" ? calledBefore(body) : []), ...callsOf(events), ...written]) {
-        if (out.length < CALLS_MAX && !out.some((o) => o.name === c.name && o.arguments === c.arguments)) out.push(c);
-      }
-      return out.length ? out : undefined;
-    };
-
-    // The passages the prompt carried as retrieved context: a block the app itself labels as
-    // context, documents, knowledge, sources or search results, in its system prompt or from the
-    // person's latest message on, and Anthropic document and search_result blocks. The app's own
-    // instructions are not passages: only what sits under such a label is.
-    const PASSAGE_TEXT = 3000, PASSAGES_MAX = 6;
-    const MATERIAL = /\b(?:retriev\w*|context|knowledge|documents?|sources?|search[ _-]?results?|references?|passages?|excerpts?|snippets?|chunks?|background|faq|relevant)\b|检索|知识|参考资料|资料|上下文|文档|背景|相关/i;
-    const HEADING = /^\s*(?:#{1,6}\s+[^\n]{1,80}|[^\n]{1,80}[:：]\s*(?:\([^\n)]*\))?|\[[^\n\]]{1,80}\]|={2,}\s*[^\n]{1,80}?\s*={2,})\s*$/;
-    // An inline label is a noun phrase that ends in the material word ("context:", "background:",
-    // "retrieved passages:"): "4. Knowledge:" in a numbered instruction and a JSON key are not.
-    const INLINE = /^\s*(?:[-*]\s+)?([A-Za-z\u4e00-\u9fff][A-Za-z\u4e00-\u9fff '’_-]{0,29})[:：]\s*\S/;
-    const NAMED = new RegExp(`(?:${MATERIAL.source})\\s*$`, "i");
-    const TAGGED = /<([A-Za-z][\w-]*)[^>]*>([\s\S]*?)<\/\1>/g;
-    // A label's block runs on to the next heading of its own kind: "资料：" over retrieved chunks
-    // that open on markdown headings holds every chunk, where stopping at its first paragraph kept
-    // one chunk of five and the reader called the knowledge base's own 1% fee made up. A markdown
-    // label holds deeper headings. A closing paragraph that opens on a label of its own ("问题：...",
-    // "Question: ...") is the prompt's ask, not material. A long block is several passages, cut
-    // between its paragraphs.
-    const MARKDOWN = /^\s*(#{1,6})\s/;
-    const endsBlock = (label, line) => {
-      if (!HEADING.test(line)) return false;
-      const outer = MARKDOWN.exec(label), inner = MARKDOWN.exec(line);
-      return !inner || Boolean(outer && inner[1].length <= outer[1].length);
-    };
-    const asks = (para) => { const m = INLINE.exec(para.split("\n")[0]); return Boolean(m && !NAMED.test(m[1])); };
-    // A heading inside a fenced block is the material's own text: a README chunk's "## Features".
-    const fences = (para) => (para.match(/^\s*(?:```|~~~)/gm) || []).length;
-    const addBlock = (add, name, paras) => {
-      let text = "";
-      for (const p of paras) {
-        if (text && text.length + p.length + 2 > PASSAGE_TEXT) { add(name, text); text = ""; }
-        text += (text ? "\n\n" : "") + p;
-      }
-      add(name, text);
-    };
-    const labelled = (text, add) => {
-      const rest = String(text || "").replace(TAGGED, (all, tag, inner) => { if (MATERIAL.test(tag.replace(/_/g, " "))) { add(tag, inner); return ""; } return all; });
-      const paras = rest.split(/\n\s*\n/);
-      for (let i = 0; i < paras.length; i++) {
-        const lines = paras[i].split("\n");
-        const head = lines[0];
-        if (HEADING.test(head) && MATERIAL.test(head)) {
-          const block = [lines.slice(1).join("\n")];
-          let fenced = fences(block[0]) % 2 === 1;
-          while (i + 1 < paras.length && (fenced || (!endsBlock(head, paras[i + 1].split("\n")[0]) && !(i + 2 === paras.length && asks(paras[i + 1]))))) {
-            block.push(paras[++i]);
-            if (fences(paras[i]) % 2 === 1) fenced = !fenced;
-          }
-          addBlock(add, head.replace(/[#:：[\]=]/g, "").trim(), block);
-          continue;
-        }
-        const inline = lines.map((l) => INLINE.exec(l)).find((m) => m && NAMED.test(m[1]));
-        if (inline) add(inline[1].trim(), paras[i]);
-      }
-    };
-    const passagesIn = (sent) => {
-      const body = parse(sent);
-      if (!body || typeof body !== "object") return undefined;
-      const out = [];
-      const add = (name, text) => { const t = String(text || "").trim().slice(0, PASSAGE_TEXT); if (t.length >= 20 && out.length < PASSAGES_MAX && !out.some((o) => o.text === t)) out.push({ name: String(name || "").slice(0, 80), text: t }); };
-      const scan = (content) => {
-        if (typeof content === "string") return labelled(content, add);
-        for (const b of list(content)) {
-          if (b.type === "document") add(b.title || "document", b.source ? textOf(b.source.data ?? b.source.content) : textOf(b.content));
-          else if (b.type === "search_result") add(b.title || b.source || "search result", textOf(b.content));
-          else if (typeof b.text === "string") labelled(b.text, add);
-        }
+      // writeHead(status, headers) sends its headers without keeping them where getHeader looks: the
+      // header block as sent says them either way.
+      const sentHeader = (name) => {
+        const kept = res.getHeader(name);
+        if (kept !== undefined) return kept;
+        const block = typeof res._header === "string" ? res._header : "";
+        const found = block.split("\r\n").filter((l) => l.toLowerCase().startsWith(`${name}:`)).map((l) => l.slice(name.length + 1).trim());
+        return name === "set-cookie" ? found : found[0];
       };
-      const messages = list(body.messages);
-      for (const m of messages) if (m.role === "system" || m.role === "developer") scan(m.content);
-      for (const m of messages.slice(Math.max(0, messages.findLastIndex(personSaid)))) if (m.role === "user") scan(m.content);
-      scan(body.system);
-      scan(body.instructions);
-      scan(body.systemInstruction && body.systemInstruction.parts);
-      const input = typeof body.input === "string" ? [{ role: "user", content: body.input }] : list(body.input);
-      for (const it of input.slice(Math.max(0, input.findLastIndex((x) => x.role === "user")))) if (it.role === "user" || it.role === "system" || it.role === "developer") scan(it.content);
-      return out.length ? out : undefined;
-    };
-    // The passages a retrieval call answered with: a vector store, a search index or a web search,
-    // read off its reply when it is JSON. Text fields only, bounded like the rest.
-    const RETRIEVAL_HOST = /pinecone\.io|qdrant|weaviate|chroma|zilliz|milvus|turbopuffer|upstash\.io|algolia|typesense|meilisearch|elastic|opensearch|vespa|tavily\.com|exa\.ai|serper\.dev|serpapi\.com|search\.brave\.com|bing\.microsoft\.com|jina\.ai/i;
-    const RETRIEVAL_PATH = /\/(?:query|search|_search|retrieve|similarity_search|rerank|hybrid)(?:\/|$)|\/points\/(?:search|query)|\/rpc\/match\w*/i;
-    const isRetrieval = (u) => RETRIEVAL_HOST.test(u.hostname) || RETRIEVAL_PATH.test(u.pathname);
-    const PASSAGE_KEY = /^(?:text|content|page_?content|pageContent|chunk|snippet|passage|body|document|documents|description|answer|raw_content|highlights?|excerpt)$/i;
-    const passagesFrom = (raw) => {
-      const out = [];
-      let nodes = 0;
-      const walk = (v, key, depth) => {
-        if (out.length >= PASSAGES_MAX || depth > 7 || ++nodes > 4000) return;
-        const t = typeof v === "string" ? v.trim().slice(0, PASSAGE_TEXT) : "";
-        if (t) { if (PASSAGE_KEY.test(key) && t.length >= 20 && !out.some((o) => o.text === t)) out.push({ name: key, text: t }); return; }
-        if (Array.isArray(v)) { for (const x of v) walk(x, key, depth + 1); return; }
-        if (v && typeof v === "object") for (const [k, x] of Object.entries(v)) walk(x, k, depth + 1);
+      // `cut`: the app began its reply and the connection closed before it finished, so the row holds
+      // part of it. Either side may have closed it (a client that stopped reading, an app that broke
+      // off mid-stream), so nothing downstream says which.
+      const done = () => {
+        try { ended(ctx, { status: res.statusCode, type: sentHeader("content-type"), writes, text: decoded(Buffer.concat(got), sentHeader("content-encoding")), cookies: cookieNames(sentHeader("set-cookie")), cut: res.headersSent && !res.writableFinished }); } catch { /* the command is gone */ }
       };
-      walk(parse(raw), "", 0);
-      return out.length ? out : undefined;
-    };
-    const rulesIn = (sent) => {
-      const list = rulesNow();
-      if (!list) return undefined;
-      const body = norm(sent);
-      return list.filter((r) => r.parts.every((p) => body.includes(p))).map((r) => r.id);
-    };
-    // Where models are served, by host, and the paths every OpenAI-shaped or vendor endpoint ends with.
-    const MODEL_HOST = /(?:^|\.)(?:openai\.com|anthropic\.com|fireworks\.ai|openrouter\.ai|groq\.com|mistral\.ai|together\.xyz|together\.ai|deepseek\.com|cohere\.ai|cohere\.com|perplexity\.ai|x\.ai|googleapis\.com|openai\.azure\.com|cognitiveservices\.azure\.com|amazonaws\.com|replicate\.com|huggingface\.co|cerebras\.ai|deepinfra\.com|novita\.ai|moonshot\.cn|dashscope\.aliyuncs\.com|bigmodel\.cn|ai-gateway\.vercel\.sh|gateway\.ai\.cloudflare\.com|helicone\.ai|portkey\.ai)$/i;
-    const MODEL_PATH = /\/(?:chat\/completions|completions|responses|messages|embeddings)$|:(?:generateContent|streamGenerateContent)|\/invoke(?:-with-response-stream)?$|\/api\/(?:chat|generate)$/i;
-    // An embedding call answers nobody, so where it was made names no path a reply came down.
-    const EMBEDDING = /\/embeddings$/i;
-    const isModelCall = (host, path) => {
-      const h = String(host || "").replace(/:\d+$/, "");
-      const p = String(path || "").split("?")[0];
-      if (/googleapis\.com$/i.test(h)) return /generativelanguage|aiplatform/i.test(h) && MODEL_PATH.test(p);
-      if (/amazonaws\.com$/i.test(h)) return /^bedrock/i.test(h);
-      return MODEL_HOST.test(h) ? true : MODEL_PATH.test(p) && /\/v\d|\/api\//.test(p);
-    };
-    const said = new Set();
-    const note = (ctx, sent) => {
-      if (!ctx || ctx.noted) return;
-      ctx.noted = true;
-      const key = `${ctx.method} ${ctx.path.split("?")[0]}`;
-      if (said.has(key)) return;
-      said.add(key);
-      const write = (chunks) => row({ at: Date.now(), method: ctx.method, path: ctx.path, headers: ctx.headers, body: Buffer.concat(chunks).toString("utf8").slice(0, MAX), sent: String(sent || "").slice(0, MAX) });
-      if (ctx.body) ctx.body.then((b) => write([b]));
-      else write(ctx.chunks);
+      res.once("finish", done);
+      res.once("close", done);
+    };
+    // Bun hands back a Response; its body is read from a clone, so the client's copy is untouched.
+    const watchResponse = (ctx, res) => {
+      // Nothing to read: the request is closed and never written.
+      const gone = () => { ctx.ended = Date.now(); ctx.reply = { status: 0, type: "", text: "", cookies: [] }; tied.closed(ctx); };
+      if (!(res instanceof Response) || Number(res.headers.get("content-length") || 0) > REPLY_MAX) return gone();
+      let copy;
+      try { copy = res.clone(); } catch { return gone(); }
+      copy.arrayBuffer().then((b) => Buffer.from(b), () => Buffer.alloc(0)).then((buf) => {
+        const set = typeof res.headers.getSetCookie === "function" ? res.headers.getSetCookie() : res.headers.get("set-cookie");
+        tied.replied(ctx, res.status, () => decoded(buf.subarray(0, MAX), res.headers.get("content-encoding")));
+        ended(ctx, { status: res.status, type: res.headers.get("content-type"), text: decoded(buf.subarray(0, MAX), res.headers.get("content-encoding")), cookies: cookieNames(set) });
+      }).catch(() => { /* the command is gone */ });
     };
 
     // Inbound: each request is handled inside its own context, and its body is seen as it arrives
-    // without reading it, so your own body parser is untouched.
+    // without reading it, so your own body parser is untouched. A GET is watched but never made the
+    // context a model call is pinned by: it can only be the step an answer comes on.
     const emit = http.Server.prototype.emit;
     http.Server.prototype.emit = function (type, req, ...rest) {
+      if (this[HELD]) return emit.call(this, type, req, ...rest);
       if (type === "listening") { try { listening(this.address()?.port); } catch { /* not a TCP server */ } }
       if (type === "request") { recheckRoutes(); sweepTools(); }
-      if (type !== "request" || !req || !req.method || /^(?:GET|HEAD|OPTIONS)$/.test(req.method)) return emit.call(this, type, req, ...rest);
+      if (type !== "request" || !req || !req.method || /^(?:HEAD|OPTIONS)$/.test(req.method)) return emit.call(this, type, req, ...rest);
       const { "x-cortad-turn": _turn, ...headers } = req.headers;
-      const ctx = { method: req.method, path: req.url || "/", headers, chunks: [], size: 0, noted: false, turn: turnOf(req.headers) };
+      const ctx = requestCtx(req.method, req.url || "/", headers, turnOf(req.headers));
+      try { watchReply(ctx, rest[0]); } catch { /* the reply goes on unwatched */ }
+      if (req.method === "GET") return emit.call(this, type, req, ...rest);
       const push = req.push;
       req.push = function (chunk, encoding) {
         if (chunk && ctx.size < MAX) { const b = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding); ctx.chunks.push(b); ctx.size += b.length; }
@@ -743,16 +460,26 @@ if (FILE) {
       const inside = (handler, self) => function (req, server) {
         recheckRoutes();
         sweepTools();
-        if (!req || /^(?:GET|HEAD|OPTIONS)$/.test(req.method)) return handler.call(self, req, server);
+        if (!req || /^(?:HEAD|OPTIONS)$/.test(req.method)) return handler.call(self, req, server);
         let path = "/";
         try { const u = new URL(req.url); path = u.pathname + u.search; } catch { /* keep "/" */ }
-        const ctx = { method: req.method, path, headers: Object.fromEntries([...req.headers].filter(([k]) => k !== "x-cortad-turn")), chunks: [], size: 0, noted: false, turn: turnOf(req.headers) };
+        const ctx = requestCtx(req.method, path, Object.fromEntries([...req.headers].filter(([k]) => k !== "x-cortad-turn")), turnOf(req.headers));
+        if (req.method === "GET") {
+          const out = handler.call(self, req, server);
+          Promise.resolve(out).then((res) => watchResponse(ctx, res), () => watchResponse(ctx, null));
+          return out;
+        }
         // ponytail: a body is copied only when it is small or says it is text; an upload is left alone.
         const size = Number(req.headers.get("content-length") || 0);
         if (size <= MAX || /json|text|form/i.test(req.headers.get("content-type") || "")) {
-          try { ctx.body = req.clone().arrayBuffer().then((b) => Buffer.from(b).subarray(0, MAX), () => Buffer.alloc(0)); } catch { /* unread */ }
+          // Read as it arrives, so a model call made while the request is open knows the person's words.
+          try { ctx.body = req.clone().arrayBuffer().then((b) => { ctx.bodyText = Buffer.from(b).subarray(0, MAX).toString("utf8"); }, () => { ctx.bodyText = ""; }); } catch { /* unread */ }
         }
-        return als.run(ctx, () => handler.call(self, req, server));
+        return als.run(ctx, () => {
+          const out = handler.call(self, req, server);
+          Promise.resolve(out).then((res) => watchResponse(ctx, res), () => {});
+          return out;
+        });
       };
       const routes = (table) => {
         if (!table || typeof table !== "object") return table;
@@ -791,61 +518,6 @@ if (FILE) {
       };
     }
 
-    // The meter. One row per model call: host, model id, status, and the provider's own token counts.
-    const zlib = require("node:zlib");
-    const REPLY_MAX = 8 * 1024 * 1024;
-    const decoded = (buf, encoding) => {
-      try {
-        const e = String(encoding || "").toLowerCase();
-        return (e === "gzip" ? zlib.gunzipSync(buf) : e === "br" ? zlib.brotliDecompressSync(buf) : e === "deflate" ? zlib.inflateSync(buf) : buf).toString("utf8");
-      } catch { return ""; }
-    };
-    const parse = (text) => { try { return JSON.parse(text); } catch { return null; } };
-    const n = (v) => (Number.isInteger(v) && v > 0 ? v : 0);
-    // The shapes the providers answer in. promptTokens is the whole input, cache included, so totals add up.
-    const tokensOf = (u) => {
-      if (!u || typeof u !== "object") return null;
-      if (u.tokens && typeof u.tokens === "object") return tokensOf(u.tokens);
-      if ("prompt_tokens" in u) return { promptTokens: n(u.prompt_tokens), cachedTokens: n(u.prompt_tokens_details && u.prompt_tokens_details.cached_tokens), completionTokens: n(u.completion_tokens) };
-      if ("input_tokens" in u && u.input_tokens_details) return { promptTokens: n(u.input_tokens), cachedTokens: n(u.input_tokens_details.cached_tokens), completionTokens: n(u.output_tokens) };
-      if ("input_tokens" in u) { const read = n(u.cache_read_input_tokens); return { promptTokens: n(u.input_tokens) + read + n(u.cache_creation_input_tokens), cachedTokens: read, completionTokens: n(u.output_tokens) }; }
-      if ("inputTokens" in u) { const read = n(u.cacheReadInputTokens); return { promptTokens: n(u.inputTokens) + read + n(u.cacheWriteInputTokens), cachedTokens: read, completionTokens: n(u.outputTokens) }; }
-      if ("promptTokenCount" in u) return { promptTokens: n(u.promptTokenCount), cachedTokens: n(u.cachedContentTokenCount), completionTokens: n(u.candidatesTokenCount) };
-      return null;
-    };
-    // A stream spreads its counts over events (Anthropic's input in the first, output in the last);
-    // later values win, so the fold ends on the final figures.
-    const readReply = (type, text) => {
-      const events = /event-stream/i.test(type || "")
-        ? text.split("\n").filter((l) => l.startsWith("data:")).map((l) => parse(l.slice(5).trim()))
-        : [].concat(parse(text));
-      const usage = {};
-      let model = null;
-      for (const e of events) {
-        if (!e || typeof e !== "object") continue;
-        const part = e.usage || (e.message && e.message.usage) || (e.response && e.response.usage) || e.usageMetadata;
-        if (part && typeof part === "object") Object.assign(usage, part);
-        model = e.model || (e.message && e.message.model) || (e.response && e.response.model) || e.modelVersion || model;
-      }
-      return { tokens: tokensOf(Object.keys(usage).length ? usage : null), model, events };
-    };
-    // The model asked for, from what was sent; Gemini and Bedrock put it in the path instead.
-    const askedFor = (path, sent) => {
-      const body = parse(sent);
-      if (body && typeof body.model === "string") return body.model;
-      const m = /\/models\/([^/:]+):|\/model\/([^/]+)\/(?:invoke|converse)/.exec(path || "");
-      return m ? decodeURIComponent(m[1] || m[2]) : "";
-    };
-    const meter = ({ host, path, sent, status, type, body, turn, caller }) => {
-      try {
-        const reply = readReply(type, String(body || "").slice(0, REPLY_MAX));
-        const rules = rulesIn(sent);
-        const tools = toolsIn(sent);
-        const called = calledIn(sent, reply.events);
-        const passages = passagesIn(sent);
-        row({ call: { at: Date.now(), host: String(host).replace(/:443$/, ""), model: String(askedFor(path, sent) || reply.model || "").slice(0, 160), status, ...(reply.tokens || { promptTokens: 0, cachedTokens: 0, completionTokens: 0 }), usage: Boolean(reply.tokens), ...(turn ? { turn } : {}), ...(rules ? { rules } : {}), ...(tools ? { tools } : {}), ...(called ? { called } : {}), ...(passages ? { passages } : {}), ...(caller ? { caller } : {}) } });
-      } catch { /* the command is gone */ }
-    };
 
     // Outbound to a service their own settings name (a vector store, a database API, a search
     // host): which setting, which host and whether it answered. No body, no headers, no query. A
@@ -868,8 +540,10 @@ if (FILE) {
         return name ? { env: name, host: u.hostname } : null;
       } catch { return null; }
     };
-    const depRow = (dep, status, code, passages, turn = (als.getStore() || {}).turn) => {
-      row({ dep: { at: Date.now(), ...(dep.env ? { env: dep.env } : {}), host: dep.host, status, code: code ? String(code).slice(0, 40) : undefined, ...(turn ? { turn } : {}), ...(passages ? { passages } : {}) } });
+    // A retrieval says so, with the app's line that asked, so one that came back empty has an address.
+    const depRow = (dep, status, { code, passages, ctx, retrieval, caller } = {}) => {
+      const turn = ctx && ctx.turn;
+      row({ dep: { at: Date.now(), ...(dep.env ? { env: dep.env } : {}), host: dep.host, status, code: code ? String(code).slice(0, 40) : undefined, ...(ctx ? { ex: ctx.id } : {}), ...(turn ? { turn } : {}), ...(retrieval ? { retrieval: true } : {}), ...(caller ? { caller } : {}), ...(passages ? { passages } : {}) } });
     };
 
     // The app's own functions the read names as its tools. An app whose code picks the tool itself
@@ -931,12 +605,13 @@ if (FILE) {
       if (!m || /[{[(]/.test(m[1])) return [];
       return m[1].split(",").map((p) => p.replace(/=[\s\S]*$/, "").replace(/^\s*\.\.\./, "").replace(/:[\s\S]*$/, "").trim());
     };
-    const toolRow = (name, names, args, value, error, turn) => {
+    const toolRow = (name, names, args, value, error, ctx) => {
+      const turn = ctx && ctx.turn;
       const named = {};
       args.forEach((a, i) => { named[IDENT.test(names[i] || "") ? names[i] : String(i)] = plainOf(a); });
       let text;
       try { text = error ? `raised ${(error && error.name) || "an error"}: ${(error && error.message) || String(error)}` : returned(value); } catch { text = "returned a value this hook cannot read"; }
-      row({ dep: { at: Date.now(), host: "in-app", status: 200, ...(turn ? { turn } : {}), called: [{ name, arguments: argsText(named) }], tools: [{ name, text: String(text).slice(0, TOOL_TEXT) }] } });
+      row({ dep: { at: Date.now(), host: "in-app", status: 200, ...(ctx ? { ex: ctx.id } : {}), ...(turn ? { turn } : {}), called: [{ name, arguments: argsText(named) }], tools: [toolText(name, String(text))] } });
     };
     const TOOL = Symbol.for("cortad.wrapped");
     const wrappers = new WeakMap();
@@ -946,14 +621,14 @@ if (FILE) {
       try { if (/^class\b/.test(Function.prototype.toString.call(fn))) return fn; } catch { return fn; }
       const names = paramNames(fn);
       const w = function (...args) {
-        const turn = (als.getStore() || {}).turn;
+        const ctx = als.getStore();
         let out;
         try { out = new.target ? Reflect.construct(fn, args, new.target) : fn.apply(this, args); }
-        catch (e) { toolRow(name, names, args, undefined, e, turn); throw e; }
+        catch (e) { toolRow(name, names, args, undefined, e, ctx); throw e; }
         // A promise is followed, and the one handed back is a new one, so a rejection nobody
         // handles still reaches the app as unhandled.
-        if (out instanceof Promise) return out.then((v) => { toolRow(name, names, args, v, undefined, turn); return v; }, (e) => { toolRow(name, names, args, undefined, e, turn); throw e; });
-        toolRow(name, names, args, out, undefined, turn);
+        if (out instanceof Promise) return out.then((v) => { toolRow(name, names, args, v, undefined, ctx); return v; }, (e) => { toolRow(name, names, args, undefined, e, ctx); throw e; });
+        toolRow(name, names, args, out, undefined, ctx);
         return out;
       };
       try {
@@ -1026,16 +701,208 @@ if (FILE) {
       }
     };
 
+    // A fetched body read to its end, or to where it broke off. Aborting the call (the client that
+    // asked went away, or the framework ended the request once its own reply was sent) errors this
+    // copy too, and what the model had said by then is still what it said.
+    const readAll = async (res) => {
+      const parts = [];
+      let size = 0;
+      try {
+        const reader = res.body && res.body.getReader();
+        for (let r = reader && await reader.read(); r && !r.done; r = await reader.read()) {
+          if (size < REPLY_MAX) { parts.push(Buffer.from(r.value)); size += r.value.length; }
+        }
+      } catch { /* broken off: what arrived stands */ }
+      return Buffer.concat(parts).toString("utf8");
+    };
+
+    // Every server the app opens a connection to, once each, by host and port only: a database named
+    // in a config file rather than in the environment is seen the first time the app reaches it.
+    // HTTP clients connect through here too; the command names only the ports stores listen on.
+    const net = require("node:net");
+    const connected = new Set();
+    const socketConnect = net.Socket.prototype.connect;
+    net.Socket.prototype.connect = function (...args) {
+      try {
+        const first = Array.isArray(args[0]) ? args[0][0] : args[0];
+        const o = first && typeof first === "object" ? first : { port: first, host: typeof args[1] === "string" ? args[1] : undefined };
+        const port = Number(o.port);
+        if (!o.path && Number.isInteger(port) && port > 0 && port !== heldPort && connected.size < 64) {
+          const host = String(o.host || "localhost").toLowerCase().slice(0, 253);
+          if (!connected.has(`${host}:${port}`)) { connected.add(`${host}:${port}`); row({ conn: { host, port } }); }
+        }
+      } catch { /* the connection goes on unrecorded */ }
+      return socketConnect.apply(this, args);
+    };
+
+    // Outbound writes a trial makes are held in the app, never sent: a trial that books, charges,
+    // emails or deletes would otherwise do it for real. Held: a call made inside a request the run
+    // tagged, with a writing method, to a host that is not a model, a retrieval, this machine, a copy
+    // of ours or a host the person said yes to. A call carrying a provider's test key goes to that
+    // provider's own sandbox as sent. The app is answered with a success shaped like what it sent,
+    // and the run is told by a dep row with `held` and the clipped call.
+    const OUTBOUND = process.env.CORTAD_OUTBOUND_FILE;
+    let passed = [], passedAt = -1;
+    const passNow = () => {
+      try {
+        const at = fs.statSync(OUTBOUND).mtimeMs;
+        if (at !== passedAt) { passedAt = at; const got = JSON.parse(fs.readFileSync(OUTBOUND, "utf8")); passed = Array.isArray(got.pass) ? got.pass.filter((h) => typeof h === "string" && h) : []; }
+      } catch { /* not written yet: nothing passes */ }
+      return passed;
+    };
+    const WRITES = /^(?:POST|PUT|PATCH|DELETE)$/;
+    const THIS_MACHINE = /^(?:localhost|127(?:\.\d+){3}|\[?::1\]?|0\.0\.0\.0)$/i;
+    // A provider's own sandbox, named so in the host: api.sandbox.paypal.com, sandbox-api.polar.sh.
+    const SANDBOX_HOST = /(?:^|[.-])(?:sandbox|sbox)[.-]/i;
+    // ponytail: a sign-in's token refresh is a POST that changes nothing, told apart by its path only.
+    const TOKEN_PATH = /\/(?:oauth2?\/)?token(?:[/?]|$)/i;
+    // An API where every call is a POST names what a call does in its last segment, as
+    // resource.verb_words (customers.get, billing.preview_attach) or as a gRPC or Connect method
+    // (acme.v1.UserService/GetUser). A POST so named that starts with a reading word, and holds no word
+    // that makes the read a write (get_or_create, check_in, GetLease), goes out.
+    // A preview commits nothing whatever it previews; any other reading word reads only while no word
+    // after it writes: credits.check_deduct and usage.count_increment went out as reads.
+    // ponytail: decided on the name alone, so a POST named as a plain read whose body writes goes out.
+    // A rule on the body is the upgrade if one is ever seen.
+    const WRITE_WORD = "create|update|delete|remove|set|add|put|insert|upsert|write|save|store|record|track|log|send|deduct|increment|decrement|consume|use|spend|charge|pay|refund|cancel|reserve|lock|unlock|commit|apply|attach|detach|start|stop|run|trigger|reset|rotate|revoke|grant|issue|mint|transfer|move|merge|sync|import|export|upload|publish|enqueue|push|pop|ack|touch|mark|close|approve|reject|submit|confirm|redeem|claim";
+    const DOT_CALL = /^[A-Za-z][\w-]*\.[a-z][a-z_]*$/, DOT_READ = /^(?:get|list|check|search|query|find|lookup|retrieve|describe|count|preview)$/, DOT_NOT = new RegExp(`^(?:or|and|in|out|next|${WRITE_WORD})$`);
+    const RPC_CALL = /^(?:[A-Z][a-z0-9]*)+$/, RPC_READ = /^(?:Get|List|Search|Query|Find|Lookup|Describe)$/, RPC_NOT = new RegExp(`^(?:or|and|next|lease|${WRITE_WORD})$`, "i");
+    const readWords = (words, read, not) => read.test(words[0]) && (/^preview$/i.test(words[0]) || !words.slice(1).some((w) => not.test(w)));
+    const readsByName = (method, pathname) => {
+      if (method !== "POST") return false;
+      const parts = pathname.split("/").filter(Boolean);
+      const last = parts[parts.length - 1] || "", before = parts[parts.length - 2] || "";
+      if (DOT_CALL.test(last)) return readWords(last.split(".")[1].split("_"), DOT_READ, DOT_NOT);
+      return /\.[A-Z]\w*$/.test(before) && RPC_CALL.test(last) && readWords(last.split(/(?=[A-Z])/), RPC_READ, RPC_NOT);
+    };
+    // A provider's test-mode key says so in the prefix of the key itself, set off by underscores
+    // (Stripe's sk_test_, am_sk_test_, pdl_sdbx_), or it is a value of a setting the app keeps as a
+    // test one. The word elsewhere is not it: a Basic user named test-admin and a live key holding
+    // "-Test-" both went out as test keys.
+    const TEST_KEY = /^(?:[a-z0-9]{2,8}_){0,3}(?:test|sandbox|sbox|sdbx)_[\w-]{4,}$/i;
+    const testKey = (auth) => Boolean(auth) && (auth.split(/[\s:]+/).some((piece) => TEST_KEY.test(piece))
+      || Object.entries(process.env).some(([k, v]) => /(?:^|_)TEST(?:_|$)/i.test(k) && v && v.length >= 8 && auth.includes(v)));
+    const authText = (value) => { const a = String(value || ""); const m = /^Basic\s+(\S+)$/i.exec(a); return m ? Buffer.from(m[1], "base64").toString("utf8") : a; };
+    // The headers a key travels in.
+    const KEY_HEADERS = ["authorization", "x-api-key", "api-key", "apikey", "x-auth-token"];
+    // Neon's HTTP driver sends every query, reads too, to its region's API host and names the
+    // database in a header: the call is decided on that database's host. No header: the API host.
+    const NEON_SQL = /^api(?:auth)?\.[a-z0-9.-]+\.neon\.tech$/;
+    const targetOf = (u, headerOf) => {
+      const host = u.hostname.toLowerCase();
+      if (!NEON_SQL.test(host) || u.pathname !== "/sql") return host;
+      try { return new URL(headerOf("neon-connection-string")).hostname.toLowerCase() || host; } catch { return host; }
+    };
+    // `headerOf(name)`: one of the call's headers, read only for a call that is otherwise held. Once a
+    // tagged write is being decided, a failure to decide holds it.
+    // ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
+    // background writes is the upgrade when that matters.
+    const RUN_LIVE_MS = 10 * 60_000;
+    const heldHere = (u, method, headerOf) => {
+      const ctx = als.getStore();
+      if (!WRITES.test(method) || (ctx ? !ctx.turn : Date.now() - lastTurnAt > RUN_LIVE_MS)) return false;
+      try {
+        const host = targetOf(u, headerOf);
+        if (THIS_MACHINE.test(host) || SANDBOX_HOST.test(host) || isModelCall(u.host, u.pathname) || isRetrieval(u) || TOKEN_PATH.test(u.pathname) || readsByName(method, u.pathname) || KEY_HEADERS.some((name) => testKey(authText(headerOf(name))))) return false;
+        return !passNow().some((p) => host === p || host.endsWith("." + p));
+      } catch { return true; }
+    };
+    // A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (Neon's SQL) is held.
+    const readsOnly = (text) => { try { const q = JSON.parse(text)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { return false; } };
+    let heldCount = 0;
+    const fieldsOf = (text, type) => {
+      try { const b = /form/i.test(type || "") ? Object.fromEntries(new URLSearchParams(text)) : JSON.parse(text); return b && typeof b === "object" && !Array.isArray(b) ? b : {}; } catch { return {}; }
+    };
+    const heldReply = (text, type) => JSON.stringify({ ...fieldsOf(text, type), id: `cortad-held-${++heldCount}`, status: "ok" });
+    // Said once per method and host in the app's own output, where the error that follows is read:
+    // a stand-in an SDK cannot parse otherwise reads as a bug in the app. It holds no word that marks
+    // an error, so it is never quoted back as the app's own.
+    const heldSaid = new Set();
+    const heldSay = (method, host) => {
+      if (heldSaid.has(`${method} ${host}`)) return;
+      heldSaid.add(`${method} ${host}`);
+      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
+    };
+    // Named by method and host only: a webhook's path is its credential.
+    const heldRow = (u, method, text, type, ctx) => { heldSay(method, u.hostname); row({ dep: { at: Date.now(), host: u.hostname, status: 200, held: true, ...(ctx ? { ex: ctx.id, turn: ctx.turn } : {}), called: [{ name: `${method} ${u.hostname}`.slice(0, 80), arguments: argsText(fieldsOf(text, type)) }] } }); };
+    // http.request hands back a request before its body is written, so a held one is sent to a server
+    // of this hook's own on this machine, which answers it. Started at the first tagged request.
+    const HELD = Symbol("cortad.held");
+    const heldWaiting = new Map();
+    let heldPort = null, heldStarted = false, heldSent = 0;
+    function heldWarm() {
+      if (heldStarted) return;
+      heldStarted = true;
+      try {
+        const server = http.createServer((req, res) => {
+          const parts = [];
+          req.on("data", (c) => { if (parts.length < 256) parts.push(c); });
+          req.on("end", () => {
+            const id = String(req.headers["x-cortad-held"] || "");
+            const w = heldWaiting.get(id);
+            heldWaiting.delete(id);
+            const text = Buffer.concat(parts).toString("utf8").slice(0, MAX);
+            if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(heldReply(text, req.headers["content-type"]));
+          });
+        });
+        server[HELD] = true;
+        server.listen(0, "127.0.0.1", () => { heldPort = server.address().port; });
+        server.unref();
+      } catch { /* no server: a held write fails to connect instead of leaving */ }
+    }
+    const headerIn = (headers, name) => {
+      if (!headers || typeof headers !== "object" || Array.isArray(headers)) return "";
+      const k = Object.keys(headers).find((n) => n.toLowerCase() === name);
+      return k ? String(headers[k]) : "";
+    };
+    // The call http.request was asked for, when it is one to hold.
+    const heldCall = (args, secure) => {
+      const first = args[0];
+      const given = typeof first === "string" || first instanceof URL ? new URL(String(first)) : null;
+      const o = (given ? (args[1] && typeof args[1] === "object" ? args[1] : {}) : first) || {};
+      const host = String(o.hostname || (o.host && String(o.host).replace(/:\d+$/, "")) || (given && given.hostname) || "localhost");
+      const path = String(o.path || (given ? given.pathname + given.search : "/"));
+      const method = String(o.method || "GET").toUpperCase();
+      const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
+      const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
+      return heldHere(u, method, headerOf) ? { u, method, o, cb: args.find((a) => typeof a === "function") } : null;
+    };
+    const httpRequest = http.request;
+    const sendHeld = ({ u, method, o, cb }, secure) => {
+      const id = String(++heldSent);
+      heldWaiting.set(id, { u, method, ctx: als.getStore() });
+      const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
+      // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
+      const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
+      // A TLS client waits for the handshake before it writes (Stripe's does).
+      if (secure) req.once("socket", (socket) => socket.once("connect", () => socket.emit("secureConnect")));
+      return req;
+    };
+    const heldFetch = async (realFetch, input, init) => {
+      const req = new Request(input, init);
+      const text = await req.clone().text().catch(() => "");
+      if (readsOnly(text)) return realFetch(req);
+      const u = new URL(req.url);
+      heldRow(u, req.method, text, req.headers.get("content-type"), als.getStore());
+      return new Response(heldReply(text, req.headers.get("content-type")), { status: 200, headers: { "content-type": "application/json" } });
+    };
+
     // Outbound: the model call your app makes while it handles that request.
     const bodyText = (body) => (typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : "");
     if (typeof globalThis.fetch === "function") {
       const realFetch = globalThis.fetch;
       globalThis.fetch = function (input, init) {
         let url = null;
+        let hold = false;
         try {
           const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input));
           if (isModelCall(u.host, u.pathname)) url = u;
+          const method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
+          hold = !url && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
         } catch { /* not a URL we can read */ }
+        if (hold) return heldFetch(realFetch, input, init);
         if (!url) {
           // Every outbound host, named by the setting that points at it when one does, and by the
           // host alone otherwise: the search provider behind TAVILY_API_KEY has no URL setting.
@@ -1048,26 +915,27 @@ if (FILE) {
             if (!dep && /^https?:$/.test(u.protocol) && (retrieval || !/^(localhost|127\.0\.0\.1|\[::1\])$/.test(u.hostname))) dep = { host: u.hostname };
           } catch { /* not a URL */ }
           if (!dep) return realFetch.apply(this, arguments);
-          const turn = (als.getStore() || {}).turn;
+          const asked = { ctx: als.getStore(), retrieval, caller: retrieval ? callers() : undefined };
           return realFetch.apply(this, arguments).then(
             (res) => {
-              if (!retrieval) { depRow(dep, res.status, undefined, undefined, turn); return res; }
-              try { res.clone().text().then((t) => depRow(dep, res.status, undefined, passagesFrom(t), turn), () => depRow(dep, res.status, undefined, undefined, turn)); } catch { depRow(dep, res.status, undefined, undefined, turn); }
+              if (!retrieval) { depRow(dep, res.status, asked); return res; }
+              try { res.clone().text().then((t) => depRow(dep, res.status, { ...asked, passages: passagesFrom(t) }), () => depRow(dep, res.status, asked)); } catch { depRow(dep, res.status, asked); }
               return res;
             },
-            (err) => { depRow(dep, 0, err && err.cause && err.cause.code); throw err; },
+            (err) => { depRow(dep, 0, { ...asked, code: err && err.cause && err.cause.code }); throw err; },
           );
         }
-        const sent = bodyText(init && init.body);
-        note(als.getStore(), sent);
-        const call = { host: url.host, path: url.pathname, sent, turn: (als.getStore() || {}).turn, caller: EMBEDDING.test(url.pathname) ? undefined : callers() };
+        let named = null;
+        try { const headers = new Headers((init && init.headers) || (input && input.headers) || undefined); named = GATEWAY_MODEL.map((h) => headers.get(h)).find(Boolean); } catch { /* headers we cannot read name no model */ }
+        const sent = asChat(bodyText(init && init.body), named);
+        const ctx = note(als.getStore(), sent);
+        const call = { host: url.host, path: url.pathname, sent, ctx, t0: Date.now(), caller: EMBEDDING.test(url.pathname) ? undefined : callers() };
         return realFetch.apply(this, arguments).then((res) => {
+          if (ctx) ctx.heard = true;
           try {
             // A clone is a tee: your app's branch gets every byte as fast as it reads, this one is read to the end.
-            res.clone().text().then(
-              (text) => meter({ ...call, status: res.status, type: res.headers.get("content-type"), body: text }),
-              () => meter({ ...call, status: res.status, type: "", body: "" }),
-            );
+            const type = res.headers.get("content-type");
+            readAll(res.clone()).then((text) => meter({ ...call, status: res.status, type, body: text }));
           } catch { meter({ ...call, status: res.status, type: "", body: "" }); }
           return res;
         }, (err) => { meter({ ...call, status: 0, type: "", body: "" }); throw err; });
@@ -1076,6 +944,9 @@ if (FILE) {
     for (const mod of [http, https]) {
       const request = mod.request;
       mod.request = function (...args) {
+        let held = null;
+        try { held = heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
+        if (held) return sendHeld(held, mod === https);
         const req = request.apply(this, args);
         try {
           const o = typeof args[0] === "string" || args[0] instanceof URL ? new URL(String(args[0])) : args[0] || {};
@@ -1088,13 +959,14 @@ if (FILE) {
             const write = req.write;
             const end = req.end;
             req.write = function (chunk, ...r) { if (chunk && typeof chunk !== "function") parts.push(Buffer.from(chunk)); return write.call(this, chunk, ...r); };
-            req.end = function (chunk, ...r) { if (chunk && typeof chunk !== "function") parts.push(Buffer.from(chunk)); sent = Buffer.concat(parts).toString("utf8"); note(ctx, sent); return end.call(this, chunk, ...r); };
+            req.end = function (chunk, ...r) { if (chunk && typeof chunk !== "function") parts.push(Buffer.from(chunk)); sent = asChat(Buffer.concat(parts).toString("utf8"), GATEWAY_MODEL.map((h) => req.getHeader && req.getHeader(h)).find(Boolean)); call.ctx = note(ctx, sent); return end.call(this, chunk, ...r); };
             const bare = String(path || "").split("?")[0];
-            const call = { host: String(host || ""), path: bare, turn: ctx && ctx.turn, caller: EMBEDDING.test(bare) ? undefined : callers() };
+            const call = { host: String(host || ""), path: bare, ctx, t0: Date.now(), caller: EMBEDDING.test(bare) ? undefined : callers() };
             let done = false;
             const once = (row) => { if (!done) { done = true; meter({ ...call, sent, ...row }); } };
             req.once("error", () => once({ status: 0, type: "", body: "" }));
             req.once("response", (res) => {
+              if (call.ctx) call.ctx.heard = true;
               // The reply's bytes as the parser hands them over, without reading the stream: your
               // app's own listeners and pipes see exactly what they would have.
               const got = [];