cortad 0.3.10 → 0.4.0

package/lib/trace.cjs

@@ -17,7 +17,7 @@ if (FILE) {
     const http = require("node:http");
     const https = require("node:https");
     const als = new AsyncLocalStorage();
-    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
+    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
     const row = (value) => { try { fs.appendFileSync(FILE, JSON.stringify(scrubbed(value)) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ } };
     // What the app writes into its own folder while a run is on: each file copied once before its
     // first write, so the command puts every one back when the run ends (lib/writes.mjs). Trials
@@ -313,13 +313,10 @@ if (FILE) {
       recheck = false;
       setImmediate(() => { try { if (table().routes.length !== routesSaid) sayRoutes(lastPort); } catch { /* as above */ } });
     };
-    // When the run last sent a request: a write made outside every request (a queue's worker, a
-    // timer) is held while a run is live, since it may be carrying out a trial's ask.
-    let lastTurnAt = -Infinity;
     const { tied, requestCtx, note, ended, meter } = makeRecorder({
       row,
       rulesFile: process.env.CORTAD_RULES_FILE,
-      onTurn: () => { heldWarm(); lastTurnAt = Date.now(); },
+      onTurn: () => {},
       onEnded: (ctx, steps) => writtenAt(ctx, steps),
     });
     // Where in the app's own code each part of a reply was written: the app's line on the stack of the
@@ -419,7 +416,6 @@ if (FILE) {
     // context a model call is pinned by: it can only be the step an answer comes on.
     const emit = http.Server.prototype.emit;
     http.Server.prototype.emit = function (type, req, ...rest) {
-      if (this[HELD]) return emit.call(this, type, req, ...rest);
       if (type === "listening") { try { listening(this.address()?.port); } catch { /* not a TCP server */ } }
       if (type === "request") { recheckRoutes(); sweepTools(); }
       if (type !== "request" || !req || !req.method || /^(?:HEAD|OPTIONS)$/.test(req.method)) return emit.call(this, type, req, ...rest);
@@ -735,327 +731,16 @@ if (FILE) {
       return socketConnect.apply(this, args);
     };
 
-    // Outbound writes a trial makes are held in the app, never sent: a trial that books, charges,
-    // emails or deletes would otherwise do it for real. Held: a call made inside a request the run
-    // tagged, with a writing method, to a host that is not a model, a retrieval, this machine, a copy
-    // of ours or a host the person said yes to. A call carrying a provider's test key goes to that
-    // provider's own sandbox as sent. The app is answered with a success shaped like what it sent,
-    // and the run is told by a dep row with `held` and the clipped call.
-    const OUTBOUND = process.env.CORTAD_OUTBOUND_FILE;
-    let passed = [], passedAt = -1;
-    const passNow = () => {
-      try {
-        const at = fs.statSync(OUTBOUND).mtimeMs;
-        if (at !== passedAt) { passedAt = at; const got = JSON.parse(fs.readFileSync(OUTBOUND, "utf8")); passed = Array.isArray(got.pass) ? got.pass.filter((h) => typeof h === "string" && h) : []; }
-      } catch { /* not written yet: nothing passes */ }
-      return passed;
-    };
-    const WRITES = /^(?:POST|PUT|PATCH|DELETE)$/;
-    const THIS_MACHINE = /^(?:localhost|127(?:\.\d+){3}|\[?::1\]?|0\.0\.0\.0)$/i;
-    // A provider's own sandbox, named so in the host: api.sandbox.paypal.com, sandbox-api.polar.sh.
-    const SANDBOX_HOST = /(?:^|[.-])(?:sandbox|sbox)[.-]/i;
-    // ponytail: a sign-in's token refresh is a POST that changes nothing, told apart by its path only.
-    const TOKEN_PATH = /\/(?:oauth2?\/)?token(?:[/?]|$)/i;
-    // An API where every call is a POST names what a call does in its last segment, as
-    // resource.verb_words (customers.get, billing.preview_attach) or as a gRPC or Connect method
-    // (acme.v1.UserService/GetUser). A POST so named that starts with a reading word, and holds no word
-    // that makes the read a write (get_or_create, check_in, GetLease), goes out.
-    // A preview commits nothing whatever it previews; any other reading word reads only while no word
-    // after it writes: credits.check_deduct and usage.count_increment went out as reads.
-    // ponytail: decided on the name alone, so a POST named as a plain read whose body writes goes out.
-    // A rule on the body is the upgrade if one is ever seen.
-    const WRITE_WORD = "create|update|delete|remove|set|add|put|insert|upsert|write|save|store|record|track|log|send|deduct|increment|decrement|consume|use|spend|charge|pay|refund|cancel|reserve|lock|unlock|commit|apply|attach|detach|start|stop|run|trigger|reset|rotate|revoke|grant|issue|mint|transfer|move|merge|sync|import|export|upload|publish|enqueue|push|pop|ack|touch|mark|close|approve|reject|submit|confirm|redeem|claim";
-    const DOT_CALL = /^[A-Za-z][\w-]*\.[a-z][a-z_]*$/, DOT_READ = /^(?:get|list|check|search|query|find|lookup|retrieve|describe|count|preview)$/, DOT_NOT = new RegExp(`^(?:or|and|in|out|next|${WRITE_WORD})$`);
-    const RPC_CALL = /^(?:[A-Z][a-z0-9]*)+$/, RPC_READ = /^(?:Get|List|Search|Query|Find|Lookup|Describe)$/, RPC_NOT = new RegExp(`^(?:or|and|next|lease|${WRITE_WORD})$`, "i");
-    const readWords = (words, read, not) => read.test(words[0]) && (/^preview$/i.test(words[0]) || !words.slice(1).some((w) => not.test(w)));
-    const readsByName = (method, pathname) => {
-      if (method !== "POST") return false;
-      const parts = pathname.split("/").filter(Boolean);
-      const last = parts[parts.length - 1] || "", before = parts[parts.length - 2] || "";
-      if (DOT_CALL.test(last)) return readWords(last.split(".")[1].split("_"), DOT_READ, DOT_NOT);
-      return /\.[A-Z]\w*$/.test(before) && RPC_CALL.test(last) && readWords(last.split(/(?=[A-Z])/), RPC_READ, RPC_NOT);
-    };
-    // A provider's test-mode key says so in the prefix of the key itself, set off by underscores
-    // (Stripe's sk_test_, am_sk_test_, pdl_sdbx_), or it is a value of a setting the app keeps as a
-    // test one. The word elsewhere is not it: a Basic user named test-admin and a live key holding
-    // "-Test-" both went out as test keys.
-    const TEST_KEY = /^(?:[a-z0-9]{2,8}_){0,3}(?:test|sandbox|sbox|sdbx)_[\w-]{4,}$/i;
-    const testKey = (auth) => Boolean(auth) && (auth.split(/[\s:]+/).some((piece) => TEST_KEY.test(piece))
-      || Object.entries(process.env).some(([k, v]) => /(?:^|_)TEST(?:_|$)/i.test(k) && v && v.length >= 8 && auth.includes(v)));
-    const authText = (value) => { const a = String(value || ""); const m = /^Basic\s+(\S+)$/i.exec(a); return m ? Buffer.from(m[1], "base64").toString("utf8") : a; };
-    // The headers a key travels in.
-    const KEY_HEADERS = ["authorization", "x-api-key", "api-key", "apikey", "x-auth-token"];
-    // Neon's HTTP driver sends every query, reads too, to its region's API host and names the
-    // database in a header: the call is decided on that database's host. No header: the API host.
-    const NEON_SQL = /^api(?:auth)?\.[a-z0-9.-]+\.neon\.tech$/;
-    const targetOf = (u, headerOf) => {
-      const host = u.hostname.toLowerCase();
-      if (!NEON_SQL.test(host) || u.pathname !== "/sql") return host;
-      try { return new URL(headerOf("neon-connection-string")).hostname.toLowerCase() || host; } catch { return host; }
-    };
-    // `headerOf(name)`: one of the call's headers, read only for a call that is otherwise held. Once a
-    // tagged write is being decided, a failure to decide holds it.
-    // ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
-    // background writes is the upgrade when that matters.
-    const RUN_LIVE_MS = 10 * 60_000;
-    // The copies this hook makes of Qdrant collections carry this suffix (copyOf below).
-    const OUR_COPY = /_cortad_\d+$/;
-    const heldHere = (u, method, headerOf) => {
-      const ctx = als.getStore();
-      if (!WRITES.test(method) || (ctx ? !ctx.turn : Date.now() - lastTurnAt > RUN_LIVE_MS)) return false;
-      // A read of a Qdrant collection, however its server is named (a bare address holds no word
-      // like qdrant), and any call to a copy this hook made, go out.
-      const q = qdrantCall(u, method);
-      if (q && (!q.write || (q.collection && OUR_COPY.test(q.collection)))) return false;
-      try {
-        const host = targetOf(u, headerOf);
-        if (THIS_MACHINE.test(host) || SANDBOX_HOST.test(host) || isModelCall(u.host, u.pathname) || isRetrieval(u) || TOKEN_PATH.test(u.pathname) || readsByName(method, u.pathname) || KEY_HEADERS.some((name) => testKey(authText(headerOf(name))))) return false;
-        return !passNow().some((p) => host === p || host.endsWith("." + p));
-      } catch { return true; }
-    };
-    // A write to a Qdrant collection made inside a run goes to a copy of that collection on the same
-    // server, made at the first such write: the collection is read page by page and written under
-    // `<name>_cortad_<pid>`, and from then on every call to that collection, reads too, goes to the
-    // copy, so the app finds what it wrote. The original is never written. A copy that cannot be
-    // made (a collection over the size a run copies, a server that refused) leaves the write held
-    // like any other. Each copy is reported as a `copy` row, and the command deletes them when it
-    // ends. A copy of ours is never copied again. ulaim's hosted Qdrant held Run for the person's
-    // yes for seventeen minutes; this is what the yes stood in for.
-    const copies = new Map();
-    // What one process copies at most: collections, and points across them. Past it a write is held
-    // like any other, and the app's output says so once. A run is a few conversations' writes, never
-    // a cluster's.
-    const COPIES_MAX = 8;
-    const POINTS_MAX = 300_000;
-    let copied = 0, pointsCopied = 0;
-    const nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch : null;
-    let qdrantLib = null;
-    const qdrantMod = () => (qdrantLib ??= import(require("node:url").pathToFileURL(require("node:path").join(__dirname, "qdrant.mjs")).href));
-    const inRun = () => { const ctx = als.getStore(); return ctx ? Boolean(ctx.turn) : Date.now() - lastTurnAt <= RUN_LIVE_MS; };
-    // What to do with a call: null to leave it alone; `hold` for a write of the server itself
-    // (/collections/aliases); else the collection's copy when there is one, or none yet for a write
-    // in a run, which makes it.
-    const guarded = (u, method) => {
-      if (!/^https?:$/.test(u.protocol)) return null;
-      const call = qdrantCall(u, method);
-      if (!call) return null;
-      if (!call.collection) return call.write && inRun() ? { hold: true } : null;
-      // The person's own calls, outside a run, go where they were sent: their writes are theirs to keep.
-      if (OUR_COPY.test(call.collection) || !inRun()) return null;
-      const key = `${u.host}|${call.collection}`;
-      const copy = copies.get(key);
-      if (copy) return { key, call, copy };
-      if (!call.write) return null;
-      // A change to the collection's shape, or a write past this process's copy budget, is held.
-      if (call.kind === "schema") return { hold: true };
-      if (copied >= COPIES_MAX || pointsCopied >= POINTS_MAX) { copySay(u.host, call.collection, `this run already copied ${copied} collections, ${pointsCopied} points`); return { hold: true }; }
-      return { key, call, copy: null };
-    };
-    // Said once per collection in the app's own output when no copy could be made and the write was
-    // kept on this machine instead, with the reason the server gave.
-    const copySaid = new Set();
-    const copySay = (host, collection, why) => {
-      if (copySaid.has(`${host}|${collection}`)) return;
-      copySaid.add(`${host}|${collection}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app write into the Qdrant collection ${collection} at ${host}. Cortad could not copy that collection on its server (${why}), so the write was kept on this machine and answered with a stand-in success.\n`); } catch { /* no stderr */ }
-    };
-    const toCopy = (u, clone, call) => { const t = new URL(u.href); t.pathname = `/collections/${encodeURIComponent(clone)}${call.rest}`; return t; };
-    // The copy's name, made now when none exists; null when none could be made. The key the app sent
-    // is the key the copy is made with, and never leaves this process.
-    const copyOf = (u, headerOf, g) => {
-      const have = copies.get(g.key);
-      if (have) return Promise.resolve(have);
-      if (!nativeFetch) return Promise.resolve(null);
-      const clone = `${g.call.collection.slice(0, 40)}_cortad_${process.pid}`;
-      const bearer = /^Bearer\s+(\S+)/i.exec(headerOf("authorization") || "");
-      const conn = { base: `${u.protocol}//${u.host}`, apiKey: headerOf("api-key") || (bearer ? bearer[1] : ""), fetch: nativeFetch };
-      const made = qdrantMod().then(({ cloneQdrant }) => cloneQdrant(conn, g.call.collection, clone)).then((got) => {
-        if (!got || got.why) { copies.delete(g.key); copySay(u.host, g.call.collection, got ? got.why : "nothing"); return null; }
-        copied += 1; pointsCopied += got.points ?? 0;
-        copies.set(g.key, clone);
-        row({ copy: { host: u.hostname, base: conn.base, collection: g.call.collection, clone } });
-        return clone;
-      }, (e) => { copies.delete(g.key); copySay(u.host, g.call.collection, e && e.message ? e.message : "error"); return null; });
-      copies.set(g.key, made);
-      return made;
-    };
-    // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
-    // a SELECT can write through a function) is held.
-    // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
-    // there cannot write: one statement that starts as a read and holds no word that writes, sent to
-    // what its address or its headers show is one of them, goes out. Anything this cannot read as that
-    // stays held. Databuddy's agent had 45 replies come back empty while its own ClickHouse queries
-    // were answered here with a stand-in.
-    const SQL_QUOTED = /'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|\/\*[\s\S]*?\*\//g;
-    // SHOW, DESCRIBE and EXISTS read whatever follows them. A SELECT, a WITH or an EXPLAIN reads
-    // unless it holds a word that writes inside it (a CTE that deletes, SELECT INTO, EXPLAIN ANALYZE
-    // of an insert) or hands its text on to another database to run.
-    const SQL_SHOWS = /^(?:show|describe|desc|exists)\b/i, SQL_SELECTS = /^(?:select|with|explain)\b/i;
-    const SQL_WRITES = /(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])/i;
-    const SQL_HANDS_ON = /\b(?:table|query|jdbc|odbc|executable)\s*\(/i;
-    const statementOf = (sql) => String(sql || "").replace(SQL_QUOTED, (m) => (m[0] === "'" ? "''" : /^["`]/.test(m) ? "x" : " ")).trim().replace(/;\s*$/, "");
-    // A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
-    const whole = (bare) => !/[;'"`]|\/\*|\$\$/.test(bare.replace(/''/g, ""));
-    const selects = (bare) => whole(bare) && (SQL_SHOWS.test(bare) || (SQL_SELECTS.test(bare) && !SQL_WRITES.test(bare) && !SQL_HANDS_ON.test(bare)));
-    const ANALYTICS_NAME = /clickhouse|trino|presto/i;
-    const ANALYTICS_HEADERS = ["x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user"];
-    const analytics = (u, headerOf, port) => /^(?:8123|8443)$/.test(String(port || u.port)) || ANALYTICS_NAME.test(u.hostname) || ANALYTICS_NAME.test(headerOf("user-agent") || "")
-      || ANALYTICS_HEADERS.some((name) => headerOf(name)) || u.pathname === "/v1/statement";
-    const readsOnly = (text, u, headerOf = () => "", port) => {
-      const sent = String(text || "").trim();
-      try { const q = JSON.parse(sent)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { /* not JSON: a statement sent as text */ }
-      if (!u || !analytics(u, headerOf, port)) return false;
-      // ClickHouse joins a `query` in the address to the body: both are read as the one statement.
-      const asked = `${u.searchParams.get("query") || ""} ${sent}`;
-      // ClickHouse reads a backslash before a quote as part of the string and Trino as its end, so
-      // where a string stops is not known here: held.
-      // ponytail: a ClickHouse read with an escaped quote in a string is held too; told apart by which
-      // database answered if that is ever seen.
-      return !/\\['"`]/.test(asked) && selects(statementOf(asked));
-    };
-    // A call passed on from this hook's own server, after its body was read: never held again.
-    const PASSED = Symbol("cortad.passed");
-    const passedOn = (args) => { const o = typeof args[0] === "string" || args[0] instanceof URL ? args[1] : args[0]; return Boolean(o && o[PASSED]); };
-    let heldCount = 0;
-    const fieldsOf = (text, type) => {
-      try { const b = /form/i.test(type || "") ? Object.fromEntries(new URLSearchParams(text)) : JSON.parse(text); return b && typeof b === "object" && !Array.isArray(b) ? b : {}; } catch { return {}; }
-    };
-    const heldReply = (text, type) => JSON.stringify({ ...fieldsOf(text, type), id: `cortad-held-${++heldCount}`, status: "ok" });
-    // Said once per method and host in the app's own output, where the error that follows is read:
-    // a stand-in an SDK cannot parse otherwise reads as a bug in the app. It holds no word that marks
-    // an error, so it is never quoted back as the app's own.
-    const heldSaid = new Set();
-    const heldSay = (method, host) => {
-      if (heldSaid.has(`${method} ${host}`)) return;
-      heldSaid.add(`${method} ${host}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
-    };
-    // Named by method and host only: a webhook's path is its credential.
-    const heldRow = (u, method, text, type, ctx) => { heldSay(method, u.hostname); row({ dep: { at: Date.now(), host: u.hostname, status: 200, held: true, ...(ctx ? { ex: ctx.id, turn: ctx.turn } : {}), called: [{ name: `${method} ${u.hostname}`.slice(0, 80), arguments: argsText(fieldsOf(text, type)) }] } }); };
-    // http.request hands back a request before its body is written, so a held one is sent to a server
-    // of this hook's own on this machine, which answers it. Started at the first tagged request.
-    const HELD = Symbol("cortad.held");
-    const heldWaiting = new Map();
-    let heldPort = null, heldStarted = false, heldSent = 0;
-    function heldWarm() {
-      if (heldStarted) return;
-      heldStarted = true;
-      try {
-        const server = http.createServer((req, res) => {
-          const parts = [];
-          req.on("data", (c) => { if (parts.length < 256) parts.push(c); });
-          req.on("end", () => {
-            const id = String(req.headers["x-cortad-held"] || "");
-            const w = heldWaiting.get(id);
-            heldWaiting.delete(id);
-            const sent = Buffer.concat(parts);
-            const text = sent.toString("utf8").slice(0, MAX);
-            const headerOf = (name) => String(req.headers[name] || "");
-            // The call goes on to where it was sent, as it was sent, or to `to` instead, and its
-            // answer comes back through this server.
-            const forward = (to) => {
-              const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
-              const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
-              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true, ...(to && !given ? { path: to.pathname + to.search } : {}) };
-              // Sent inside the request that asked, so the call is recorded behind that reply.
-              const send = () => (w.secure ? https : http).request(...(given ? [to ? to.href : w.args[0], options] : [options]));
-              const up = w.ctx ? als.run(w.ctx, send) : send();
-              up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
-              up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
-              res.on("close", () => up.destroy());
-              return up.end(sent);
-            };
-            const answer = () => {
-              if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
-              res.writeHead(200, { "content-type": "application/json" });
-              res.end(heldReply(text, req.headers["content-type"]));
-            };
-            // A body that only reads, known now that it is here, goes on as it was sent.
-            if (w && parts.length < 256 && readsOnly(text, w.u, headerOf, w.port)) return forward(null);
-            // A call to a Qdrant collection goes to the run's copy of it, made now when this is its first write.
-            if (w && w.copy) return copyOf(w.u, headerOf, w.copy).then((clone) => (clone ? forward(toCopy(w.u, clone, w.copy.call)) : answer()), answer);
-            answer();
-          });
-        });
-        server[HELD] = true;
-        server.listen(0, "127.0.0.1", () => { heldPort = server.address().port; });
-        server.unref();
-      } catch { /* no server: a held write fails to connect instead of leaving */ }
-    }
-    const headerIn = (headers, name) => {
-      if (!headers || typeof headers !== "object" || Array.isArray(headers)) return "";
-      const k = Object.keys(headers).find((n) => n.toLowerCase() === name);
-      return k ? String(headers[k]) : "";
-    };
-    // The call http.request was asked for, when it is one to hold.
-    const heldCall = (args, secure) => {
-      const first = args[0];
-      const given = typeof first === "string" || first instanceof URL ? new URL(String(first)) : null;
-      const o = (given ? (args[1] && typeof args[1] === "object" ? args[1] : {}) : first) || {};
-      const host = String(o.hostname || (o.host && String(o.host).replace(/:\d+$/, "")) || (given && given.hostname) || "localhost");
-      const path = String(o.path || (given ? given.pathname + given.search : "/"));
-      const method = String(o.method || "GET").toUpperCase();
-      const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
-      const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      const port = o.port || (given && given.port) || "";
-      // The server's address whole, port included, names a collection's copy; the hold is decided on
-      // the host alone, as before.
-      const at = new URL(u.href);
-      if (port) at.port = String(port);
-      const g = guarded(at, method);
-      if (!g && !heldHere(u, method, headerOf)) return null;
-      return { u: at, method, o, args: args.filter((a) => typeof a !== "function"), port, cb: args.find((a) => typeof a === "function"), ...(g && !g.hold ? { copy: g } : {}) };
-    };
-    const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb, args, port, copy }, secure) => {
-      const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure, copy });
-      const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
-      // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
-      const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
-      // A TLS client waits for the handshake before it writes (Stripe's does).
-      if (secure) req.once("socket", (socket) => socket.once("connect", () => socket.emit("secureConnect")));
-      return req;
-    };
-    const heldFetch = async (realFetch, input, init) => {
-      const req = new Request(input, init);
-      const text = await req.clone().text().catch(() => "");
-      if (readsOnly(text, new URL(req.url), (name) => req.headers.get(name) || "")) return realFetch(req);
-      const u = new URL(req.url);
-      heldRow(u, req.method, text, req.headers.get("content-type"), als.getStore());
-      return new Response(heldReply(text, req.headers.get("content-type")), { status: 200, headers: { "content-type": "application/json" } });
-    };
-
     // Outbound: the model call your app makes while it handles that request.
     const bodyText = (body) => (typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : "");
     if (typeof globalThis.fetch === "function") {
       const realFetch = globalThis.fetch;
-      // A call to a Qdrant collection, sent again through this same wrapper at the copy's address, so
-      // it is recorded like any retrieval; held when no copy could be made.
-      const guardedFetch = async (self, wrapped, input, init, u, method, g) => {
-        if (g.hold) return heldFetch(realFetch, input, init);
-        const req = new Request(input, init);
-        const clone = await (typeof g.copy === "string" ? g.copy : copyOf(u, (name) => req.headers.get(name) || "", g));
-        if (!clone) return heldFetch(realFetch, input, init);
-        const body = method === "GET" || method === "HEAD" ? undefined : await req.arrayBuffer();
-        return wrapped.call(self, toCopy(u, clone, g.call).href, { method, headers: req.headers, body, signal: req.signal });
-      };
       globalThis.fetch = function (input, init) {
         let url = null;
-        let hold = false;
-        let guard = null;
-        let at = null;
-        let method = "GET";
         try {
           const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input));
-          at = u;
           if (isModelCall(u.host, u.pathname)) url = u;
-          method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
-          guard = !url ? guarded(u, method) : null;
-          hold = !url && !guard && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
         } catch { /* not a URL we can read */ }
-        if (guard) return guardedFetch(this, globalThis.fetch, input, init, at, method, guard);
-        if (hold) return heldFetch(realFetch, input, init);
         if (!url) {
           // Every outbound host, named by the setting that points at it when one does, and by the
           // host alone otherwise: the search provider behind TAVILY_API_KEY has no URL setting.
@@ -1097,9 +782,6 @@ if (FILE) {
     for (const mod of [http, https]) {
       const request = mod.request;
       mod.request = function (...args) {
-        let held = null;
-        try { held = passedOn(args) ? null : heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
-        if (held) return sendHeld(held, mod === https);
         const req = request.apply(this, args);
         try {
           const o = typeof args[0] === "string" || args[0] instanceof URL ? new URL(String(args[0])) : args[0] || {};

package/lib/verbs.mjs

@@ -6,6 +6,7 @@ import { askReach } from "./auto-reach.mjs";
 import { homeOf, projectOf } from "./home.mjs";
 import { reach as reachApp } from "./reach.mjs";
 import { fieldConnectText, fieldText, findingsText, finished, linesOf, notStartedText, refusedText, restartedText, runText, STARTING, startedText, statusText, testedLine, upWaitingText, waitingText } from "./text.mjs";
+import { incidentsText, intelligenceText, outcomesText, queryText } from "./intel-text.mjs";
 
 // The ten things a coding agent may ask of Cortad, each a call to the API with this machine's key
 // and a rendering from lib/text.mjs; `reach` also sends to the app on this machine. The MCP tools
@@ -286,11 +287,65 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
     return res.ok ? { text: fieldConnectText(res.data), data: res.data } : failed(res);
   };
 
+  // A world for an AI that is not a chat (the server's world/run.ts): built on this machine from the
+  // app's own seed, planted with problems whose answers are known, discovered by the app's own code.
+  // `ask`: what the agent built or wants tested, kept with the report. Answers at once with the id.
+  const world = async ({ ask } = {}) => {
+    const res = await call("POST", "/mcp/world", ask ? { ask: String(ask) } : {});
+    if (!res.ok) return failed(res);
+    if (res.data?.joined) return { text: `A world is already being tested: ${res.data.jobId}.\nnext: world_status ${res.data.jobId}`, data: res.data };
+    if (!res.data?.started) return { text: `${res.data?.why ?? "No world started."}\nNothing ran.`, data: res.data, isError: true, code: "world_refused" };
+    const planted = Array.isArray(res.data.situations) && res.data.situations.length ? `Planted: ${res.data.situations.join("; ")}.` : `${res.data.worlds ?? ""} worlds.`;
+    return { text: `World started: ${res.data.jobId}. ${planted} Each is tested ${res.data.repeats} times. The person sees it at ${res.data.url}\nnext: world_status ${res.data.jobId}`, data: res.data };
+  };
+  // The one door: the agent says what it built or wants tested, and Cortad decides what kind of test
+  // that is. A world where the app has one and the ask names something it can plant; a run of the
+  // app's chat surfaces otherwise. The answer says which, and what to follow it with.
+  const test = async ({ ask } = {}) => {
+    const res = await call("POST", "/mcp/world", { ...(ask ? { ask: String(ask) } : {}), only: "matched" });
+    if (res.ok && res.data?.started) return { text: `This is tested in a world. World started: ${res.data.jobId}. Planted: ${(res.data.situations ?? []).join("; ")}. Each is tested ${res.data.repeats} times. The person sees it at ${res.data.url}\nnext: world_status ${res.data.jobId}`, data: res.data };
+    if (res.ok && res.data?.joined) return { text: `A world is already being tested: ${res.data.jobId}.\nnext: world_status ${res.data.jobId}`, data: res.data };
+    const why = res.ok ? (res.data?.unmatched ? "Nothing a world can plant is what that is about, so it is tested by a run of the app's chat surfaces." : "No world is written for this app yet, so it is tested by a run of the app's chat surfaces.") : "The world could not be asked, so it is tested by a run of the app's chat surfaces.";
+    const ran = await run({});
+    return { ...ran, text: `${why}\n${ran.text}` };
+  };
+  const worldStatus = async ({ jobId } = {}) => {
+    if (!jobId) return { text: "Name the world: world_status <id>.", isError: true, code: "no_id" };
+    const res = await call("GET", `/mcp/world/${encodeURIComponent(String(jobId))}`);
+    if (!res.ok) return failed(res);
+    const running = res.data.status === "queued" || res.data.status === "running";
+    return { text: `${res.data.text}\nThe person sees this at ${res.data.url}\nnext: ${running ? `world_status ${jobId}` : "status"}`, data: res.data };
+  };
+
   const field = async ({ days } = {}) => {
     const res = await call("GET", `/mcp/field${days ? `?days=${Number(days)}` : ""}`);
     return res.ok ? { text: fieldText(res.data), data: res.data } : failed(res);
   };
 
+  // The Intelligence Layer: the board in numbers, what is wrong, what counts as an outcome, a
+  // subscription to incidents, and a question to the warehouse.
+  const intelligence = async ({ days } = {}) => {
+    const res = await call("GET", `/mcp/intelligence${days ? `?days=${Number(days)}` : ""}`);
+    return res.ok ? { text: intelligenceText(res.data), data: res.data } : failed(res);
+  };
+  const incidents = async () => {
+    const res = await call("GET", "/mcp/incidents");
+    return res.ok ? { text: incidentsText(res.data), data: res.data } : failed(res);
+  };
+  const outcomes = async ({ proposals } = {}) => {
+    const res = proposals ? await call("POST", "/mcp/outcomes", { proposals }) : await call("GET", "/mcp/outcomes");
+    return res.ok ? { text: outcomesText(res.data), data: res.data } : failed(res);
+  };
+  const subscribe = async ({ url }) => {
+    const res = await call("POST", "/mcp/subscribe", { url });
+    return res.ok ? { text: `Subscribed. ${res.data.said}
+Secret, shown once: ${res.data.secret}`, data: res.data } : failed(res);
+  };
+  const query = async (ask) => {
+    const res = await call("POST", "/mcp/query", ask);
+    return res.ok ? { text: queryText(res.data), data: res.data } : { text: queryText(res.data ?? { error: res.text }), data: res.data };
+  };
+
   // `status --changed`: the files Cortad cites that changed since the latest run started, with the
   // findings at them. Empty when there is nothing to say, or nothing could be asked. The code review's
   // files are those of the review shown: the read's misses, or the lines Cortad's team's review cites.
@@ -312,7 +367,7 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
   };
 
   // `post` and `changed` serve lib/cli.mjs; the MCP answers only the names in TOOLS.
-  return { status, reach, run, run_status: runStatus, wait, findings, verify, dispute, feedback, field_connect: fieldConnect, field, post, changed };
+  return { status, reach, run, run_status: runStatus, wait, findings, verify, dispute, feedback, field_connect: fieldConnect, field, world, world_status: worldStatus, test, connect: fieldConnect, intelligence, incidents, outcomes, subscribe, query, post, changed };
 }
 
 const sizeOf = (path) => { try { return statSync(path).size; } catch { return 0; } };