cortad 0.3.11 → 0.4.0

package/lib/replay.mjs

@@ -7,13 +7,16 @@ import { SourceMap } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CODE, TEST } from "./data.mjs";
+import { CODE, TEST } from "./files.mjs";
 import { canaryOf, doorOf, doorsOf, exchangesOf, isCanary, proofOf, provingOf, sitesOf } from "./proof.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const HOOK = join(HERE, "trace.cjs");
 const PYHOOK = join(HERE, "pyhook");
 export const CAPTURED = "captured";
+// The header a run's request carries to speak as one of the app's own callers: the role, never the
+// token, which this machine holds and puts in (local.mjs).
+export const AS_HEADER = "x-cortad-as";
 // Never replayed: they describe one connection, not the caller.
 const SECRET_HEADER = /authorization|cookie|token|secret|session|csrf|api-?key/i;
 const HOP = /^(?:host|content-length|connection|keep-alive|transfer-encoding|upgrade|expect|te|trailer|accept-encoding|x-cortad-as|x-cortad-turn)$/i;
@@ -37,8 +40,6 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
   let newestTable = null;
   // Each server a hooked process opened a connection to, by host and port.
   const conns = new Map();
-  // The Qdrant collections the hook copied for a run's writes, by server and name (lib/stores.mjs drops them).
-  const copies = new Map();
   // The model's last words and status for each of a run's turns on an endpoint the app answers
   // later, by turn (lib/wire.cjs answeredLater).
   const answers = new Map();
@@ -50,7 +51,7 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
   // requires, to one without.
   const bunHook = /\s/.test(HOOK) ? (() => {
     const dir = mkdtempSync(join(tmpdir(), "cortad-"));
-    for (const name of ["trace.cjs", "wire.cjs", "tied.cjs", "qdrant.mjs"]) copyFileSync(join(HERE, name), join(dir, name));
+    for (const name of ["trace.cjs", "wire.cjs", "tied.cjs"]) copyFileSync(join(HERE, name), join(dir, name));
     return join(dir, "trace.cjs");
   })() : HOOK;
   // The hooks are handed to whatever is started: a Node app loads the first, a Bun app the same file
@@ -64,9 +65,6 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
     // The read's tools by name, file and function, written by the run the same way: the hook wraps
     // those functions so a tool your own code runs is seen even when no model named it.
     CORTAD_TOOLS_FILE: join(work, "tools.json"),
-    // The hosts a trial's outbound writes may reach; every other write made inside a trial's turn
-    // is held in the app and answered there (the person's yes, written by the command).
-    CORTAD_OUTBOUND_FILE: join(work, "outbound.json"),
     // While a run is on, the hook records each file the app writes under its own folder, with a
     // copy from before the first write, and the run's end puts them back (lib/writes.mjs).
     ...(writes && root ? { CORTAD_WRITES_DIR: writes, CORTAD_APP_ROOT: root } : {}),
@@ -98,7 +96,6 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
       if (Number.isInteger(row.listen)) { ports.add(row.listen); continue; }
       if (row.routes) { const t = routeTable(row.routes); if (t) { tables.set(t.port, t); newestTable = t; } continue; }
       if (row.conn) { const { host, port } = row.conn; if (typeof host === "string" && Number.isInteger(port)) conns.set(`${host}:${port}`, { host, port }); continue; }
-      if (row.copy) { const { base, collection, clone } = row.copy; if ([base, collection, clone].every((v) => typeof v === "string" && v)) copies.set(`${base}|${collection}`, { base, collection, clone }); continue; }
       if (row.answer) {
         const { turn, status, reply } = row.answer;
         if (TURN.test(turn ?? "")) answers.set(turn, { status: Number.isInteger(status) ? status : 0, reply: typeof reply === "string" ? reply : "" });
@@ -159,10 +156,8 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
     // The app's routes as its framework holds them: the table of the process on `port`, else the
     // newest any hooked process wrote. Empty when no hook read one.
     registry: (port) => { poll(); return tables.get(port) ?? newestTable ?? {}; },
-    // The servers the app has connected to so far (lib/stores.mjs names the ones no setting does).
+    // The servers the app has connected to so far: where test conversations write, said on the card.
     connections: () => { poll(); return [...conns.values()]; },
-    // The collections the hook copied on a Qdrant server for a run's writes, to be deleted at the end.
-    copies: () => { poll(); return [...copies.values()]; },
     // The model's last words for a run's turn on an endpoint the app answers later, once the hook
     // has written them; null at `until`, or once `signal` aborts. `forget` drops a turn sent again.
     answered: async (turn, until, signal) => {

package/lib/start.mjs

@@ -1,5 +1,6 @@
-// How their app is started, and from which folder, worked out from the repository itself so nobody
-// is asked. A monorepo root has no app of its own: the app is the workspace that serves the AI.
+// How their app most likely starts, and from which folder, read off the repository: printed as the
+// one suggestion when the person gave no start command (local.mjs), never run on its own. A
+// monorepo root has no app of its own: the app is the workspace that serves the AI.
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 
@@ -120,7 +121,16 @@ const BOUND_APP = /^(app|application)\s*=\s*[\w.]+\(/m;
 const IMPORTED_APP = /^from\s+[\w.]+\s+import\s+(?:\(\s*[^)]*?\b(app|application)\b[^)]*\)|[^\n(]*\b(app|application)\b)/m;
 const KNOWN = ["package.json", "pyproject.toml", "requirements.txt", "manage.py", "Pipfile", "uv.lock"];
 // A folder whose app the hooks can load into: Node, Bun or Python. Any other is seen through lib/proxy.mjs.
-export const hookable = (dir) => KNOWN.some((f) => existsSync(join(dir, f)));
+// Whether the hook can ride into the process the command starts: a Node, Bun or Python process takes it
+// from its environment whatever folder it runs in; a container, a Go or Java binary does not, and is
+// watched from outside (lib/proxy.mjs). Judged by the command when there is one, else by the folder.
+const HOOKED = /^(?:python3?(?:\.\d+)?|node|nodemon|tsx|ts-node|bun|bunx|deno|npm|npx|pnpm|yarn|uvicorn|gunicorn|hypercorn|flask|fastapi|poetry|uv|pipenv)$/;
+// The program a command runs, past any PORT=3000 in front of it and the quotes or folder around it.
+const runtimeOf = (cmd) => {
+  const words = cmd.trim().split(/\s+/).filter((w) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(w));
+  return (words[0] ?? "").replace(/^["']|["']$/g, "").split("/").pop() ?? "";
+};
+export const hookable = (dir, cmd = "") => (cmd ? HOOKED.test(runtimeOf(cmd)) : KNOWN.some((f) => existsSync(join(dir, f))));
 
 const startOf = (dir, onPath) => nodeStart(dir, onPath) ?? pythonStart(dir, onPath);
 
@@ -209,37 +219,6 @@ export function startPlan({ root, typed, onPath }) {
   return serving ? { ...at(serving), unsure: true } : { cmd: null, cwd: root, noServer: true };
 }
 
-// What an app says when its dependencies are not installed on this machine, in every runtime we
-// start, and the name of the one it named first.
-const MISSING = /Cannot find module ['"]?([@\w./-]+)|Cannot find package ['"]?([@\w./-]+)|ModuleNotFoundError: No module named ['"]?([\w.]+)|ImportError: No module named ['"]?([\w.]+)|(?:^|[:/ ])([\w.-]+): (?:command )?not found|command not found: ?([\w.-]+)/m;
-export const missingDependency = (said) => MISSING.exec(String(said ?? ""))?.slice(1).find(Boolean) ?? "";
-
-// One install, with the manager the project locked. Never a global one: a Python project without an
-// interpreter of its own gets a virtual environment beside its code, so nothing installed here
-// reaches the rest of the machine.
-export function installPlan(dir, onPath, root = dir) {
-  if (json(join(dir, "package.json"))) {
-    // A workspace member holds no lockfile of its own: the manager, and the install, belong to the
-    // repository that owns it. novel's apps/web installed with npm here, and npm cannot read the
-    // `workspace:^` ranges its own packages are pinned with: "Unsupported URL Type".
-    const at = lockRoot(dir, root);
-    // The manager the repository locked, fetched for the job when this machine has not got it: npm
-    // refuses vercel's ai-chatbot outright over a peer range pnpm resolves without a word.
-    const locked = manager(at);
-    const where = at === dir ? "" : `cd ${JSON.stringify(at)} && `;
-    if (locked !== "npm") return `${where}${onPath(locked) ? `${locked} install` : `npx --yes ${locked} install`}`;
-    return `${where}${existsSync(join(at, "package-lock.json")) ? "npm ci || npm install --legacy-peer-deps" : "npm install || npm install --legacy-peer-deps"}`;
-  }
-  if (existsSync(join(dir, "uv.lock")) && onPath("uv")) return "uv sync";
-  if (existsSync(join(dir, "poetry.lock")) && onPath("poetry")) return "poetry install";
-  const venv = [".venv/bin/python", "venv/bin/python", "env/bin/python"].map((p) => join(dir, p)).find(existsSync);
-  const py = venv ? JSON.stringify(venv) : null;
-  const into = (what) => (py ? `${py} -m pip install ${what}` : `python3 -m venv .venv && .venv/bin/python -m pip install --upgrade pip && .venv/bin/python -m pip install ${what}`);
-  if (existsSync(join(dir, "requirements.txt"))) return into("-r requirements.txt");
-  if (existsSync(join(dir, "pyproject.toml"))) return into("-e .");
-  return null;
-}
-
 // The start command as it leaves this machine: a value typed into it (DATABASE_URL=...) stays here
 // unless it is a plain word, and it is cut to the length the server keeps. A command past that
 // length was refused whole, as "port is required", with a valid port beside it.

package/lib/switches.mjs

@@ -1,83 +1,23 @@
-// Switches an app reads to decide who it lets in, set for the app this command started and for
-// nothing else. The customer's files are never written, and every name is printed before the app
-// starts. A lockout, an attempt counter and a password rule are never touched.
+// Your app's own request limits, raised for the session of the app this command started, and for
+// nothing else: a run asks in twenty minutes what a person asks in a month, and a limiter that fires
+// answers instead of your AI. Only a limit the code reads, by its name; the customer's files are never
+// written, and every name is printed before the app starts. A sign-in switch, a lockout, an attempt
+// counter and a password rule are never touched: who the app lets in is the app's own business.
 import { readFileSync, statSync } from "node:fs";
 
-const GUARDED = /(AUTH|LOGIN|PASSWORD|BREAKER|LOCKOUT|ATTEMPT|FAIL|BAN|BLOCK)/;
 const ENV_READ = /(?:process\.env(?:\.|\[\s*['"])|os\.(?:environ\.get|getenv)\(\s*['"]|os\.environ\[\s*['"]|\benv\(\s*['"]|Deno\.env\.get\(\s*['"])([A-Z][A-Z0-9_]*)/g;
-
-// A switch their own app reads to decide whether a caller has to be signed in at all. morphic's
-// chat answers 401 to everyone until ENABLE_GUEST_CHAT is true; open-webui, librechat and a dozen
-// others carry the same idea under their own name. Set for the app this command started and for
-// nothing else: their files are not touched, and the name is printed before anything starts.
-// A lockout, an attempt counter and a password rule carry the same words and are never touched.
-const OPENS_AUTH = /^(?:ENABLE|REQUIRE)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_(?:ENABLED|REQUIRED)$|^(?:REQUIRE|ENABLE)_(?:LOGIN|SIGN_?IN)$/;
-const CLOSES_AUTH = /^(?:DISABLE|SKIP|NO)_AUTH(?:ENTICATION)?$|^AUTH(?:ENTICATION)?_DISABLED$/;
-const OPENS_GUEST = /^(?:ENABLE|ALLOW)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT|ENABLED|LOGIN)$/;
-const CLOSES_GUEST = /^(?:DISABLE|BLOCK)_(?:GUEST|ANONYMOUS|PUBLIC)(?:_[A-Z0-9_]+)?$|^(?:GUEST|ANONYMOUS|PUBLIC)_(?:MODE|ACCESS|CHAT)_DISABLED$/;
-const BOOLEAN = /^(?:true|false|1|0|yes|no|on|off)$/i;
-export function openSwitches(envFiles, sources = []) {
-  const out = {};
-  const open = (name) => {
-    if (GUARDED.test(name) && !OPENS_AUTH.test(name) && !CLOSES_AUTH.test(name)) return null;
-    if (OPENS_AUTH.test(name) || CLOSES_GUEST.test(name)) return "false";
-    if (CLOSES_AUTH.test(name) || OPENS_GUEST.test(name)) return "true";
-    return null;
-  };
-  for (const file of envFiles) {
-    let text = "";
-    try { text = readFileSync(file, "utf8"); } catch { continue; }
-    for (const line of text.split("\n")) {
-      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-      if (!m) continue;
-      const value = m[2].trim().replace(/^(['"])(.*)\1$/, "$2");
-      const to = open(m[1]);
-      // Only a switch: a name of this shape holding a URL or a key is something else entirely.
-      if (to && (value === "" || BOOLEAN.test(value))) out[m[1]] = to;
-    }
-  }
-  for (const file of sources) {
-    if (!/\.(?:[cm]?[jt]sx?|py|go|rb|php|rs)$/.test(file)) continue;
-    let text = "";
-    try { if (statSync(file).size > 512_000) continue; text = readFileSync(file, "utf8"); } catch { continue; }
-    for (const m of text.matchAll(ENV_READ)) { const to = open(m[1]); if (to && !(m[1] in out)) out[m[1]] = to; }
-  }
-  return out;
-}
-
-// Your app's own request limits, raised for this session only, the way the sandbox raises them:
-// a run asks in twenty minutes what a person asks in a month, and a limiter that fires answers
-// instead of your AI. Numeric values under a limit-shaped name; switches and guards are left alone.
 const THROUGHPUT = /(RATE_?LIMIT|DAILY_LIMIT|HOURLY_LIMIT|MINUTE_LIMIT|REQUESTS_PER|TOKEN_BUDGET|MAX_SSE|MAX_CONCURRENT|THROTTLE|_RPM$|_RPS$|_QPS$)/;
+const GUARDED = /(AUTH|LOGIN|PASSWORD|BREAKER|LOCKOUT|ATTEMPT|FAIL|BAN|BLOCK)/;
 const SWITCH = /_(?:ENABLED|DISABLED|ENABLE|DISABLE)$|^(?:ENABLE|DISABLE)_/;
 const lifted = (name) => (/(TOKEN_BUDGET|TOKENS)/.test(name) ? "1000000000" : "1000000");
 const liftable = (name) => THROUGHPUT.test(name) && !GUARDED.test(name) && !SWITCH.test(name);
-export function liftedLimits(envFiles, sources = []) {
-  // Only a limit the code reads is raised: a line in .env that nothing reads is not a limit, and
-  // naming it as one raised was the tell an engineer caught first.
-  const read = new Set();
+export function liftedLimits(sources = []) {
+  const out = {};
   for (const file of sources) {
     if (!/\.(?:[cm]?[jt]sx?|py|go|rb|php|rs)$/.test(file)) continue;
     let text = "";
     try { if (statSync(file).size > 512_000) continue; text = readFileSync(file, "utf8"); } catch { continue; }
-    for (const m of text.matchAll(ENV_READ)) if (liftable(m[1])) read.add(m[1]);
+    for (const m of text.matchAll(ENV_READ)) if (liftable(m[1])) out[m[1]] = lifted(m[1]);
   }
-  const out = {};
-  for (const file of envFiles) {
-    let text = "";
-    try { text = readFileSync(file, "utf8"); } catch { continue; }
-    for (const line of text.split("\n")) {
-      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-      if (!m) continue;
-      const [, name, raw] = m;
-      const value = raw.trim().replace(/^(['"])(.*)\1$/, "$2");
-      if (liftable(name) && /^\d+$/.test(value) && (!sources.length || read.has(name))) out[name] = lifted(name);
-    }
-  }
-  for (const name of read) if (!(name in out)) out[name] = lifted(name);
   return out;
 }
-
-// What the app is started with beyond its own env: nothing until the person said yes, in this
-// terminal or in the browser (setup.consent.limits). A guard of theirs stays on by default.
-export const sessionLifts = (yes, envFiles, sources = []) => (yes ? { ...liftedLimits(envFiles, sources), ...openSwitches(envFiles, sources) } : {});

package/lib/trace.cjs

@@ -17,7 +17,7 @@ if (FILE) {
     const http = require("node:http");
     const https = require("node:https");
     const als = new AsyncLocalStorage();
-    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
+    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
     const row = (value) => { try { fs.appendFileSync(FILE, JSON.stringify(scrubbed(value)) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ } };
     // What the app writes into its own folder while a run is on: each file copied once before its
     // first write, so the command puts every one back when the run ends (lib/writes.mjs). Trials
@@ -313,13 +313,10 @@ if (FILE) {
       recheck = false;
       setImmediate(() => { try { if (table().routes.length !== routesSaid) sayRoutes(lastPort); } catch { /* as above */ } });
     };
-    // When the run last sent a request: a write made outside every request (a queue's worker, a
-    // timer) is held while a run is live, since it may be carrying out a trial's ask.
-    let lastTurnAt = -Infinity;
     const { tied, requestCtx, note, ended, meter } = makeRecorder({
       row,
       rulesFile: process.env.CORTAD_RULES_FILE,
-      onTurn: () => { heldWarm(); lastTurnAt = Date.now(); },
+      onTurn: () => {},
       onEnded: (ctx, steps) => writtenAt(ctx, steps),
     });
     // Where in the app's own code each part of a reply was written: the app's line on the stack of the
@@ -419,7 +416,6 @@ if (FILE) {
     // context a model call is pinned by: it can only be the step an answer comes on.
     const emit = http.Server.prototype.emit;
     http.Server.prototype.emit = function (type, req, ...rest) {
-      if (this[HELD]) return emit.call(this, type, req, ...rest);
       if (type === "listening") { try { listening(this.address()?.port); } catch { /* not a TCP server */ } }
       if (type === "request") { recheckRoutes(); sweepTools(); }
       if (type !== "request" || !req || !req.method || /^(?:HEAD|OPTIONS)$/.test(req.method)) return emit.call(this, type, req, ...rest);
@@ -735,327 +731,16 @@ if (FILE) {
       return socketConnect.apply(this, args);
     };
 
-    // Outbound writes a trial makes are held in the app, never sent: a trial that books, charges,
-    // emails or deletes would otherwise do it for real. Held: a call made inside a request the run
-    // tagged, with a writing method, to a host that is not a model, a retrieval, this machine, a copy
-    // of ours or a host the person said yes to. A call carrying a provider's test key goes to that
-    // provider's own sandbox as sent. The app is answered with a success shaped like what it sent,
-    // and the run is told by a dep row with `held` and the clipped call.
-    const OUTBOUND = process.env.CORTAD_OUTBOUND_FILE;
-    let passed = [], passedAt = -1;
-    const passNow = () => {
-      try {
-        const at = fs.statSync(OUTBOUND).mtimeMs;
-        if (at !== passedAt) { passedAt = at; const got = JSON.parse(fs.readFileSync(OUTBOUND, "utf8")); passed = Array.isArray(got.pass) ? got.pass.filter((h) => typeof h === "string" && h) : []; }
-      } catch { /* not written yet: nothing passes */ }
-      return passed;
-    };
-    const WRITES = /^(?:POST|PUT|PATCH|DELETE)$/;
-    const THIS_MACHINE = /^(?:localhost|127(?:\.\d+){3}|\[?::1\]?|0\.0\.0\.0)$/i;
-    // A provider's own sandbox, named so in the host: api.sandbox.paypal.com, sandbox-api.polar.sh.
-    const SANDBOX_HOST = /(?:^|[.-])(?:sandbox|sbox)[.-]/i;
-    // ponytail: a sign-in's token refresh is a POST that changes nothing, told apart by its path only.
-    const TOKEN_PATH = /\/(?:oauth2?\/)?token(?:[/?]|$)/i;
-    // An API where every call is a POST names what a call does in its last segment, as
-    // resource.verb_words (customers.get, billing.preview_attach) or as a gRPC or Connect method
-    // (acme.v1.UserService/GetUser). A POST so named that starts with a reading word, and holds no word
-    // that makes the read a write (get_or_create, check_in, GetLease), goes out.
-    // A preview commits nothing whatever it previews; any other reading word reads only while no word
-    // after it writes: credits.check_deduct and usage.count_increment went out as reads.
-    // ponytail: decided on the name alone, so a POST named as a plain read whose body writes goes out.
-    // A rule on the body is the upgrade if one is ever seen.
-    const WRITE_WORD = "create|update|delete|remove|set|add|put|insert|upsert|write|save|store|record|track|log|send|deduct|increment|decrement|consume|use|spend|charge|pay|refund|cancel|reserve|lock|unlock|commit|apply|attach|detach|start|stop|run|trigger|reset|rotate|revoke|grant|issue|mint|transfer|move|merge|sync|import|export|upload|publish|enqueue|push|pop|ack|touch|mark|close|approve|reject|submit|confirm|redeem|claim";
-    const DOT_CALL = /^[A-Za-z][\w-]*\.[a-z][a-z_]*$/, DOT_READ = /^(?:get|list|check|search|query|find|lookup|retrieve|describe|count|preview)$/, DOT_NOT = new RegExp(`^(?:or|and|in|out|next|${WRITE_WORD})$`);
-    const RPC_CALL = /^(?:[A-Z][a-z0-9]*)+$/, RPC_READ = /^(?:Get|List|Search|Query|Find|Lookup|Describe)$/, RPC_NOT = new RegExp(`^(?:or|and|next|lease|${WRITE_WORD})$`, "i");
-    const readWords = (words, read, not) => read.test(words[0]) && (/^preview$/i.test(words[0]) || !words.slice(1).some((w) => not.test(w)));
-    const readsByName = (method, pathname) => {
-      if (method !== "POST") return false;
-      const parts = pathname.split("/").filter(Boolean);
-      const last = parts[parts.length - 1] || "", before = parts[parts.length - 2] || "";
-      if (DOT_CALL.test(last)) return readWords(last.split(".")[1].split("_"), DOT_READ, DOT_NOT);
-      return /\.[A-Z]\w*$/.test(before) && RPC_CALL.test(last) && readWords(last.split(/(?=[A-Z])/), RPC_READ, RPC_NOT);
-    };
-    // A provider's test-mode key says so in the prefix of the key itself, set off by underscores
-    // (Stripe's sk_test_, am_sk_test_, pdl_sdbx_), or it is a value of a setting the app keeps as a
-    // test one. The word elsewhere is not it: a Basic user named test-admin and a live key holding
-    // "-Test-" both went out as test keys.
-    const TEST_KEY = /^(?:[a-z0-9]{2,8}_){0,3}(?:test|sandbox|sbox|sdbx)_[\w-]{4,}$/i;
-    const testKey = (auth) => Boolean(auth) && (auth.split(/[\s:]+/).some((piece) => TEST_KEY.test(piece))
-      || Object.entries(process.env).some(([k, v]) => /(?:^|_)TEST(?:_|$)/i.test(k) && v && v.length >= 8 && auth.includes(v)));
-    const authText = (value) => { const a = String(value || ""); const m = /^Basic\s+(\S+)$/i.exec(a); return m ? Buffer.from(m[1], "base64").toString("utf8") : a; };
-    // The headers a key travels in.
-    const KEY_HEADERS = ["authorization", "x-api-key", "api-key", "apikey", "x-auth-token"];
-    // Neon's HTTP driver sends every query, reads too, to its region's API host and names the
-    // database in a header: the call is decided on that database's host. No header: the API host.
-    const NEON_SQL = /^api(?:auth)?\.[a-z0-9.-]+\.neon\.tech$/;
-    const targetOf = (u, headerOf) => {
-      const host = u.hostname.toLowerCase();
-      if (!NEON_SQL.test(host) || u.pathname !== "/sql") return host;
-      try { return new URL(headerOf("neon-connection-string")).hostname.toLowerCase() || host; } catch { return host; }
-    };
-    // `headerOf(name)`: one of the call's headers, read only for a call that is otherwise held. Once a
-    // tagged write is being decided, a failure to decide holds it.
-    // ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
-    // background writes is the upgrade when that matters.
-    const RUN_LIVE_MS = 10 * 60_000;
-    // The copies this hook makes of Qdrant collections carry this suffix (copyOf below).
-    const OUR_COPY = /_cortad_\d+$/;
-    const heldHere = (u, method, headerOf) => {
-      const ctx = als.getStore();
-      if (!WRITES.test(method) || (ctx ? !ctx.turn : Date.now() - lastTurnAt > RUN_LIVE_MS)) return false;
-      // A read of a Qdrant collection, however its server is named (a bare address holds no word
-      // like qdrant), and any call to a copy this hook made, go out.
-      const q = qdrantCall(u, method);
-      if (q && (!q.write || (q.collection && OUR_COPY.test(q.collection)))) return false;
-      try {
-        const host = targetOf(u, headerOf);
-        if (THIS_MACHINE.test(host) || SANDBOX_HOST.test(host) || isModelCall(u.host, u.pathname) || isRetrieval(u) || TOKEN_PATH.test(u.pathname) || readsByName(method, u.pathname) || KEY_HEADERS.some((name) => testKey(authText(headerOf(name))))) return false;
-        return !passNow().some((p) => host === p || host.endsWith("." + p));
-      } catch { return true; }
-    };
-    // A write to a Qdrant collection made inside a run goes to a copy of that collection on the same
-    // server, made at the first such write: the collection is read page by page and written under
-    // `<name>_cortad_<pid>`, and from then on every call to that collection, reads too, goes to the
-    // copy, so the app finds what it wrote. The original is never written. A copy that cannot be
-    // made (a collection over the size a run copies, a server that refused) leaves the write held
-    // like any other. Each copy is reported as a `copy` row, and the command deletes them when it
-    // ends. A copy of ours is never copied again. ulaim's hosted Qdrant held Run for the person's
-    // yes for seventeen minutes; this is what the yes stood in for.
-    const copies = new Map();
-    // What one process copies at most: collections, and points across them. Past it a write is held
-    // like any other, and the app's output says so once. A run is a few conversations' writes, never
-    // a cluster's.
-    const COPIES_MAX = 8;
-    const POINTS_MAX = 300_000;
-    let copied = 0, pointsCopied = 0;
-    const nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch : null;
-    let qdrantLib = null;
-    const qdrantMod = () => (qdrantLib ??= import(require("node:url").pathToFileURL(require("node:path").join(__dirname, "qdrant.mjs")).href));
-    const inRun = () => { const ctx = als.getStore(); return ctx ? Boolean(ctx.turn) : Date.now() - lastTurnAt <= RUN_LIVE_MS; };
-    // What to do with a call: null to leave it alone; `hold` for a write of the server itself
-    // (/collections/aliases); else the collection's copy when there is one, or none yet for a write
-    // in a run, which makes it.
-    const guarded = (u, method) => {
-      if (!/^https?:$/.test(u.protocol)) return null;
-      const call = qdrantCall(u, method);
-      if (!call) return null;
-      if (!call.collection) return call.write && inRun() ? { hold: true } : null;
-      // The person's own calls, outside a run, go where they were sent: their writes are theirs to keep.
-      if (OUR_COPY.test(call.collection) || !inRun()) return null;
-      const key = `${u.host}|${call.collection}`;
-      const copy = copies.get(key);
-      if (copy) return { key, call, copy };
-      if (!call.write) return null;
-      // A change to the collection's shape, or a write past this process's copy budget, is held.
-      if (call.kind === "schema") return { hold: true };
-      if (copied >= COPIES_MAX || pointsCopied >= POINTS_MAX) { copySay(u.host, call.collection, `this run already copied ${copied} collections, ${pointsCopied} points`); return { hold: true }; }
-      return { key, call, copy: null };
-    };
-    // Said once per collection in the app's own output when no copy could be made and the write was
-    // kept on this machine instead, with the reason the server gave.
-    const copySaid = new Set();
-    const copySay = (host, collection, why) => {
-      if (copySaid.has(`${host}|${collection}`)) return;
-      copySaid.add(`${host}|${collection}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app write into the Qdrant collection ${collection} at ${host}. Cortad could not copy that collection on its server (${why}), so the write was kept on this machine and answered with a stand-in success.\n`); } catch { /* no stderr */ }
-    };
-    const toCopy = (u, clone, call) => { const t = new URL(u.href); t.pathname = `/collections/${encodeURIComponent(clone)}${call.rest}`; return t; };
-    // The copy's name, made now when none exists; null when none could be made. The key the app sent
-    // is the key the copy is made with, and never leaves this process.
-    const copyOf = (u, headerOf, g) => {
-      const have = copies.get(g.key);
-      if (have) return Promise.resolve(have);
-      if (!nativeFetch) return Promise.resolve(null);
-      const clone = `${g.call.collection.slice(0, 40)}_cortad_${process.pid}`;
-      const bearer = /^Bearer\s+(\S+)/i.exec(headerOf("authorization") || "");
-      const conn = { base: `${u.protocol}//${u.host}`, apiKey: headerOf("api-key") || (bearer ? bearer[1] : ""), fetch: nativeFetch };
-      const made = qdrantMod().then(({ cloneQdrant }) => cloneQdrant(conn, g.call.collection, clone)).then((got) => {
-        if (!got || got.why) { copies.delete(g.key); copySay(u.host, g.call.collection, got ? got.why : "nothing"); return null; }
-        copied += 1; pointsCopied += got.points ?? 0;
-        copies.set(g.key, clone);
-        row({ copy: { host: u.hostname, base: conn.base, collection: g.call.collection, clone } });
-        return clone;
-      }, (e) => { copies.delete(g.key); copySay(u.host, g.call.collection, e && e.message ? e.message : "error"); return null; });
-      copies.set(g.key, made);
-      return made;
-    };
-    // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
-    // a SELECT can write through a function) is held.
-    // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
-    // there cannot write: one statement that starts as a read and holds no word that writes, sent to
-    // what its address or its headers show is one of them, goes out. Anything this cannot read as that
-    // stays held. Databuddy's agent had 45 replies come back empty while its own ClickHouse queries
-    // were answered here with a stand-in.
-    const SQL_QUOTED = /'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|\/\*[\s\S]*?\*\//g;
-    // SHOW, DESCRIBE and EXISTS read whatever follows them. A SELECT, a WITH or an EXPLAIN reads
-    // unless it holds a word that writes inside it (a CTE that deletes, SELECT INTO, EXPLAIN ANALYZE
-    // of an insert) or hands its text on to another database to run.
-    const SQL_SHOWS = /^(?:show|describe|desc|exists)\b/i, SQL_SELECTS = /^(?:select|with|explain)\b/i;
-    const SQL_WRITES = /(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])/i;
-    const SQL_HANDS_ON = /\b(?:table|query|jdbc|odbc|executable)\s*\(/i;
-    const statementOf = (sql) => String(sql || "").replace(SQL_QUOTED, (m) => (m[0] === "'" ? "''" : /^["`]/.test(m) ? "x" : " ")).trim().replace(/;\s*$/, "");
-    // A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
-    const whole = (bare) => !/[;'"`]|\/\*|\$\$/.test(bare.replace(/''/g, ""));
-    const selects = (bare) => whole(bare) && (SQL_SHOWS.test(bare) || (SQL_SELECTS.test(bare) && !SQL_WRITES.test(bare) && !SQL_HANDS_ON.test(bare)));
-    const ANALYTICS_NAME = /clickhouse|trino|presto/i;
-    const ANALYTICS_HEADERS = ["x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user"];
-    const analytics = (u, headerOf, port) => /^(?:8123|8443)$/.test(String(port || u.port)) || ANALYTICS_NAME.test(u.hostname) || ANALYTICS_NAME.test(headerOf("user-agent") || "")
-      || ANALYTICS_HEADERS.some((name) => headerOf(name)) || u.pathname === "/v1/statement";
-    const readsOnly = (text, u, headerOf = () => "", port) => {
-      const sent = String(text || "").trim();
-      try { const q = JSON.parse(sent)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { /* not JSON: a statement sent as text */ }
-      if (!u || !analytics(u, headerOf, port)) return false;
-      // ClickHouse joins a `query` in the address to the body: both are read as the one statement.
-      const asked = `${u.searchParams.get("query") || ""} ${sent}`;
-      // ClickHouse reads a backslash before a quote as part of the string and Trino as its end, so
-      // where a string stops is not known here: held.
-      // ponytail: a ClickHouse read with an escaped quote in a string is held too; told apart by which
-      // database answered if that is ever seen.
-      return !/\\['"`]/.test(asked) && selects(statementOf(asked));
-    };
-    // A call passed on from this hook's own server, after its body was read: never held again.
-    const PASSED = Symbol("cortad.passed");
-    const passedOn = (args) => { const o = typeof args[0] === "string" || args[0] instanceof URL ? args[1] : args[0]; return Boolean(o && o[PASSED]); };
-    let heldCount = 0;
-    const fieldsOf = (text, type) => {
-      try { const b = /form/i.test(type || "") ? Object.fromEntries(new URLSearchParams(text)) : JSON.parse(text); return b && typeof b === "object" && !Array.isArray(b) ? b : {}; } catch { return {}; }
-    };
-    const heldReply = (text, type) => JSON.stringify({ ...fieldsOf(text, type), id: `cortad-held-${++heldCount}`, status: "ok" });
-    // Said once per method and host in the app's own output, where the error that follows is read:
-    // a stand-in an SDK cannot parse otherwise reads as a bug in the app. It holds no word that marks
-    // an error, so it is never quoted back as the app's own.
-    const heldSaid = new Set();
-    const heldSay = (method, host) => {
-      if (heldSaid.has(`${method} ${host}`)) return;
-      heldSaid.add(`${method} ${host}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
-    };
-    // Named by method and host only: a webhook's path is its credential.
-    const heldRow = (u, method, text, type, ctx) => { heldSay(method, u.hostname); row({ dep: { at: Date.now(), host: u.hostname, status: 200, held: true, ...(ctx ? { ex: ctx.id, turn: ctx.turn } : {}), called: [{ name: `${method} ${u.hostname}`.slice(0, 80), arguments: argsText(fieldsOf(text, type)) }] } }); };
-    // http.request hands back a request before its body is written, so a held one is sent to a server
-    // of this hook's own on this machine, which answers it. Started at the first tagged request.
-    const HELD = Symbol("cortad.held");
-    const heldWaiting = new Map();
-    let heldPort = null, heldStarted = false, heldSent = 0;
-    function heldWarm() {
-      if (heldStarted) return;
-      heldStarted = true;
-      try {
-        const server = http.createServer((req, res) => {
-          const parts = [];
-          req.on("data", (c) => { if (parts.length < 256) parts.push(c); });
-          req.on("end", () => {
-            const id = String(req.headers["x-cortad-held"] || "");
-            const w = heldWaiting.get(id);
-            heldWaiting.delete(id);
-            const sent = Buffer.concat(parts);
-            const text = sent.toString("utf8").slice(0, MAX);
-            const headerOf = (name) => String(req.headers[name] || "");
-            // The call goes on to where it was sent, as it was sent, or to `to` instead, and its
-            // answer comes back through this server.
-            const forward = (to) => {
-              const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
-              const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
-              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true, ...(to && !given ? { path: to.pathname + to.search } : {}) };
-              // Sent inside the request that asked, so the call is recorded behind that reply.
-              const send = () => (w.secure ? https : http).request(...(given ? [to ? to.href : w.args[0], options] : [options]));
-              const up = w.ctx ? als.run(w.ctx, send) : send();
-              up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
-              up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
-              res.on("close", () => up.destroy());
-              return up.end(sent);
-            };
-            const answer = () => {
-              if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
-              res.writeHead(200, { "content-type": "application/json" });
-              res.end(heldReply(text, req.headers["content-type"]));
-            };
-            // A body that only reads, known now that it is here, goes on as it was sent.
-            if (w && parts.length < 256 && readsOnly(text, w.u, headerOf, w.port)) return forward(null);
-            // A call to a Qdrant collection goes to the run's copy of it, made now when this is its first write.
-            if (w && w.copy) return copyOf(w.u, headerOf, w.copy).then((clone) => (clone ? forward(toCopy(w.u, clone, w.copy.call)) : answer()), answer);
-            answer();
-          });
-        });
-        server[HELD] = true;
-        server.listen(0, "127.0.0.1", () => { heldPort = server.address().port; });
-        server.unref();
-      } catch { /* no server: a held write fails to connect instead of leaving */ }
-    }
-    const headerIn = (headers, name) => {
-      if (!headers || typeof headers !== "object" || Array.isArray(headers)) return "";
-      const k = Object.keys(headers).find((n) => n.toLowerCase() === name);
-      return k ? String(headers[k]) : "";
-    };
-    // The call http.request was asked for, when it is one to hold.
-    const heldCall = (args, secure) => {
-      const first = args[0];
-      const given = typeof first === "string" || first instanceof URL ? new URL(String(first)) : null;
-      const o = (given ? (args[1] && typeof args[1] === "object" ? args[1] : {}) : first) || {};
-      const host = String(o.hostname || (o.host && String(o.host).replace(/:\d+$/, "")) || (given && given.hostname) || "localhost");
-      const path = String(o.path || (given ? given.pathname + given.search : "/"));
-      const method = String(o.method || "GET").toUpperCase();
-      const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
-      const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      const port = o.port || (given && given.port) || "";
-      // The server's address whole, port included, names a collection's copy; the hold is decided on
-      // the host alone, as before.
-      const at = new URL(u.href);
-      if (port) at.port = String(port);
-      const g = guarded(at, method);
-      if (!g && !heldHere(u, method, headerOf)) return null;
-      return { u: at, method, o, args: args.filter((a) => typeof a !== "function"), port, cb: args.find((a) => typeof a === "function"), ...(g && !g.hold ? { copy: g } : {}) };
-    };
-    const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb, args, port, copy }, secure) => {
-      const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure, copy });
-      const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
-      // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
-      const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
-      // A TLS client waits for the handshake before it writes (Stripe's does).
-      if (secure) req.once("socket", (socket) => socket.once("connect", () => socket.emit("secureConnect")));
-      return req;
-    };
-    const heldFetch = async (realFetch, input, init) => {
-      const req = new Request(input, init);
-      const text = await req.clone().text().catch(() => "");
-      if (readsOnly(text, new URL(req.url), (name) => req.headers.get(name) || "")) return realFetch(req);
-      const u = new URL(req.url);
-      heldRow(u, req.method, text, req.headers.get("content-type"), als.getStore());
-      return new Response(heldReply(text, req.headers.get("content-type")), { status: 200, headers: { "content-type": "application/json" } });
-    };
-
     // Outbound: the model call your app makes while it handles that request.
     const bodyText = (body) => (typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : "");
     if (typeof globalThis.fetch === "function") {
       const realFetch = globalThis.fetch;
-      // A call to a Qdrant collection, sent again through this same wrapper at the copy's address, so
-      // it is recorded like any retrieval; held when no copy could be made.
-      const guardedFetch = async (self, wrapped, input, init, u, method, g) => {
-        if (g.hold) return heldFetch(realFetch, input, init);
-        const req = new Request(input, init);
-        const clone = await (typeof g.copy === "string" ? g.copy : copyOf(u, (name) => req.headers.get(name) || "", g));
-        if (!clone) return heldFetch(realFetch, input, init);
-        const body = method === "GET" || method === "HEAD" ? undefined : await req.arrayBuffer();
-        return wrapped.call(self, toCopy(u, clone, g.call).href, { method, headers: req.headers, body, signal: req.signal });
-      };
       globalThis.fetch = function (input, init) {
         let url = null;
-        let hold = false;
-        let guard = null;
-        let at = null;
-        let method = "GET";
         try {
           const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input));
-          at = u;
           if (isModelCall(u.host, u.pathname)) url = u;
-          method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
-          guard = !url ? guarded(u, method) : null;
-          hold = !url && !guard && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
         } catch { /* not a URL we can read */ }
-        if (guard) return guardedFetch(this, globalThis.fetch, input, init, at, method, guard);
-        if (hold) return heldFetch(realFetch, input, init);
         if (!url) {
           // Every outbound host, named by the setting that points at it when one does, and by the
           // host alone otherwise: the search provider behind TAVILY_API_KEY has no URL setting.
@@ -1097,9 +782,6 @@ if (FILE) {
     for (const mod of [http, https]) {
       const request = mod.request;
       mod.request = function (...args) {
-        let held = null;
-        try { held = passedOn(args) ? null : heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
-        if (held) return sendHeld(held, mod === https);
         const req = request.apply(this, args);
         try {
           const o = typeof args[0] === "string" || args[0] instanceof URL ? new URL(String(args[0])) : args[0] || {};