cortad 0.3.3 → 0.3.5

package/lib/identities.mjs

@@ -34,6 +34,10 @@ const STATUSES = new Set(["minted", "sealed", "absent", "refused", "unreachable"
 // so USER_USERNAME pairs with USER_PASSWORD and TUDUDI_USER_EMAIL with TUDUDI_USER_PASSWORD.
 const USER_TOKEN = /_(?:USERNAME|USER|EMAIL|LOGIN)$/;
 const SECRET_TOKEN = /_(?:PASSWORD|PASS|SECRET)$/;
+// A pair that opens a store or a mail server is never the app's own account: PG_DB_USER with
+// PG_DB_PASSWORD signs in to Postgres, and offered to a sign-in form it sent a database password
+// to the app's login route.
+const SERVICE_PREFIX = /(?:^|_)(?:DB|DATABASE|SQL|PG|PSQL|POSTGRES(?:QL)?|MYSQL|MARIADB|MSSQL|MONGO(?:DB)?|REDIS|VALKEY|ELASTIC(?:SEARCH)?|OPENSEARCH|ES|QDRANT|NEO4J|CLICKHOUSE|RABBIT(?:MQ)?|AMQP|KAFKA|SMTP|MAIL|EMAIL|S3|MINIO|FTP|SFTP|LDAP|PROXY)(?:_|$)/;
 const CRED_USER_FIELD = /^(?:e-?mail|user(?:_?name)?|login|account|identifier)$/i;
 const CRED_PASS_FIELD = /^(?:password|passcode|pass|pwd)$/i;
 const SIGN_IN_ROUTE = /(?:^|\/)(?:login|signin|sign-in|sign_in|session|token|authenticate)(?:\/|$)/i;
@@ -586,7 +590,7 @@ export function credentialPairs(names) {
   const seen = new Set();
   for (const u of users) {
     const s = secrets.find((x) => x.prefix === u.prefix);
-    if (s && !seen.has(u.prefix)) { seen.add(u.prefix); pairs.push({ user: u.name, secret: s.name, prefix: u.prefix }); }
+    if (s && !seen.has(u.prefix) && !SERVICE_PREFIX.test(u.prefix)) { seen.add(u.prefix); pairs.push({ user: u.name, secret: s.name, prefix: u.prefix }); }
   }
   return pairs;
 }

package/lib/keeping.mjs

@@ -5,7 +5,7 @@
 import { createHash } from "node:crypto";
 import { localAddresses, makeBacking, tcpOpen } from "./backing.mjs";
 import { keepData } from "./data.mjs";
-import { bypassedOf, isStorePort, onThisMachine, storeId, storeKeeper, storesOf, unnamedLines } from "./stores.mjs";
+import { bypassedOf, isStorePort, onThisMachine, storeId, storeKeeper, storesOf, unnamedHeld } from "./stores.mjs";
 
 // A line that opens with a setting's name keeps its case: "nEXT_PUBLIC_SUPABASE_URL" was printed.
 const lower = (line) => (/^[A-Z][A-Z0-9_]/.test(line) ? line : line.charAt(0).toLowerCase() + line.slice(1));
@@ -34,17 +34,26 @@ function blockedRows(blocked) {
 // folder and its source files. launch(plan): a service of the repository started the way the app
 // is. connections(): what the hook saw the app reach. hold(): the run's requests wait from here until
 // the caller has the app on the copies made, since until then it still writes into the originals.
-export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, hold = () => {} }) {
+// `typed`: the person gave the start command. It is run as it is, with the settings and the stores
+// that command gives the app: a legal research API typed ENV=staging and was started on copies of
+// the test databases its default settings file names, where its library is empty.
+const AS_TYPED = "Your app is started with your own command as it is, on the databases that command gives it. Nothing is copied: a run writes into them once you say yes to each on the card.";
+export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, hold = () => {}, typed = false }) {
   let pending = null;
   let now = null;
   let backing = null;
   let backedUp = false;
   let seen = 0;
-  const told = new Set();
   const tell = (lines) => { for (const line of lines) say(lower(line)); };
   const held = (blocked) => tell(blocked.map((b) => `Run waits for your yes on the card in the browser: ${lower(b.why)}`));
 
   async function keepAll(started) {
+    if (typed) {
+      const none = async () => ({ env: {}, risks: [], copies: [], blocked: [], pass: [] });
+      now = { env: {}, risks: [], notes: [AS_TYPED], blocked: [], pass: [], stores: [], keeper: { keep: none, drop: async () => {} }, values: {}, started };
+      tell(now.notes);
+      return now;
+    }
     const { values, from, appDir, sources } = settings();
     const disk = keepData({ values, from, appDir, root, work, sources, started });
     const stores = storesOf(disk.values);
@@ -61,6 +70,7 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
 
   // Brings up what is wanted, copies each store that now answers, and says both.
   async function bringUp(wants) {
+    if (typed) return { changed: false, came: false, copied: false };
     const k = await once(true);
     hold();
     const up = await backing.up(wants);
@@ -136,14 +146,11 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
       const k = await pending;
       const live = [];
       for (const c of conns) if (!onThisMachine(c.host) || (await tcpOpen(c.host, c.port))) live.push(c);
-      const fresh = unnamedLines(live, k.stores, told);
-      k.risks.push(...fresh);
-      tell(fresh);
-      const bypassed = bypassedOf(live, k.stores, k.blocked);
+      const bypassed = [...bypassedOf(live, k.stores, k.blocked), ...unnamedHeld(live, k.stores, k.blocked)];
       k.blocked.push(...bypassed);
       held(bypassed);
-      const got = await bringUp(reached(appPort));
-      return { changed: fresh.length > 0 || bypassed.length > 0 || got.changed, copied: got.copied };
+      const got = typed ? { changed: false, copied: false } : await bringUp(reached(appPort));
+      return { changed: bypassed.length > 0 || got.changed, copied: got.copied };
     },
     // An app attached to instead of started keeps its own connections: its copies are of no use.
     async forget() {

package/lib/proof.mjs

@@ -440,10 +440,17 @@ function carriedFrom(later, earlier, ask) {
 
 const cookiesIn = (ex) => Object.fromEntries(str(headerOf(ex.headers, "cookie")).split(";").map((c) => c.trim().split("=")).filter(([k, v]) => k && v !== undefined).map(([k, ...v]) => [k, v.join("=")]));
 
+// A sign-in is never the conversation. A cookie or a header a trial is sent without is one that only
+// names the conversation: Databuddy's sign-in cookie, refreshed on every reply, was taken for one, and
+// each trial sent without it was refused; an Authorization header that stayed the same would be too.
+const READS_AS_CREDENTIAL = /auth|token|jwt|csrf|xsrf|secret|key|sid$|sessionid|connect\.sid|phpsessid|jsessionid|__session|__host-|__secure-|^sb-|clerk|supabase|laravel_session/i;
+const READS_AS_CONVERSATION = /conv|thread|chat|dialog|session[-_]?id/i;
+const namesConversation = (name) => READS_AS_CONVERSATION.test(name) && !READS_AS_CREDENTIAL.test(name);
+
 // What stayed the same from the earlier exchange to the later one and is not the ask: a field the app
 // handed back, a path segment, a field that reads as an id, a cookie the app set, a header, another
 // cookie. The first found carries the session.
-function carrierOf(earlier, later, ask, door) {
+export function carrierOf(earlier, later, ask, door) {
   const same = (a, b) => a !== undefined && a !== "" && a === b;
   const before = new Map(leaves(bodyOf(earlier) ?? {}).map((l) => [l.at.join("."), l.value]));
   const own = leaves(bodyOf(later) ?? {}).filter((l) => !inList(l.at) && fieldOf(l.at) !== ask?.field);
@@ -466,13 +473,15 @@ function carrierOf(earlier, later, ask, door) {
   if (idField) return { carrier: "body", key: idField.at.join("."), minted: "client" };
   const jar = cookiesIn(later);
   const jarBefore = cookiesIn(earlier);
-  // A cookie the app set on the earlier reply, sent back: the earlier request could not carry it.
-  const set = Object.keys(jar).find((k) => earlier.cookies.includes(k));
+  // A cookie the app set on the earlier reply, sent back, which the earlier request could not carry.
+  // One that request already carried was only refreshed: a session the person signed in with, unless
+  // its name says it is the conversation.
+  const set = Object.keys(jar).find((k) => earlier.cookies.includes(k) && (jarBefore[k] === undefined || namesConversation(k)));
   if (set) return { carrier: "cookie", key: set, minted: "app" };
-  const cookies = Object.keys(jar).filter((k) => same(jar[k], jarBefore[k]));
-  const header = Object.keys(later.headers).find((k) => !HOP.test(k) && !PLAIN_HEADER.test(k) && same(later.headers[k], headerOf(earlier.headers, k.toLowerCase())));
+  const header = Object.keys(later.headers).find((k) => !HOP.test(k) && !PLAIN_HEADER.test(k) && namesConversation(k) && same(later.headers[k], headerOf(earlier.headers, k.toLowerCase())));
   if (header) return { carrier: "header", key: header.toLowerCase(), minted: "client" };
-  if (cookies.length) return { carrier: "cookie", key: cookies[0], minted: "client" };
+  const cookie = Object.keys(jar).find((k) => namesConversation(k) && same(jar[k], jarBefore[k]));
+  if (cookie) return { carrier: "cookie", key: cookie, minted: "client" };
   return { carrier: "none", key: null };
 }
 

package/lib/pyhook/cortad_tied.py

@@ -26,6 +26,23 @@ RECENT_KEPT, RECENT_MS = 32, 300000
 # turn (a chat UI shows the message with one event, then answers it with the next).
 BEFORE_MS = 60000
 PROMPTS_KEPT, PROMPT_HEAD = 64, 500
+# How much of a sentence the model wrote a fetched reply has to carry to be the answer.
+CARRY = 60
+# tied.cjs UNDER_WAY: a job's own word for work still going on.
+UNDER_WAY = re.compile(r"^(?:queued|pending|waiting|scheduled|submitted|accepted|created|starting|started|running|processing|generating|working|thinking|searching|retrieving|streaming|in[_ -]?progress|not[_ -]?(?:started|ready))$", re.I)
+
+
+def _under_way(v, depth=0):
+    if depth > 4:
+        return False
+    if isinstance(v, list):
+        return bool(v) and _under_way(v[-1], depth + 1)
+    if not isinstance(v, dict):
+        return False
+    state = v.get("status", v.get("state"))
+    if isinstance(state, str) and UNDER_WAY.match(state):
+        return True
+    return any(isinstance(x, (list, dict)) and _under_way(x, depth + 1) for x in v.values())
 # The ask the last call pinned in this handler's context was made for. A queue runs each handler in a
 # context of its own, so its later calls, which carry none of the person's words, are told apart by
 # it when several asks are open at once. Only a tiebreak: it never outranks what the rules decide.
@@ -68,10 +85,23 @@ def _address_ids(req):
     return {v for v in path.split("/") + [v for _, v in parse_qsl(query)] if ID.match(v)}
 
 
+# tied.cjs saidSentences: a JSON answer the clip cut short is read by its strings.
+def _said_sentences(text):
+    text = text.decode("utf-8", "replace") if isinstance(text, (bytes, bytearray)) else str(text or "")
+    v = _json(text)
+    whole = [s for s in (_scalars(v, []) if v is not None else [text]) if _sentence(s)]
+    if len(whole) != 1 or not re.match(r"\s*[\[{]", whole[0]):
+        return whole
+    return [m for m in re.findall(r'"((?:[^"\\]|\\.){8,})"', whole[0]) if _sentence(m)]
+
+
 class Tied:
     # `body_of(req)` and `reply_of(req)` read what a request carried and what the app answered.
-    def __init__(self, norm, body_of, reply_of):
+    # `said_of(req)`: what the model calls made for an ask answered later have written, one entry a
+    # call and none before one has, None where the hook hears none (tied.cjs saidOf).
+    def __init__(self, norm, body_of, reply_of, said_of=None):
         self.norm, self.body_of, self.reply_of = norm, body_of, reply_of
+        self.said_of = said_of or (lambda req: None)
         self.open = {}
         self.recent = collections.deque(maxlen=RECENT_KEPT)
         # The heads of the prompts this process sent: one arriving at a server in the same process (an
@@ -127,7 +157,7 @@ class Tied:
         now = int(time.time() * 1000)
         for t in reversed(list(self.recent)) if mine else []:
             # A request answered later is fetched afterwards only by a read of it, never by a new message.
-            if t["at"] <= req["at"] and now - t["at"] <= RECENT_MS and (t.get("pinned") or not pinned_only) and (not t.get("settled") or req["method"] == "GET"):
+            if t["at"] <= req["at"] and now - t.get("call_at", t["at"]) <= RECENT_MS and (t.get("pinned") or not pinned_only) and (not t.get("settled") or req["method"] == "GET"):
                 shared = mine & self._ids(t)
                 if shared:
                     return t, shared
@@ -146,7 +176,7 @@ class Tied:
     def closed(self, req):
         self.open.pop(req["id"], None)
         asker = req.get("asker")
-        if asker and not asker.get("written") and not asker.get("calls_open"):
+        if asker and not asker.get("written") and not asker.get("calls_open") and self._carries(req, asker):
             since = max([self.answered[i] for i in req["tie"] if self.answered.get(i, asker["at"]) < asker["at"]], default=0)
             before = [p for p in list(self.recent) if p is not asker and not p.get("settled") and since < p["at"] < asker["at"] and asker["at"] - p["at"] <= BEFORE_MS and self._ids(p) & req["tie"]]
             for s in before + [asker]:
@@ -161,6 +191,18 @@ class Tied:
             self.recent.append(req)
         return None
 
+    # tied.cjs carries: a page polling for an answer several calls build comes back many times
+    # between two of them, on a document with no answer in it yet.
+    def _carries(self, fetch, asker):
+        said = self.said_of(asker)
+        if said is None:
+            return True
+        raw = self.reply_of(fetch)
+        if _under_way(_json(raw)):
+            return False
+        reply = self.norm(raw)
+        return any(self.norm(w)[:CARRY] in reply for one in (said if isinstance(said, (list, tuple)) else [said]) for w in _said_sentences(one))
+
     def _answered(self, tie, at):
         for i in tie:
             self.answered.pop(i, None)
@@ -230,6 +272,7 @@ class Tied:
             asker["late"] = True
         asker["pinned"] = True
         asker["calls_open"] = asker.get("calls_open", 0) + 1
+        asker["call_at"] = int(time.time() * 1000)
         _HELD.set(asker)
         return asker
 
@@ -260,6 +303,7 @@ class Tied:
         if req.get("late"):
             req["pinned"] = True
             req["calls_open"] = req.get("calls_open", 0) + 1
+            req["call_at"] = int(time.time() * 1000)
         else:
             req["waiting"] = req.get("waiting", 0) + 1
         return req
@@ -285,7 +329,7 @@ class Tied:
     # request tied to it came to fetch the answer. It stays where a fetch that comes later can still
     # find it and complete the exchange on a second request, but no call is pinned to it by its words.
     def settled(self, req):
-        if not req or not req.get("late") or not req.get("ended") or req.get("calls_open") or req.get("waiting") or req.get("written") or req.get("settled") or req.get("fetched"):
+        if not req or not req.get("late") or not req.get("ended") or req.get("calls_open") or req.get("waiting") or req.get("written") or req.get("settled") or (req.get("fetched") and self.said_of(req) is None):
             return False
         req["settled"] = req["answered"] = True
         return True

package/lib/pyhook/sitecustomize.py

@@ -1353,11 +1353,55 @@ def _install():
         except Exception:
             return True
 
-    # A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (SQL over HTTP) is held.
-    def reads_only(raw):
-        b = parsed(raw) if raw else None
-        q = b.get("query") if isinstance(b, dict) else None
-        return isinstance(q, str) and bool(re.match(r"^\s*(?:\{|query\b|fragment\b)", q)) and not re.search(r"\bmutation\b", q)
+    # A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (SQL over HTTP,
+    # where a SELECT can write through a function) is held.
+    # ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
+    # there cannot write: one statement that starts as a read and holds no word that writes, sent to
+    # what its address or its headers show is one of them, goes out (lib/trace.cjs does the same).
+    sql_quoted = re.compile(r"""'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|/\*[\s\S]*?\*/""")
+    sql_shows = re.compile(r"^(?:show|describe|desc|exists)\b", re.I | re.A)
+    sql_selects = re.compile(r"^(?:select|with|explain)\b", re.I | re.A)
+    sql_writes = re.compile(r"(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])", re.I | re.A)
+    sql_hands_on = re.compile(r"\b(?:table|query|jdbc|odbc|executable)\s*\(", re.I | re.A)
+    sql_open = re.compile(r"""[;'"`]|/\*|\$\$""")
+    analytics_name = re.compile(r"clickhouse|trino|presto", re.I)
+    analytics_headers = ("x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user")
+
+    def statement_of(sql):
+        bare = sql_quoted.sub(lambda m: "''" if m.group(0)[0] == "'" else "x" if m.group(0)[0] in '"`' else " ", str(sql or "")).strip()
+        return re.sub(r";\s*$", "", bare)
+
+    # A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
+    def selects(bare):
+        if sql_open.search(bare.replace("''", "")):
+            return False
+        return bool(sql_shows.match(bare)) or bool(sql_selects.match(bare) and not sql_writes.search(bare) and not sql_hands_on.search(bare))
+
+    def analytics(parts, header_of):
+        try:
+            port = parts.port
+        except ValueError:
+            port = None
+        return port in (8123, 8443) or bool(analytics_name.search(parts.hostname or "")) or bool(analytics_name.search(str(header_of("user-agent") or ""))) \
+            or any(header_of(name) for name in analytics_headers) or parts.path == "/v1/statement"
+
+    def reads_only(raw, url=None, header_of=None):
+        sent = str(raw or "").strip()
+        b = parsed(sent) if sent else None
+        if b is not None:
+            q = b.get("query") if isinstance(b, dict) else None
+            return isinstance(q, str) and bool(re.match(r"^\s*(?:\{|query\b|fragment\b)", q)) and not re.search(r"\bmutation\b", q)
+        try:
+            parts = urlsplit(str(url)) if url else None
+            if parts is None or not analytics(parts, header_of or (lambda name: None)):
+                return False
+            # ClickHouse joins a `query` in the address to the body: both are read as the one statement.
+            asked = "%s %s" % (dict(parse_qsl(parts.query)).get("query", ""), sent)
+            # ClickHouse reads a backslash before a quote as part of the string and Trino as its end,
+            # so where a string stops is not known here: held.
+            return not re.search(r"""\\['"`]""", asked) and selects(statement_of(asked))
+        except Exception:
+            return False
 
     held_count = itertools.count(1)
 
@@ -1381,7 +1425,7 @@ def _install():
             return
         held_said.add((method, host))
         try:
-            sys.stderr.write("cortad: a request Cortad sent made this app send %s to %s. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n" % (method, host))
+            sys.stderr.write("cortad: a request Cortad sent made this app send %s to %s. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n" % (method, host))
         except Exception:
             pass
 
@@ -1548,7 +1592,7 @@ def _install():
 
     try:
         from cortad_tied import Tied
-        tied = Tied(norm, body_of, reply_of)
+        tied = Tied(norm, body_of, reply_of, lambda req: req.get("said_all", []) if req.get("late") else None)
     except Exception:
         tied = None
 
@@ -1749,6 +1793,7 @@ def _install():
                 if req and req.get("late"):
                     if not row.get("embedding"):
                         req["said"] = (row["status"], reply_text(events)[:model_words], now)
+                        req["said_all"] = (req.get("said_all", []) + [req["said"][1]])[-12:]
                     settle(req)
             row.update(inside_of(req))
             if req and (req.get("kept") or req.get("turn")):
@@ -2425,7 +2470,7 @@ def _install():
 
         # A held call that cannot be answered fails in the app; it is never sent instead.
         def held_httpx(request, sent):
-            if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent):
+            if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent, request.url, request.headers.get):
                 return None
             kind = request.headers.get("content-type", "")
             held_row(request.url, request.method, sent, kind, ctx.get())
@@ -2488,7 +2533,7 @@ def _install():
             if not held_here(request.url, request.method, lambda: keys_in(request.headers)):
                 return None
             raw = text(request.body, reply_max)
-            if reads_only(raw):
+            if reads_only(raw, request.url, request.headers.get):
                 return None
             import datetime
             models, structures = sys.modules["requests.models"], sys.modules["requests.structures"]
@@ -2539,6 +2584,13 @@ def _install():
             basic = k.get("auth") or getattr(self, "_default_auth", None)
             return [given.get(n) or defaults.get(n) for n in key_headers] + [basic.encode() if basic else None]
 
+        def header_of(self, k, name):
+            for headers in (k.get("headers"), getattr(self, "_default_headers", None)):
+                for n, v in dict(headers or {}).items():
+                    if str(n).lower() == name:
+                        return v
+            return None
+
         # A path relative to the session's base address is decided on the whole address.
         def whole(self, str_or_url):
             try:
@@ -2549,7 +2601,7 @@ def _install():
         async def requested(self, method, str_or_url, *a, **k):
             body = k.get("json") if k.get("json") is not None else k.get("data")
             url = whole(self, str_or_url)
-            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max)):
+            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max), url, lambda name: header_of(self, k, name)):
                 port = held_port()
                 if port is None:
                     raise module.ClientConnectionError("this write was kept from leaving and could not be answered")

package/lib/replay.mjs

@@ -2,7 +2,7 @@
 // reads what the hook wrote, keeps the sign-in each request carried on this machine, and tells the
 // cloud what each door is proven to do (lib/proof.mjs): the route, the method, the body, the header
 // names and what the requests did inside the app. Header values never leave.
-import { copyFileSync, existsSync, mkdtempSync, readFileSync, statSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { SourceMap } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative } from "node:path";
@@ -15,15 +15,17 @@ const HOOK = join(HERE, "trace.cjs");
 const PYHOOK = join(HERE, "pyhook");
 export const CAPTURED = "captured";
 // Never replayed: they describe one connection, not the caller.
+const SECRET_HEADER = /authorization|cookie|token|secret|session|csrf|api-?key/i;
 const HOP = /^(?:host|content-length|connection|keep-alive|transfer-encoding|upgrade|expect|te|trailer|accept-encoding|x-cortad-as|x-cortad-turn)$/i;
 
 // `files` lists the repository's source, relative to `root`, for placing a problem at its line;
 // `appFolder` is the folder the app runs in, relative to `root`. `onProof` gets one payload per door,
 // again whenever what it proves changes. `printed(from, to)` is what the app printed between two times.
-export function makeCapture({ work, keepSecret, onProof = () => {}, writes = null, root = null, files = () => [], appFolder = () => "", printed = () => "" }) {
+export function makeCapture({ work, keepSecret, onProof = () => {}, writes = null, root = null, files = () => [], appFolder = () => "", printed = () => "", signIns = null }) {
   const file = join(work, "trace.jsonl");
   let read = 0;
-  const accounts = makeAccounts();
+  const accounts = makeAccounts(signIns);
+  for (const headers of accounts.kept()) for (const [k, v] of Object.entries(headers)) if (SECRET_HEADER.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
   let alive = false;
   // The ports a hooked process listens on. Loading is not listening: turbo's own Node launcher loads
   // the hook, and one app was told we would see its messages while its API on Bun carried none.
@@ -118,7 +120,7 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
       if (typeof row.ex !== "string" || typeof row.method !== "string" || typeof row.path !== "string" || !row.path.startsWith("/")) continue;
       for (const [door, r] of taken) if (r.ex === row.ex) taken.delete(door);
       const headers = Object.fromEntries(Object.entries(row.headers ?? {}).filter(([k, v]) => !HOP.test(k) && typeof v === "string"));
-      for (const [k, v] of Object.entries(headers)) if (/authorization|cookie|token|secret|session|csrf|api-?key/i.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
+      for (const [k, v] of Object.entries(headers)) if (SECRET_HEADER.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
       // Speaking as the person means their own client's headers, never a trial's. Cortad's own test
       // request (reach:*) carries the page and sign-in this machine found for the app, so a run speaks
       // with them where no request of the person's came: without it every run request lost the Origin
@@ -451,9 +453,29 @@ function leavesOf(body) {
   try { walk(typeof body === "string" ? JSON.parse(body) : body, "", 0); } catch { /* not JSON: nothing of theirs to read */ }
   return out;
 }
-export function makeAccounts() {
+// `file`: where the accounts are kept between connects, on this machine and readable by this user
+// alone. Databuddy's agent signed in once per connect, and every reconnect asked for it again.
+// A sign-in that has ended is not read back.
+export function makeAccounts(file = null) {
   const kept = [];
   let bare = null;
+  if (file) {
+    try {
+      for (const a of JSON.parse(readFileSync(file, "utf8"))) {
+        if (kept.length >= ACCOUNTS_MAX || typeof a?.key !== "string" || !a.headers || typeof a.headers !== "object") continue;
+        const headers = Object.fromEntries(Object.entries(a.headers).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
+        if (signInKey(headers) !== a.key || (identityOf(headers).expiresInS ?? 1) <= 0) continue;
+        kept.push({ key: a.key, headers, bodies: new Map(Object.entries(a.bodies ?? {}).map(([door, leaves]) => [door, new Map(Object.entries(leaves ?? {}))])) });
+      }
+    } catch { /* none kept, or not ours to read: the next signed-in request is taken */ }
+  }
+  const save = () => {
+    if (!file) return;
+    try {
+      mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+      writeFileSync(file, JSON.stringify(kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) }))), { mode: 0o600 });
+    } catch { /* kept for this connect only */ }
+  };
   const at = (role) => { const m = ACCOUNT_ROLE.exec(role); return m ? kept[Number(m[1] ?? 1) - 1] ?? kept[0] ?? null : null; };
   return {
     // `door` and `body`: the request as that customer sent it, for the values in it that are theirs.
@@ -470,6 +492,7 @@ export function makeAccounts() {
         else return;
       }
       if (door) account.bodies.set(door, leavesOf(body));
+      save();
     },
     kept: () => kept.map((a) => a.headers),
     speak(role) {

package/lib/start.mjs

@@ -239,3 +239,11 @@ export function installPlan(dir, onPath, root = dir) {
   if (existsSync(join(dir, "pyproject.toml"))) return into("-e .");
   return null;
 }
+
+// The start command as it leaves this machine: a value typed into it (DATABASE_URL=...) stays here
+// unless it is a plain word, and it is cut to the length the server keeps. A command past that
+// length was refused whole, as "port is required", with a valid port beside it.
+export const SHOWN_COMMAND = 200;
+export const shownCommand = (cmd, mask = (text) => text) => (cmd == null ? cmd
+  : mask(String(cmd)).replace(/\b([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S+)/g, (whole, name, value) => (/^[\w.-]{1,24}$/.test(value) ? whole : `${name}=***`)).slice(0, SHOWN_COMMAND));
+

package/lib/stores.mjs

@@ -21,7 +21,7 @@ export const PORT_OF = { postgres: 5432, mysql: 3306, mongo: 27017, redis: 6379,
 const ENGINE_AT = { ...Object.fromEntries(Object.entries(PORT_OF).filter(([e]) => e !== "chroma" && e !== "weaviate").map(([e, p]) => [p, e])), 6334: "qdrant" };
 export const isStorePort = (port) => Boolean(ENGINE_AT[port]);
 // Stores reached through their maker's SDK, which a setting rarely names: the hook sees the host.
-const HOSTED = [["supabase", /\.supabase\.(?:co|in|com)$/], ["mongo", /\.mongodb\.net$/], ["redis", /\.upstash\.io$|\.redis-cloud\.com$|\.redislabs\.com$/], ["postgres", /\.neon\.tech$/], ["pinecone", /\.pinecone\.io$/], ["qdrant", /\.qdrant\.io$/], ["firestore", /^firestore\.googleapis\.com$/]];
+const HOSTED = [["supabase", /\.supabase\.(?:co|in|com)$/], ["mongo", /\.mongodb\.net$/], ["elasticsearch", /\.elastic-cloud\.com$|\.found\.io$|\.es\.amazonaws\.com$/], ["redis", /\.upstash\.io$|\.redis-cloud\.com$|\.redislabs\.com$/], ["postgres", /\.neon\.tech$/], ["pinecone", /\.pinecone\.io$/], ["qdrant", /\.qdrant\.io$/], ["firestore", /^firestore\.googleapis\.com$/]];
 // How each store we copy is copied and dropped: on its own server, under the name given.
 const COPY = {
   postgres: { copy: (s, clone) => clonePg(s.conn, s.db, clone), drop: (s, clone) => dropPg(s.conn, clone) },
@@ -39,6 +39,10 @@ const WORD_ENGINE = [["postgres", /^(?:PG|POSTGRES|PSQL)|POSTGRES/], ["mysql", /
 const SECRETISH = /(?:^|_)(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD)$/;
 // Every engine's word in a setting's name, so a setting that carries one is that engine's own.
 const ENGINE_WORD = new RegExp([...Object.keys(ENGINE), ...[...BY_NAME, ...WORD_ENGINE].map(([, re]) => re.source)].join("|"), "i");
+// A settings file's values without the ones that name a store. An app the person started with
+// their own command is handed the rest: which databases it uses is that command's to say.
+const STORE_SETTING = new RegExp(`${ENGINE_WORD.source}|(?:^|_)(?:DB|DATABASE)(?:_|$)`, "i");
+export const withoutStoreSettings = (values) => Object.fromEntries(Object.entries(values).filter(([name]) => !STORE_SETTING.test(name)));
 // Stores that hold no collections: a bare COLLECTION setting beside one of them is still Qdrant's.
 const NO_COLLECTIONS = new Set(["redis", "mysql", "sqlserver", "neo4j", "meilisearch", "pinecone"]);
 const LOOPBACK = /^(?:localhost|127(?:\.\d+){3}|::1|\[::1\]|0\.0\.0\.0|host\.docker\.internal)?$/i;
@@ -329,19 +333,19 @@ export function storeKeeper({ ledgerFile, values = {}, dirs = [], fetchFn, local
 }
 
 // The stores the app reached that no setting names, as the hook saw each connection: a store written
-// into a config file rather than the environment, or one its maker's SDK finds by itself. One
-// sentence per store, said once.
-export function unnamedLines(connections, stores, told) {
-  const lines = [];
+// into a config file rather than the environment, one its maker's SDK finds by itself, or the ones an
+// app started with the person's own command was given. No copy stands in for any of them, so each
+// holds Run for the person's yes, once. `blocked`: the rows already holding it.
+export function unnamedHeld(connections, stores, blocked) {
+  const rows = [];
   for (const { host, port } of connections) {
     const local = onThisMachine(host);
-    const engine = local ? ENGINE_AT[port] : HOSTED.find(([, re]) => re.test(String(host).toLowerCase()))?.[0];
-    const key = local ? `localhost:${port}` : `${engine}:${String(host).toLowerCase()}`;
-    if (!engine || told.has(key) || stores.some((s) => (local ? `${hostKey(s.host)}:${s.port}` === key : s.engine === engine && !onThisMachine(s.host)))) continue;
-    told.add(key);
-    lines.push(local
-      ? `Your app connects to a ${ENGINE[engine]} server on this machine that none of its settings names, so it cannot be pointed at a copy: what test conversations create there stays there.`
-      : `Your app reaches ${ENGINE[engine]} on a server off this machine, and a copy is only made on this machine: what test conversations create there stays there.`);
+    const engine = local ? ENGINE_AT[port] : HOSTED.find(([, re]) => re.test(String(host).toLowerCase()))?.[0] ?? ENGINE_AT[port];
+    if (!engine || stores.some((s) => (local ? `${hostKey(s.host)}:${s.port}` === `localhost:${port}` : s.engine === engine && !onThisMachine(s.host)))) continue;
+    const id = createHash("sha256").update(`${engine}|${local ? "localhost" : String(host).toLowerCase()}|${port}`).digest("hex").slice(0, 16);
+    if ([...blocked, ...rows].some((b) => b.id === id)) continue;
+    // Named by its engine where a setting's name would stand: the API takes a name, never an address.
+    rows.push({ id, names: [ENGINE[engine].replace(/\W+/g, "_")], why: `Your app reaches ${/^[AEIOU]/.test(ENGINE[engine]) ? "an" : "a"} ${ENGINE[engine]} server ${local ? "on" : "off"} this machine that it was not given a copy of, so the run would write what its test conversations create into it as it is. Start your app on a copy of it, then run the connect command again.` });
   }
-  return lines;
+  return rows;
 }

package/lib/tied.cjs

@@ -39,9 +39,32 @@ const sentence = (v) => v.length >= 8 && /\s|[^\x00-\x7F]/.test(v);
 // The sentences a body or a reply carries, read as the person's words are: an "ok" or an id says nothing.
 const sentencesIn = (text) => { const v = json(text); return (v === undefined ? [String(text || "")] : scalars(v)).filter(sentence); };
 const PROMPTS_KEPT = 64, PROMPT_HEAD = 500;
+// How much of a sentence the model wrote a fetched reply has to carry to be the answer.
+const CARRY = 60;
+// A job's own word for work still going on, as its status or state says it: at the top of a document,
+// in an object inside it, or on the newest entry of a list in it. The backend reads the same words
+// (customer/endpoint.ts).
+const UNDER_WAY = /^(?:queued|pending|waiting|scheduled|submitted|accepted|created|starting|started|running|processing|generating|working|thinking|searching|retrieving|streaming|in[_ -]?progress|not[_ -]?(?:started|ready))$/i;
+const underWay = (v, depth = 0) => {
+  if (!v || typeof v !== "object" || depth > 4) return false;
+  if (Array.isArray(v)) return underWay(v.at(-1), depth + 1);
+  const state = v.status ?? v.state;
+  if (typeof state === "string" && UNDER_WAY.test(state)) return true;
+  return Object.values(v).some((x) => x && typeof x === "object" && underWay(x, depth + 1));
+};
+// The sentences a model wrote, read as the person's words are; a JSON answer the clip cut short is
+// read by its strings.
+const saidSentences = (text) => {
+  const whole = sentencesIn(text);
+  if (whole.length !== 1 || !/^\s*[[{]/.test(whole[0])) return whole;
+  return [...whole[0].matchAll(/"((?:[^"\\]|\\.){8,})"/g)].map((m) => m[1]).filter(sentence);
+};
 
 // `bodyOf(req)` and `replyOf(req)` read what a request carried and what the app answered.
-function makeTied({ norm, bodyOf, replyOf }) {
+// `saidOf(req)`: what the model calls made for an ask answered later have written, one entry a call
+// and none before one has, undefined where the hook hears none. The answer a person reads is not
+// always the last call's: a second look that changes nothing leaves the first reading standing.
+function makeTied({ norm, bodyOf, replyOf, saidOf = () => undefined }) {
   const open = new Set();
   const recent = [];
   // The heads of the prompts this process sent: one arriving at a server in the same process (an
@@ -68,6 +91,17 @@ function makeTied({ norm, bodyOf, replyOf }) {
     return first[1] >= 0 && first[1] !== second[1] ? first[0] : null;
   };
   const drop = (req) => { const i = recent.indexOf(req); if (i >= 0) recent.splice(i, 1); };
+  // Whether a fetch carries the ask's answer. A page polling for an answer several calls build comes
+  // back many times between two of them, on a document with no answer in it yet, or with a first
+  // reading in it while the document itself still says running.
+  const carries = (fetch, asker) => {
+    const said = saidOf(asker);
+    if (said === undefined) return true;
+    const raw = replyOf(fetch);
+    if (underWay(json(raw))) return false;
+    const reply = norm(raw);
+    return [].concat(said).flatMap(saidSentences).some((w) => reply.includes(norm(w).slice(0, CARRY)));
+  };
   // Asks reached through one session are one client's turns, the newest the one being answered: a
   // client holds a second stream open on its session (a heartbeat) that points at an older ask.
   const newestOf = (found) => {
@@ -89,7 +123,7 @@ function makeTied({ norm, bodyOf, replyOf }) {
     for (let i = mine.size ? recent.length - 1 : -1; i >= 0; i--) {
       const t = recent[i];
       // A request answered later is fetched afterwards only by a read of it, never by a new message.
-      if (t.at > req.at || now - t.at > RECENT_MS || (pinnedOnly && !t.pinned) || (t.settled && req.method !== "GET")) continue;
+      if (t.at > req.at || now - (t.callAt ?? t.at) > RECENT_MS || (pinnedOnly && !t.pinned) || (t.settled && req.method !== "GET")) continue;
       const tie = [...mine].filter((v) => idsOf(t).has(v));
       if (tie.length) return { asker: t, tie: new Set(tie) };
     }
@@ -107,7 +141,7 @@ function makeTied({ norm, bodyOf, replyOf }) {
     closed(req) {
       open.delete(req);
       const { asker } = req;
-      if (asker && !asker.written && !asker.callsOpen) {
+      if (asker && !asker.written && !asker.callsOpen && carries(req, asker)) {
         const since = Math.max(0, ...[...req.tie].map((i) => answered.get(i) ?? asker.at).filter((at) => at < asker.at));
         const before = recent.filter((p) => p !== asker && !p.settled && since < p.at && p.at < asker.at && asker.at - p.at <= BEFORE_MS && meets(idsOf(p), req.tie));
         for (const s of [...before, asker]) drop(s);
@@ -140,7 +174,7 @@ function makeTied({ norm, bodyOf, replyOf }) {
     inside(req, sent) {
       if (req.finished && (!req.noted || req.late) && !says(req, norm(sent))) return pinned(sent, req);
       if (!req.noted && req.finished) req.late = true;
-      if (req.late) { req.pinned = true; req.callsOpen = (req.callsOpen || 0) + 1; }
+      if (req.late) { req.pinned = true; req.callsOpen = (req.callsOpen || 0) + 1; req.callAt = Date.now(); }
       else req.waiting = (req.waiting || 0) + 1;
       return req;
     },
@@ -166,7 +200,7 @@ function makeTied({ norm, bodyOf, replyOf }) {
     // request tied to it came to fetch the answer. It stays where a fetch that comes later can still
     // find it and complete the exchange on a second request, but no call is pinned to it by its words.
     settled(req) {
-      if (!req || !req.late || !req.ended || req.callsOpen || req.waiting || req.written || req.settled || req.fetched) return false;
+      if (!req || !req.late || !req.ended || req.callsOpen || req.waiting || req.written || req.settled || (req.fetched && saidOf(req) === undefined)) return false;
       req.settled = true;
       return true;
     },
@@ -210,6 +244,7 @@ function makeTied({ norm, bodyOf, replyOf }) {
     if (!asker.noted && asker.finished) asker.late = true;
     asker.pinned = true;
     asker.callsOpen = (asker.callsOpen || 0) + 1;
+    asker.callAt = Date.now();
     return asker;
   }
 }

package/lib/trace.cjs

@@ -807,8 +807,43 @@ if (FILE) {
         return !passNow().some((p) => host === p || host.endsWith("." + p));
       } catch { return true; }
     };
-    // A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (Neon's SQL) is held.
-    const readsOnly = (text) => { try { const q = JSON.parse(text)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { return false; } };
+    // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
+    // a SELECT can write through a function) is held.
+    // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
+    // there cannot write: one statement that starts as a read and holds no word that writes, sent to
+    // what its address or its headers show is one of them, goes out. Anything this cannot read as that
+    // stays held. Databuddy's agent had 45 replies come back empty while its own ClickHouse queries
+    // were answered here with a stand-in.
+    const SQL_QUOTED = /'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|\/\*[\s\S]*?\*\//g;
+    // SHOW, DESCRIBE and EXISTS read whatever follows them. A SELECT, a WITH or an EXPLAIN reads
+    // unless it holds a word that writes inside it (a CTE that deletes, SELECT INTO, EXPLAIN ANALYZE
+    // of an insert) or hands its text on to another database to run.
+    const SQL_SHOWS = /^(?:show|describe|desc|exists)\b/i, SQL_SELECTS = /^(?:select|with|explain)\b/i;
+    const SQL_WRITES = /(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])/i;
+    const SQL_HANDS_ON = /\b(?:table|query|jdbc|odbc|executable)\s*\(/i;
+    const statementOf = (sql) => String(sql || "").replace(SQL_QUOTED, (m) => (m[0] === "'" ? "''" : /^["`]/.test(m) ? "x" : " ")).trim().replace(/;\s*$/, "");
+    // A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
+    const whole = (bare) => !/[;'"`]|\/\*|\$\$/.test(bare.replace(/''/g, ""));
+    const selects = (bare) => whole(bare) && (SQL_SHOWS.test(bare) || (SQL_SELECTS.test(bare) && !SQL_WRITES.test(bare) && !SQL_HANDS_ON.test(bare)));
+    const ANALYTICS_NAME = /clickhouse|trino|presto/i;
+    const ANALYTICS_HEADERS = ["x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user"];
+    const analytics = (u, headerOf, port) => /^(?:8123|8443)$/.test(String(port || u.port)) || ANALYTICS_NAME.test(u.hostname) || ANALYTICS_NAME.test(headerOf("user-agent") || "")
+      || ANALYTICS_HEADERS.some((name) => headerOf(name)) || u.pathname === "/v1/statement";
+    const readsOnly = (text, u, headerOf = () => "", port) => {
+      const sent = String(text || "").trim();
+      try { const q = JSON.parse(sent)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { /* not JSON: a statement sent as text */ }
+      if (!u || !analytics(u, headerOf, port)) return false;
+      // ClickHouse joins a `query` in the address to the body: both are read as the one statement.
+      const asked = `${u.searchParams.get("query") || ""} ${sent}`;
+      // ClickHouse reads a backslash before a quote as part of the string and Trino as its end, so
+      // where a string stops is not known here: held.
+      // ponytail: a ClickHouse read with an escaped quote in a string is held too; told apart by which
+      // database answered if that is ever seen.
+      return !/\\['"`]/.test(asked) && selects(statementOf(asked));
+    };
+    // A call passed on from this hook's own server, after its body was read: never held again.
+    const PASSED = Symbol("cortad.passed");
+    const passedOn = (args) => { const o = typeof args[0] === "string" || args[0] instanceof URL ? args[1] : args[0]; return Boolean(o && o[PASSED]); };
     let heldCount = 0;
     const fieldsOf = (text, type) => {
       try { const b = /form/i.test(type || "") ? Object.fromEntries(new URLSearchParams(text)) : JSON.parse(text); return b && typeof b === "object" && !Array.isArray(b) ? b : {}; } catch { return {}; }
@@ -821,7 +856,7 @@ if (FILE) {
     const heldSay = (method, host) => {
       if (heldSaid.has(`${method} ${host}`)) return;
       heldSaid.add(`${method} ${host}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
+      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
     };
     // Named by method and host only: a webhook's path is its credential.
     const heldRow = (u, method, text, type, ctx) => { heldSay(method, u.hostname); row({ dep: { at: Date.now(), host: u.hostname, status: 200, held: true, ...(ctx ? { ex: ctx.id, turn: ctx.turn } : {}), called: [{ name: `${method} ${u.hostname}`.slice(0, 80), arguments: argsText(fieldsOf(text, type)) }] } }); };
@@ -841,7 +876,22 @@ if (FILE) {
             const id = String(req.headers["x-cortad-held"] || "");
             const w = heldWaiting.get(id);
             heldWaiting.delete(id);
-            const text = Buffer.concat(parts).toString("utf8").slice(0, MAX);
+            const sent = Buffer.concat(parts);
+            const text = sent.toString("utf8").slice(0, MAX);
+            // A body that only reads, known now that it is here, goes on to where it was sent, as it was
+            // sent, and its answer comes back through this server.
+            if (w && parts.length < 256 && readsOnly(text, w.u, (name) => String(req.headers[name] || ""), w.port)) {
+              const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
+              const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
+              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true };
+              // Sent inside the request that asked, so the call is recorded behind that reply.
+              const send = () => (w.secure ? https : http).request(...(given ? [w.args[0], options] : [options]));
+              const up = w.ctx ? als.run(w.ctx, send) : send();
+              up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
+              up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
+              res.on("close", () => up.destroy());
+              return up.end(sent);
+            }
             if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
             res.writeHead(200, { "content-type": "application/json" });
             res.end(heldReply(text, req.headers["content-type"]));
@@ -867,12 +917,12 @@ if (FILE) {
       const method = String(o.method || "GET").toUpperCase();
       const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
       const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      return heldHere(u, method, headerOf) ? { u, method, o, cb: args.find((a) => typeof a === "function") } : null;
+      return heldHere(u, method, headerOf) ? { u, method, o, args: args.filter((a) => typeof a !== "function"), port: o.port || (given && given.port) || "", cb: args.find((a) => typeof a === "function") } : null;
     };
     const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb }, secure) => {
+    const sendHeld = ({ u, method, o, cb, args, port }, secure) => {
       const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore() });
+      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure });
       const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
       // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
       const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
@@ -883,7 +933,7 @@ if (FILE) {
     const heldFetch = async (realFetch, input, init) => {
       const req = new Request(input, init);
       const text = await req.clone().text().catch(() => "");
-      if (readsOnly(text)) return realFetch(req);
+      if (readsOnly(text, new URL(req.url), (name) => req.headers.get(name) || "")) return realFetch(req);
       const u = new URL(req.url);
       heldRow(u, req.method, text, req.headers.get("content-type"), als.getStore());
       return new Response(heldReply(text, req.headers.get("content-type")), { status: 200, headers: { "content-type": "application/json" } });
@@ -945,7 +995,7 @@ if (FILE) {
       const request = mod.request;
       mod.request = function (...args) {
         let held = null;
-        try { held = heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
+        try { held = passedOn(args) ? null : heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
         if (held) return sendHeld(held, mod === https);
         const req = request.apply(this, args);
         try {

package/lib/wire.cjs

@@ -761,14 +761,14 @@ function makeRecorder({ row, rulesFile, onTurn = () => {}, onEnded = () => {} })
   // of the person's is kept: their newest is the sign-in and the proof a run takes, and the command
   // keeps only the newest few per door.
   // ponytail: the trace file grows by one row per request of the person's; a cap per route if a person's own load test fills it.
-  const EXCHANGES_PER_ROUTE = 4, CANARY_PER_ROUTE = 30, ROUTES_KEPT = 1000, SENT_MAX = 4, MODEL_WORDS = 4000;
+  const EXCHANGES_PER_ROUTE = 4, CANARY_PER_ROUTE = 30, ROUTES_KEPT = 1000, SENT_MAX = 4, MODEL_WORDS = 4000, SAID_KEPT = 12;
   const slotOf = (turn) => (!turn ? { cls: "", max: Infinity } : /^canary:/.test(turn) ? { cls: "canary ", max: CANARY_PER_ROUTE } : { cls: "ours ", max: EXCHANGES_PER_ROUTE });
   const perRoute = new Map();
   // One route whatever id its path carries: a conversation in the path is a new path every trial.
   const routeKey = (method, path) => `${method} ${path.split("?")[0].split("/").map((s) => (/^\d+$/.test(s) || (s.length >= 8 && /\d/.test(s)) ? "{id}" : s)).join("/")}`;
   let lastExchange = 0;
   const { makeTied, sentencesIn } = require("./tied.cjs");
-  const tied = makeTied({ norm, bodyOf, replyOf: (ctx) => (ctx.reply ? ctx.reply.text.slice(0, MAX) : "") });
+  const tied = makeTied({ norm, bodyOf, replyOf: (ctx) => (ctx.reply ? ctx.reply.text.slice(0, MAX) : ""), saidOf: (ctx) => (ctx.late ? ctx.saidAll || [] : undefined) });
   const requestCtx = (method, path, headers, turn) => {
     if (turn) onTurn();
     const ctx = { id: `${process.pid}.${++lastExchange}`, at: Date.now(), method, path, headers, chunks: [], size: 0, noted: false, kept: false, sent: [], turn, sites: [], traced: 0 };
@@ -866,7 +866,10 @@ function makeRecorder({ row, rulesFile, onTurn = () => {}, onEnded = () => {} })
       const told = asked && typeof asked === "object" && !EMBEDDING.test(path) ? toldOf(asked, ctx ? new Set([...heard, ...heardIn(ctx)]) : heard) : {};
       tied.done(ctx);
       if (ctx && ctx.late) {
-        if (!EMBEDDING.test(path)) ctx.said = { status, words: replyText(reply.events).slice(0, MODEL_WORDS), at: Date.now() };
+        if (!EMBEDDING.test(path)) {
+          ctx.said = { status, words: replyText(reply.events).slice(0, MODEL_WORDS), at: Date.now() };
+          ctx.saidAll = [...(ctx.saidAll || []), ctx.said.words].slice(-SAID_KEPT);
+        }
         settle(ctx);
       }
       row({ call: { at: Date.now(), ms: Date.now() - t0, host: String(host).replace(/:443$/, ""), model: String(askedFor(path, sent) || reply.model || "").slice(0, 160), ...answeredBy(askedFor(path, sent), reply.model), status, ...(reply.tokens || { promptTokens: 0, cachedTokens: 0, completionTokens: 0 }), usage: Boolean(reply.tokens), ...(EMBEDDING.test(path) ? { embedding: true } : {}), ...(ctx ? { ex: ctx.id } : {}), ...(ctx && (ctx.kept || ctx.turn) ? { reply: replyText(reply.events).slice(0, MODEL_WORDS) } : {}), ...(turn ? { turn } : {}), ...(rules ? { rules } : {}), ...(tools ? { tools } : {}), ...(called ? { called } : {}), ...(passages ? { passages } : {}), ...(caller ? { caller } : {}), ...(reply.limit ? { limit: { cap: capOf(asked), reasoning: reply.reasoning } } : {}), ...told } });

package/local.mjs

@@ -12,7 +12,7 @@
 // on with the key this connect leaves in ~/.cortad. Nothing here touches git. Your environment
 // never leaves this machine. Ctrl-C ends everything.
 
-import { storesOf } from "./lib/stores.mjs";
+import { storesOf, withoutStoreSettings } from "./lib/stores.mjs";
 import { notAnApp, withoutStores } from "./lib/app-port.mjs";
 import { holdsKeys, secretEnvValues } from "./lib/keys.mjs";
 import { spawn, execFile, execFileSync } from "node:child_process";
@@ -38,7 +38,7 @@ import { CAPTURED, makeCapture } from "./lib/replay.mjs";
 import { sampleHere } from "./lib/sample.mjs";
 import { mintAcross, originFor, servicePort, waitForPort } from "./lib/service.mjs";
 import { listingUrl } from "./lib/listing.mjs";
-import { hookable, installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
+import { hookable, installPlan, missingDependency, shownCommand, startPlan, workspaces } from "./lib/start.mjs";
 import { openProxy } from "./lib/proxy.mjs";
 import { liftedLimits, sessionLifts } from "./lib/switches.mjs";
 import { makeKeeping } from "./lib/keeping.mjs";
@@ -663,6 +663,10 @@ async function ask(question) {
   return line.trim() || null;
 }
 let child = null;
+// An app this command did not start carries nothing that counts its model calls, and no run plays
+// against it (the API holds Run): databuddy's free run played 39 conversations into a route that
+// answers from code.
+const UNSEEN = "your app was already running, so Cortad cannot see the calls it makes to its model, and no run can start.";
 async function startApp() {
   const wanted = Number(flag("--port"));
   // "--port 8106 --start ..." is "start it, it will answer on 8106", not "it is already on 8106":
@@ -671,11 +675,10 @@ async function startApp() {
     if (!(await answers(wanted))) return { port: null, said: "", why: `nothing is answering on port ${wanted}, so there is nothing to ask.`, noStart: true };
     const took = await takeOver(wanted);
     if (took) return took;
-    say("your app was already running, so its request limits stay as they are; if it answers 429, stop it and run this without --port and they are raised for the session");
     if (proxyAsked) {
       await useProxy();
-      say(`to have its model calls seen, start your app with: ${Object.entries(proxy.env({ ...envExports(envFiles), ...process.env })).map(([k, v]) => `${k}=${v}`).join(" ")}`);
-    }
+      say(`your app was already running, so Cortad cannot see the calls it makes to its model until it is started with: ${Object.entries(proxy.env({ ...envExports(envFiles), ...process.env })).map(([k, v]) => `${k}=${v}`).join(" ")}`);
+    } else say(`${UNSEEN} Stop it and run this again without --port: this command starts your app itself.`);
     return { port: wanted, cmd: null };
   }
   const plan = startPlan({ root, typed: flag("--start"), onPath });
@@ -718,7 +721,7 @@ async function startApp() {
       await keeping.forget();
       const took = await takeOver(held.port);
       if (took) return took;
-      say(`your app is already running on port ${held.port}, so that one is used; its request limits stay as they are`);
+      say(`${UNSEEN} Stop the one on port ${held.port} and run this again: this command starts your app itself.`);
       return { port: held.port, cmd: null };
     }
   }
@@ -912,7 +915,7 @@ async function freed(cmd, lifted) {
 // was copied, started, or left where trials write into it is told in the terminal here and to the
 // run with the app (announce), so status says it beside Run and the report keeps it.
 const keeping = makeKeeping({
-  root, work, ledgerFile: join(homeOf(project), "made.json"), onPath, say, hold,
+  root, work, ledgerFile: join(homeOf(project), "made.json"), onPath, say, hold, typed: Boolean(flag("--start")),
   launch: (plan) => sidecar(plan.cmd, plan.cwd),
   connections: () => capture?.connections() ?? [],
   settings: () => {
@@ -941,7 +944,10 @@ async function start(waitMs, tries = 3) {
   loaded = note;
   const copies = await keeping.env(true);
   await allowOutbound();
-  const base = { ...envExports(envFiles), ...process.env, ...lifted, ...copies };
+  // A start command the person typed says which databases the app uses: the store settings of their
+  // settings files are left for the app to load, since handed over here they outrank the
+  // environment that command chose, and no copy is pointed at.
+  const base = flag("--start") ? { ...withoutStoreSettings(envExports(envFiles)), ...process.env, ...lifted } : { ...envExports(envFiles), ...process.env, ...lifted, ...copies };
   child = spawnTied(cmd, { cwd: appDir, env: { ...base, ...(proxy ? proxy.env(base) : capture ? capture.env(process.env) : {}), FORCE_COLOR: "0", ...(pinned.bin ? { PATH: `${pinned.bin}:${process.env.PATH ?? ""}` } : {}) } });
   const mine = child;
   become("starting", { app: mine.pid ?? null });
@@ -1167,7 +1173,7 @@ identities = makeIdentities({ root, work, envFiles, sourceFiles: () => files, sa
 // A real request that reached their model proves its door (lib/proof.mjs). What it proved goes up,
 // masked like everything else, and nothing goes up that the mask could not read; the sign-in each
 // request carried stays here.
-capture = makeCapture({ work, keepSecret, writes: join(homeOf(projectOf(root)), "writes"), root, files: () => files, appFolder: () => relative(root, appDir), printed: printedBetween, onProof: (proof) => {
+capture = makeCapture({ work, keepSecret, signIns: join(homeOf(projectOf(root)), "sign-ins.json"), writes: join(homeOf(projectOf(root)), "writes"), root, files: () => files, appFolder: () => relative(root, appDir), printed: printedBetween, onProof: (proof) => {
   let masked;
   try { masked = JSON.parse(mask(JSON.stringify(proof))); } catch { return; }
   call("POST", `/local/${box}/proof`, masked).catch(() => {});
@@ -1285,7 +1291,7 @@ const announce = async () => {
   // Through the proxy, a message is seen arriving at its front, and its model calls once the app was started with its settings on the proxy.
   const hooked = Boolean(proxy ? launched || proxy.seen() : launched && capture?.watching(app.port));
   const started = Boolean(launched);
-  const told = await call("POST", `/local/${box}/app`, { port: doorPort(), cmd: app.cmd, origins: envOrigins(envFiles), lifted: app.lifted ?? [], data: (await keeping.lines(started)).map(mask), blocked: await keeping.blocked(started), watching: hooked, metered: hooked, proves: hooked });
+  const told = await call("POST", `/local/${box}/app`, { port: doorPort(), cmd: shownCommand(app.cmd, mask), origins: envOrigins(envFiles), lifted: app.lifted ?? [], data: (await keeping.lines(started)).map(mask), blocked: await keeping.blocked(started), watching: hooked, metered: hooked, proves: hooked });
   if (told.ok) await allowOutbound(told.data?.consent);
   return told;
 };
@@ -1334,7 +1340,7 @@ async function appLife(firstStart) {
   clearStep();
   if (!told.ok) return quit(told.data?.error ?? `could not register your app (${told.status})`);
   machineOf = () => (app ? {
-    cmd: app.cmd ?? "", dir: relative(root, appDir) || ".", port: app.port, started: Boolean(launched),
+    cmd: shownCommand(app.cmd, mask) ?? "", dir: relative(root, appDir) || ".", port: app.port, started: Boolean(launched),
     hooked: Boolean(launched && !proxy && capture?.watching(app.port)), proxy: proxy?.port ?? null,
     changed: [...new Set([...(app.lifted ?? []), ...Object.keys(keeping.envNow())])],
     copies: Object.keys(keeping.envNow()).length ? "made" : "none",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"