cortad 0.3.4 → 0.3.6

package/lib/proof.mjs

@@ -440,10 +440,17 @@ function carriedFrom(later, earlier, ask) {
 
 const cookiesIn = (ex) => Object.fromEntries(str(headerOf(ex.headers, "cookie")).split(";").map((c) => c.trim().split("=")).filter(([k, v]) => k && v !== undefined).map(([k, ...v]) => [k, v.join("=")]));
 
+// A sign-in is never the conversation. A cookie or a header a trial is sent without is one that only
+// names the conversation: Databuddy's sign-in cookie, refreshed on every reply, was taken for one, and
+// each trial sent without it was refused; an Authorization header that stayed the same would be too.
+const READS_AS_CREDENTIAL = /auth|token|jwt|csrf|xsrf|secret|key|sid$|sessionid|connect\.sid|phpsessid|jsessionid|__session|__host-|__secure-|^sb-|clerk|supabase|laravel_session/i;
+const READS_AS_CONVERSATION = /conv|thread|chat|dialog|session[-_]?id/i;
+const namesConversation = (name) => READS_AS_CONVERSATION.test(name) && !READS_AS_CREDENTIAL.test(name);
+
 // What stayed the same from the earlier exchange to the later one and is not the ask: a field the app
 // handed back, a path segment, a field that reads as an id, a cookie the app set, a header, another
 // cookie. The first found carries the session.
-function carrierOf(earlier, later, ask, door) {
+export function carrierOf(earlier, later, ask, door) {
   const same = (a, b) => a !== undefined && a !== "" && a === b;
   const before = new Map(leaves(bodyOf(earlier) ?? {}).map((l) => [l.at.join("."), l.value]));
   const own = leaves(bodyOf(later) ?? {}).filter((l) => !inList(l.at) && fieldOf(l.at) !== ask?.field);
@@ -466,13 +473,15 @@ function carrierOf(earlier, later, ask, door) {
   if (idField) return { carrier: "body", key: idField.at.join("."), minted: "client" };
   const jar = cookiesIn(later);
   const jarBefore = cookiesIn(earlier);
-  // A cookie the app set on the earlier reply, sent back: the earlier request could not carry it.
-  const set = Object.keys(jar).find((k) => earlier.cookies.includes(k));
+  // A cookie the app set on the earlier reply, sent back, which the earlier request could not carry.
+  // One that request already carried was only refreshed: a session the person signed in with, unless
+  // its name says it is the conversation.
+  const set = Object.keys(jar).find((k) => earlier.cookies.includes(k) && (jarBefore[k] === undefined || namesConversation(k)));
   if (set) return { carrier: "cookie", key: set, minted: "app" };
-  const cookies = Object.keys(jar).filter((k) => same(jar[k], jarBefore[k]));
-  const header = Object.keys(later.headers).find((k) => !HOP.test(k) && !PLAIN_HEADER.test(k) && same(later.headers[k], headerOf(earlier.headers, k.toLowerCase())));
+  const header = Object.keys(later.headers).find((k) => !HOP.test(k) && !PLAIN_HEADER.test(k) && namesConversation(k) && same(later.headers[k], headerOf(earlier.headers, k.toLowerCase())));
   if (header) return { carrier: "header", key: header.toLowerCase(), minted: "client" };
-  if (cookies.length) return { carrier: "cookie", key: cookies[0], minted: "client" };
+  const cookie = Object.keys(jar).find((k) => namesConversation(k) && same(jar[k], jarBefore[k]));
+  if (cookie) return { carrier: "cookie", key: cookie, minted: "client" };
   return { carrier: "none", key: null };
 }
 

package/lib/pyhook/sitecustomize.py

@@ -1353,11 +1353,55 @@ def _install():
         except Exception:
             return True
 
-    # A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (SQL over HTTP) is held.
-    def reads_only(raw):
-        b = parsed(raw) if raw else None
-        q = b.get("query") if isinstance(b, dict) else None
-        return isinstance(q, str) and bool(re.match(r"^\s*(?:\{|query\b|fragment\b)", q)) and not re.search(r"\bmutation\b", q)
+    # A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (SQL over HTTP,
+    # where a SELECT can write through a function) is held.
+    # ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
+    # there cannot write: one statement that starts as a read and holds no word that writes, sent to
+    # what its address or its headers show is one of them, goes out (lib/trace.cjs does the same).
+    sql_quoted = re.compile(r"""'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|/\*[\s\S]*?\*/""")
+    sql_shows = re.compile(r"^(?:show|describe|desc|exists)\b", re.I | re.A)
+    sql_selects = re.compile(r"^(?:select|with|explain)\b", re.I | re.A)
+    sql_writes = re.compile(r"(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])", re.I | re.A)
+    sql_hands_on = re.compile(r"\b(?:table|query|jdbc|odbc|executable)\s*\(", re.I | re.A)
+    sql_open = re.compile(r"""[;'"`]|/\*|\$\$""")
+    analytics_name = re.compile(r"clickhouse|trino|presto", re.I)
+    analytics_headers = ("x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user")
+
+    def statement_of(sql):
+        bare = sql_quoted.sub(lambda m: "''" if m.group(0)[0] == "'" else "x" if m.group(0)[0] in '"`' else " ", str(sql or "")).strip()
+        return re.sub(r";\s*$", "", bare)
+
+    # A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
+    def selects(bare):
+        if sql_open.search(bare.replace("''", "")):
+            return False
+        return bool(sql_shows.match(bare)) or bool(sql_selects.match(bare) and not sql_writes.search(bare) and not sql_hands_on.search(bare))
+
+    def analytics(parts, header_of):
+        try:
+            port = parts.port
+        except ValueError:
+            port = None
+        return port in (8123, 8443) or bool(analytics_name.search(parts.hostname or "")) or bool(analytics_name.search(str(header_of("user-agent") or ""))) \
+            or any(header_of(name) for name in analytics_headers) or parts.path == "/v1/statement"
+
+    def reads_only(raw, url=None, header_of=None):
+        sent = str(raw or "").strip()
+        b = parsed(sent) if sent else None
+        if b is not None:
+            q = b.get("query") if isinstance(b, dict) else None
+            return isinstance(q, str) and bool(re.match(r"^\s*(?:\{|query\b|fragment\b)", q)) and not re.search(r"\bmutation\b", q)
+        try:
+            parts = urlsplit(str(url)) if url else None
+            if parts is None or not analytics(parts, header_of or (lambda name: None)):
+                return False
+            # ClickHouse joins a `query` in the address to the body: both are read as the one statement.
+            asked = "%s %s" % (dict(parse_qsl(parts.query)).get("query", ""), sent)
+            # ClickHouse reads a backslash before a quote as part of the string and Trino as its end,
+            # so where a string stops is not known here: held.
+            return not re.search(r"""\\['"`]""", asked) and selects(statement_of(asked))
+        except Exception:
+            return False
 
     held_count = itertools.count(1)
 
@@ -1381,7 +1425,7 @@ def _install():
             return
         held_said.add((method, host))
         try:
-            sys.stderr.write("cortad: a request Cortad sent made this app send %s to %s. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n" % (method, host))
+            sys.stderr.write("cortad: a request Cortad sent made this app send %s to %s. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n" % (method, host))
         except Exception:
             pass
 
@@ -2426,7 +2470,7 @@ def _install():
 
         # A held call that cannot be answered fails in the app; it is never sent instead.
         def held_httpx(request, sent):
-            if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent):
+            if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent, request.url, request.headers.get):
                 return None
             kind = request.headers.get("content-type", "")
             held_row(request.url, request.method, sent, kind, ctx.get())
@@ -2489,7 +2533,7 @@ def _install():
             if not held_here(request.url, request.method, lambda: keys_in(request.headers)):
                 return None
             raw = text(request.body, reply_max)
-            if reads_only(raw):
+            if reads_only(raw, request.url, request.headers.get):
                 return None
             import datetime
             models, structures = sys.modules["requests.models"], sys.modules["requests.structures"]
@@ -2540,6 +2584,13 @@ def _install():
             basic = k.get("auth") or getattr(self, "_default_auth", None)
             return [given.get(n) or defaults.get(n) for n in key_headers] + [basic.encode() if basic else None]
 
+        def header_of(self, k, name):
+            for headers in (k.get("headers"), getattr(self, "_default_headers", None)):
+                for n, v in dict(headers or {}).items():
+                    if str(n).lower() == name:
+                        return v
+            return None
+
         # A path relative to the session's base address is decided on the whole address.
         def whole(self, str_or_url):
             try:
@@ -2550,7 +2601,7 @@ def _install():
         async def requested(self, method, str_or_url, *a, **k):
             body = k.get("json") if k.get("json") is not None else k.get("data")
             url = whole(self, str_or_url)
-            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max)):
+            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max), url, lambda name: header_of(self, k, name)):
                 port = held_port()
                 if port is None:
                     raise module.ClientConnectionError("this write was kept from leaving and could not be answered")

package/lib/replay.mjs

@@ -2,7 +2,7 @@
 // reads what the hook wrote, keeps the sign-in each request carried on this machine, and tells the
 // cloud what each door is proven to do (lib/proof.mjs): the route, the method, the body, the header
 // names and what the requests did inside the app. Header values never leave.
-import { copyFileSync, existsSync, mkdtempSync, readFileSync, statSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { SourceMap } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative } from "node:path";
@@ -15,15 +15,17 @@ const HOOK = join(HERE, "trace.cjs");
 const PYHOOK = join(HERE, "pyhook");
 export const CAPTURED = "captured";
 // Never replayed: they describe one connection, not the caller.
+const SECRET_HEADER = /authorization|cookie|token|secret|session|csrf|api-?key/i;
 const HOP = /^(?:host|content-length|connection|keep-alive|transfer-encoding|upgrade|expect|te|trailer|accept-encoding|x-cortad-as|x-cortad-turn)$/i;
 
 // `files` lists the repository's source, relative to `root`, for placing a problem at its line;
 // `appFolder` is the folder the app runs in, relative to `root`. `onProof` gets one payload per door,
 // again whenever what it proves changes. `printed(from, to)` is what the app printed between two times.
-export function makeCapture({ work, keepSecret, onProof = () => {}, writes = null, root = null, files = () => [], appFolder = () => "", printed = () => "" }) {
+export function makeCapture({ work, keepSecret, onProof = () => {}, writes = null, root = null, files = () => [], appFolder = () => "", printed = () => "", signIns = null }) {
   const file = join(work, "trace.jsonl");
   let read = 0;
-  const accounts = makeAccounts();
+  const accounts = makeAccounts(signIns);
+  for (const headers of accounts.kept()) for (const [k, v] of Object.entries(headers)) if (SECRET_HEADER.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
   let alive = false;
   // The ports a hooked process listens on. Loading is not listening: turbo's own Node launcher loads
   // the hook, and one app was told we would see its messages while its API on Bun carried none.
@@ -118,7 +120,7 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
       if (typeof row.ex !== "string" || typeof row.method !== "string" || typeof row.path !== "string" || !row.path.startsWith("/")) continue;
       for (const [door, r] of taken) if (r.ex === row.ex) taken.delete(door);
       const headers = Object.fromEntries(Object.entries(row.headers ?? {}).filter(([k, v]) => !HOP.test(k) && typeof v === "string"));
-      for (const [k, v] of Object.entries(headers)) if (/authorization|cookie|token|secret|session|csrf|api-?key/i.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
+      for (const [k, v] of Object.entries(headers)) if (SECRET_HEADER.test(k)) keepSecret(String(v).replace(/^Bearer\s+/i, ""));
       // Speaking as the person means their own client's headers, never a trial's. Cortad's own test
       // request (reach:*) carries the page and sign-in this machine found for the app, so a run speaks
       // with them where no request of the person's came: without it every run request lost the Origin
@@ -451,15 +453,40 @@ function leavesOf(body) {
   try { walk(typeof body === "string" ? JSON.parse(body) : body, "", 0); } catch { /* not JSON: nothing of theirs to read */ }
   return out;
 }
-export function makeAccounts() {
+// `file`: where the accounts are kept between connects, on this machine and readable by this user
+// alone. Databuddy's agent signed in once per connect, and every reconnect asked for it again.
+// A sign-in that has ended is not read back.
+export function makeAccounts(file = null) {
   const kept = [];
   let bare = null;
+  if (file) {
+    try {
+      const stored = JSON.parse(readFileSync(file, "utf8"));
+      // A visitor who is not signed in still sends what the app lets them in by (its Origin): ulaim
+      // refused every test request of a reconnect with 403, having been sent none of it.
+      const visitor = Array.isArray(stored) ? null : stored?.visitor;
+      if (visitor && typeof visitor === "object" && !signInKey(visitor)) bare = Object.fromEntries(Object.entries(visitor).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
+      for (const a of Array.isArray(stored) ? stored : stored?.accounts ?? []) {
+        if (kept.length >= ACCOUNTS_MAX || typeof a?.key !== "string" || !a.headers || typeof a.headers !== "object") continue;
+        const headers = Object.fromEntries(Object.entries(a.headers).filter(([k, v]) => typeof k === "string" && typeof v === "string"));
+        if (signInKey(headers) !== a.key || (identityOf(headers).expiresInS ?? 1) <= 0) continue;
+        kept.push({ key: a.key, headers, bodies: new Map(Object.entries(a.bodies ?? {}).map(([door, leaves]) => [door, new Map(Object.entries(leaves ?? {}))])) });
+      }
+    } catch { /* none kept, or not ours to read: the next signed-in request is taken */ }
+  }
+  const save = () => {
+    if (!file) return;
+    try {
+      mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+      writeFileSync(file, JSON.stringify({ visitor: bare, accounts: kept.map((a) => ({ key: a.key, headers: a.headers, bodies: Object.fromEntries([...a.bodies].map(([door, leaves]) => [door, Object.fromEntries(leaves)])) })) }), { mode: 0o600 });
+    } catch { /* kept for this connect only */ }
+  };
   const at = (role) => { const m = ACCOUNT_ROLE.exec(role); return m ? kept[Number(m[1] ?? 1) - 1] ?? kept[0] ?? null : null; };
   return {
     // `door` and `body`: the request as that customer sent it, for the values in it that are theirs.
     keep(headers, door, body) {
       const key = signInKey(headers);
-      if (!key) { bare = headers; return; }
+      if (!key) { bare = headers; save(); return; }
       let account = kept.find((a) => a.key === key);
       if (account) account.headers = headers;
       else {
@@ -470,6 +497,7 @@ export function makeAccounts() {
         else return;
       }
       if (door) account.bodies.set(door, leavesOf(body));
+      save();
     },
     kept: () => kept.map((a) => a.headers),
     speak(role) {

package/lib/start.mjs

@@ -239,3 +239,11 @@ export function installPlan(dir, onPath, root = dir) {
   if (existsSync(join(dir, "pyproject.toml"))) return into("-e .");
   return null;
 }
+
+// The start command as it leaves this machine: a value typed into it (DATABASE_URL=...) stays here
+// unless it is a plain word, and it is cut to the length the server keeps. A command past that
+// length was refused whole, as "port is required", with a valid port beside it.
+export const SHOWN_COMMAND = 200;
+export const shownCommand = (cmd, mask = (text) => text) => (cmd == null ? cmd
+  : mask(String(cmd)).replace(/\b([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S+)/g, (whole, name, value) => (/^[\w.-]{1,24}$/.test(value) ? whole : `${name}=***`)).slice(0, SHOWN_COMMAND));
+

package/lib/trace.cjs

@@ -807,8 +807,43 @@ if (FILE) {
         return !passNow().some((p) => host === p || host.endsWith("." + p));
       } catch { return true; }
     };
-    // A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (Neon's SQL) is held.
-    const readsOnly = (text) => { try { const q = JSON.parse(text)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { return false; } };
+    // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
+    // a SELECT can write through a function) is held.
+    // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
+    // there cannot write: one statement that starts as a read and holds no word that writes, sent to
+    // what its address or its headers show is one of them, goes out. Anything this cannot read as that
+    // stays held. Databuddy's agent had 45 replies come back empty while its own ClickHouse queries
+    // were answered here with a stand-in.
+    const SQL_QUOTED = /'(?:[^'\\]|\\.|'')*'|"(?:[^"\\]|\\.|"")*"|`[^`]*`|--[^\n]*|\/\*[\s\S]*?\*\//g;
+    // SHOW, DESCRIBE and EXISTS read whatever follows them. A SELECT, a WITH or an EXPLAIN reads
+    // unless it holds a word that writes inside it (a CTE that deletes, SELECT INTO, EXPLAIN ANALYZE
+    // of an insert) or hands its text on to another database to run.
+    const SQL_SHOWS = /^(?:show|describe|desc|exists)\b/i, SQL_SELECTS = /^(?:select|with|explain)\b/i;
+    const SQL_WRITES = /(?<![.\w])(?:insert|update|delete|merge|into|create|alter|drop|truncate|refresh|call|execute)(?![.\w])/i;
+    const SQL_HANDS_ON = /\b(?:table|query|jdbc|odbc|executable)\s*\(/i;
+    const statementOf = (sql) => String(sql || "").replace(SQL_QUOTED, (m) => (m[0] === "'" ? "''" : /^["`]/.test(m) ? "x" : " ")).trim().replace(/;\s*$/, "");
+    // A quote or a comment left open, a second statement or a dollar-quoted body is not read as a read.
+    const whole = (bare) => !/[;'"`]|\/\*|\$\$/.test(bare.replace(/''/g, ""));
+    const selects = (bare) => whole(bare) && (SQL_SHOWS.test(bare) || (SQL_SELECTS.test(bare) && !SQL_WRITES.test(bare) && !SQL_HANDS_ON.test(bare)));
+    const ANALYTICS_NAME = /clickhouse|trino|presto/i;
+    const ANALYTICS_HEADERS = ["x-clickhouse-user", "x-clickhouse-key", "x-clickhouse-database", "x-clickhouse-format", "x-trino-user", "x-presto-user"];
+    const analytics = (u, headerOf, port) => /^(?:8123|8443)$/.test(String(port || u.port)) || ANALYTICS_NAME.test(u.hostname) || ANALYTICS_NAME.test(headerOf("user-agent") || "")
+      || ANALYTICS_HEADERS.some((name) => headerOf(name)) || u.pathname === "/v1/statement";
+    const readsOnly = (text, u, headerOf = () => "", port) => {
+      const sent = String(text || "").trim();
+      try { const q = JSON.parse(sent)?.query; return typeof q === "string" && /^\s*(?:\{|query\b|fragment\b)/.test(q) && !/\bmutation\b/.test(q); } catch { /* not JSON: a statement sent as text */ }
+      if (!u || !analytics(u, headerOf, port)) return false;
+      // ClickHouse joins a `query` in the address to the body: both are read as the one statement.
+      const asked = `${u.searchParams.get("query") || ""} ${sent}`;
+      // ClickHouse reads a backslash before a quote as part of the string and Trino as its end, so
+      // where a string stops is not known here: held.
+      // ponytail: a ClickHouse read with an escaped quote in a string is held too; told apart by which
+      // database answered if that is ever seen.
+      return !/\\['"`]/.test(asked) && selects(statementOf(asked));
+    };
+    // A call passed on from this hook's own server, after its body was read: never held again.
+    const PASSED = Symbol("cortad.passed");
+    const passedOn = (args) => { const o = typeof args[0] === "string" || args[0] instanceof URL ? args[1] : args[0]; return Boolean(o && o[PASSED]); };
     let heldCount = 0;
     const fieldsOf = (text, type) => {
       try { const b = /form/i.test(type || "") ? Object.fromEntries(new URLSearchParams(text)) : JSON.parse(text); return b && typeof b === "object" && !Array.isArray(b) ? b : {}; } catch { return {}; }
@@ -821,7 +856,7 @@ if (FILE) {
     const heldSay = (method, host) => {
       if (heldSaid.has(`${method} ${host}`)) return;
       heldSaid.add(`${method} ${host}`);
-      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
+      try { process.stderr.write(`cortad: a request Cortad sent made this app send ${method} to ${host}. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line may come from that stand-in rather than from your code. With that service's test key the call goes out as sent.\n`); } catch { /* no stderr */ }
     };
     // Named by method and host only: a webhook's path is its credential.
     const heldRow = (u, method, text, type, ctx) => { heldSay(method, u.hostname); row({ dep: { at: Date.now(), host: u.hostname, status: 200, held: true, ...(ctx ? { ex: ctx.id, turn: ctx.turn } : {}), called: [{ name: `${method} ${u.hostname}`.slice(0, 80), arguments: argsText(fieldsOf(text, type)) }] } }); };
@@ -841,7 +876,22 @@ if (FILE) {
             const id = String(req.headers["x-cortad-held"] || "");
             const w = heldWaiting.get(id);
             heldWaiting.delete(id);
-            const text = Buffer.concat(parts).toString("utf8").slice(0, MAX);
+            const sent = Buffer.concat(parts);
+            const text = sent.toString("utf8").slice(0, MAX);
+            // A body that only reads, known now that it is here, goes on to where it was sent, as it was
+            // sent, and its answer comes back through this server.
+            if (w && parts.length < 256 && readsOnly(text, w.u, (name) => String(req.headers[name] || ""), w.port)) {
+              const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
+              const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
+              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true };
+              // Sent inside the request that asked, so the call is recorded behind that reply.
+              const send = () => (w.secure ? https : http).request(...(given ? [w.args[0], options] : [options]));
+              const up = w.ctx ? als.run(w.ctx, send) : send();
+              up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
+              up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
+              res.on("close", () => up.destroy());
+              return up.end(sent);
+            }
             if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
             res.writeHead(200, { "content-type": "application/json" });
             res.end(heldReply(text, req.headers["content-type"]));
@@ -867,12 +917,12 @@ if (FILE) {
       const method = String(o.method || "GET").toUpperCase();
       const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
       const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      return heldHere(u, method, headerOf) ? { u, method, o, cb: args.find((a) => typeof a === "function") } : null;
+      return heldHere(u, method, headerOf) ? { u, method, o, args: args.filter((a) => typeof a !== "function"), port: o.port || (given && given.port) || "", cb: args.find((a) => typeof a === "function") } : null;
     };
     const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb }, secure) => {
+    const sendHeld = ({ u, method, o, cb, args, port }, secure) => {
       const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore() });
+      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure });
       const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
       // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
       const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
@@ -883,7 +933,7 @@ if (FILE) {
     const heldFetch = async (realFetch, input, init) => {
       const req = new Request(input, init);
       const text = await req.clone().text().catch(() => "");
-      if (readsOnly(text)) return realFetch(req);
+      if (readsOnly(text, new URL(req.url), (name) => req.headers.get(name) || "")) return realFetch(req);
       const u = new URL(req.url);
       heldRow(u, req.method, text, req.headers.get("content-type"), als.getStore());
       return new Response(heldReply(text, req.headers.get("content-type")), { status: 200, headers: { "content-type": "application/json" } });
@@ -945,7 +995,7 @@ if (FILE) {
       const request = mod.request;
       mod.request = function (...args) {
         let held = null;
-        try { held = heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
+        try { held = passedOn(args) ? null : heldCall(args, mod === https); } catch { /* not a call we can read: sent as asked */ }
         if (held) return sendHeld(held, mod === https);
         const req = request.apply(this, args);
         try {

package/local.mjs

@@ -38,7 +38,7 @@ import { CAPTURED, makeCapture } from "./lib/replay.mjs";
 import { sampleHere } from "./lib/sample.mjs";
 import { mintAcross, originFor, servicePort, waitForPort } from "./lib/service.mjs";
 import { listingUrl } from "./lib/listing.mjs";
-import { hookable, installPlan, missingDependency, startPlan, workspaces } from "./lib/start.mjs";
+import { hookable, installPlan, missingDependency, shownCommand, startPlan, workspaces } from "./lib/start.mjs";
 import { openProxy } from "./lib/proxy.mjs";
 import { liftedLimits, sessionLifts } from "./lib/switches.mjs";
 import { makeKeeping } from "./lib/keeping.mjs";
@@ -410,7 +410,12 @@ async function verb(job) {
         if (role === CAPTURED || role.startsWith(`${CAPTURED}:`)) {
           spokenAs = role;
           // Speaking as one of the customers whose requests we watched: every header their own client sent.
-          for (const [name, value] of Object.entries(capture?.headers(role) ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          const theirs = capture?.headers(role);
+          for (const [name, value] of Object.entries(theirs ?? {})) { for (const k of Object.keys(headers)) if (k.toLowerCase() === name) delete headers[k]; headers[name] = value; }
+          // No request of theirs is held (a new connect): sent from the app's own address, as Cortad's
+          // own test request is, so an app that lets visitors in by Origin lets this one in.
+          const from = !theirs && app ? ownOrigin(app.port) : null;
+          if (from && !Object.keys(headers).some((k) => k.toLowerCase() === "origin")) { headers.origin = from; headers.referer = `${from}/`; }
         } else {
           const held = await identities?.headerFor(role);
           if (held) { for (const k of Object.keys(headers)) if (k.toLowerCase() === held.name) delete headers[k]; headers[held.name] = held.value; }
@@ -663,6 +668,10 @@ async function ask(question) {
   return line.trim() || null;
 }
 let child = null;
+// An app this command did not start carries nothing that counts its model calls, and no run plays
+// against it (the API holds Run): databuddy's free run played 39 conversations into a route that
+// answers from code.
+const UNSEEN = "your app was already running, so Cortad cannot see the calls it makes to its model, and no run can start.";
 async function startApp() {
   const wanted = Number(flag("--port"));
   // "--port 8106 --start ..." is "start it, it will answer on 8106", not "it is already on 8106":
@@ -671,11 +680,10 @@ async function startApp() {
     if (!(await answers(wanted))) return { port: null, said: "", why: `nothing is answering on port ${wanted}, so there is nothing to ask.`, noStart: true };
     const took = await takeOver(wanted);
     if (took) return took;
-    say("your app was already running, so its request limits stay as they are; if it answers 429, stop it and run this without --port and they are raised for the session");
     if (proxyAsked) {
       await useProxy();
-      say(`to have its model calls seen, start your app with: ${Object.entries(proxy.env({ ...envExports(envFiles), ...process.env })).map(([k, v]) => `${k}=${v}`).join(" ")}`);
-    }
+      say(`your app was already running, so Cortad cannot see the calls it makes to its model until it is started with: ${Object.entries(proxy.env({ ...envExports(envFiles), ...process.env })).map(([k, v]) => `${k}=${v}`).join(" ")}`);
+    } else say(`${UNSEEN} Stop it and run this again without --port: this command starts your app itself.`);
     return { port: wanted, cmd: null };
   }
   const plan = startPlan({ root, typed: flag("--start"), onPath });
@@ -718,7 +726,7 @@ async function startApp() {
       await keeping.forget();
       const took = await takeOver(held.port);
       if (took) return took;
-      say(`your app is already running on port ${held.port}, so that one is used; its request limits stay as they are`);
+      say(`${UNSEEN} Stop the one on port ${held.port} and run this again: this command starts your app itself.`);
       return { port: held.port, cmd: null };
     }
   }
@@ -1170,7 +1178,7 @@ identities = makeIdentities({ root, work, envFiles, sourceFiles: () => files, sa
 // A real request that reached their model proves its door (lib/proof.mjs). What it proved goes up,
 // masked like everything else, and nothing goes up that the mask could not read; the sign-in each
 // request carried stays here.
-capture = makeCapture({ work, keepSecret, writes: join(homeOf(projectOf(root)), "writes"), root, files: () => files, appFolder: () => relative(root, appDir), printed: printedBetween, onProof: (proof) => {
+capture = makeCapture({ work, keepSecret, signIns: join(homeOf(projectOf(root)), "sign-ins.json"), writes: join(homeOf(projectOf(root)), "writes"), root, files: () => files, appFolder: () => relative(root, appDir), printed: printedBetween, onProof: (proof) => {
   let masked;
   try { masked = JSON.parse(mask(JSON.stringify(proof))); } catch { return; }
   call("POST", `/local/${box}/proof`, masked).catch(() => {});
@@ -1288,7 +1296,7 @@ const announce = async () => {
   // Through the proxy, a message is seen arriving at its front, and its model calls once the app was started with its settings on the proxy.
   const hooked = Boolean(proxy ? launched || proxy.seen() : launched && capture?.watching(app.port));
   const started = Boolean(launched);
-  const told = await call("POST", `/local/${box}/app`, { port: doorPort(), cmd: app.cmd, origins: envOrigins(envFiles), lifted: app.lifted ?? [], data: (await keeping.lines(started)).map(mask), blocked: await keeping.blocked(started), watching: hooked, metered: hooked, proves: hooked });
+  const told = await call("POST", `/local/${box}/app`, { port: doorPort(), cmd: shownCommand(app.cmd, mask), origins: envOrigins(envFiles), lifted: app.lifted ?? [], data: (await keeping.lines(started)).map(mask), blocked: await keeping.blocked(started), watching: hooked, metered: hooked, proves: hooked });
   if (told.ok) await allowOutbound(told.data?.consent);
   return told;
 };
@@ -1337,7 +1345,7 @@ async function appLife(firstStart) {
   clearStep();
   if (!told.ok) return quit(told.data?.error ?? `could not register your app (${told.status})`);
   machineOf = () => (app ? {
-    cmd: app.cmd ?? "", dir: relative(root, appDir) || ".", port: app.port, started: Boolean(launched),
+    cmd: shownCommand(app.cmd, mask) ?? "", dir: relative(root, appDir) || ".", port: app.port, started: Boolean(launched),
     hooked: Boolean(launched && !proxy && capture?.watching(app.port)), proxy: proxy?.port ?? null,
     changed: [...new Set([...(app.lifted ?? []), ...Object.keys(keeping.envNow())])],
     copies: Object.keys(keeping.envNow()).length ? "made" : "none",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"