cortad 0.3.8 → 0.3.10

package/lib/text.mjs

@@ -4,8 +4,8 @@ import { failedLines, heldLines } from "./failed-text.mjs";
 import { readLines } from "./read-text.mjs";
 import { at, clip, has, num, PAGE_CHARS, pageOf, plural, SIDE, upper } from "./words.mjs";
 
-// What each verb prints. A result is data for the coding agent: a line meant for the person starts
-// with "For the person:", and a run_status result ends with the next call. A field the API leaves
+// What each verb prints. A result is data for the coding agent, in plain sentences it can hand the
+// person as they are, and a run_status result ends with the next call. A field the API leaves
 // out prints nothing, so the text follows the API as it grows.
 
 const DONE = new Set(["succeeded", "failed", "canceled"]);
@@ -39,8 +39,7 @@ export function statusText(d) {
   lines.push(...contactLines(d.contact, d.app?.data, receipts));
   // While the read runs its lists are zeros ("Journeys (0)", "Questions: 0; 0 asked..."): it is said
   // once, and the lists come when it lands (the server's news says so).
-  // The quote says it when it is said (it names the read with what the run does about it).
-  if (d.read?.complete === false) { if (!d.contact?.ready?.reading || !d.contact.ready.trials) lines.push("Your code is still being read."); }
+  if (d.read?.complete === false) lines.push("Your code is still being read.");
   else if (d.read) lines.push(...readLines(d.read));
   if (d.run) lines.push(...runLines(d.run, "latest "));
   // Trials the read wrote after this run chose its own: the one count that is not the run's.
@@ -49,7 +48,7 @@ export function statusText(d) {
   // Production comes up after the first run (skill: The second run and production).
   if (d.field && d.run) lines.push(`Production: ${d.field.connected ? "connected" : "not connected"}.`);
   if (d.next) lines.push(d.next);
-  if (d.links?.lab && (d.read || d.run)) lines.push(`For the person: ${d.links.lab} shows this in the browser.`);
+  if (d.links?.lab && (d.read || d.run)) lines.push(`The person sees this at ${d.links.lab}`);
   if (d.run && !finished(d.run)) lines.push(`next: run_status ${d.run.jobId}`);
   return lines.join("\n");
 }
@@ -61,8 +60,8 @@ export const unseenText = (door) => `A request to ${door} was answered in words
 // to it, or there is no AI behind it. `followed`: a model call came after it that carried none of its
 // words.
 export const receiptText = (door, followed) => (followed
-  ? `${door} answered your request at once, with no model call inside it; a model call came after it, but its prompt carried none of the words your request sent, so Cortad cannot tell it was this request's answer. That gap is on Cortad's side, and a run leaves this endpoint out.\nFor the person: ${door} answers later in a way Cortad cannot match to the message that asked, so a run leaves it out for now; that gap is on Cortad's side.`
-  : `${door} answered your request at once with no model call inside it, and no model call followed in any process Cortad started. If a worker in another process writes its answer, Cortad does not see that worker, so a run leaves this endpoint out for now; that gap is on Cortad's side. If this endpoint has no AI behind it, nothing is missing.\nFor the person: ${door} answered with no AI call Cortad could see; if its AI runs in a separate worker, a run leaves it out for now, and that gap is on Cortad's side.`);
+  ? `${door} answered your request at once, with no model call inside it; a model call came after it, but its prompt carried none of the words your request sent, so Cortad cannot tell it was this request's answer. That gap is on Cortad's side, and a run leaves this endpoint out.`
+  : `${door} answered your request at once with no model call inside it, and no model call followed in any process Cortad started. If a worker in another process writes its answer, Cortad does not see that worker, so a run leaves this endpoint out for now; that gap is on Cortad's side. If this endpoint has no AI behind it, nothing is missing.`);
 // Only a door the read lists as one no request has reached, and no request has proven since: a sign-up
 // or a guard's reply to a request a later one proved is no worker's answer.
 const receiptsSaid = (receipts = [], c) => {
@@ -100,8 +99,16 @@ const runsSaid = (left, allowed) => (left > 0 ? `${num(left)} of ${plural(allowe
 // After the findings: what was measured of the app's own promises, in its own words, then the checks
 // measured and why the rest were not, then how many trials kept every promise. Counts, never a score.
 // The replies that did not count sit before the count: a clean count beside 62 error replies read as a clean bill.
+// Their own eval files, as the run played them: one line for all, one per file.
+function evalLines(evals) {
+  const t = evals?.total;
+  if (!t || !t.played) return [];
+  const said = (x) => `${num(x.passed)} of ${plural(x.played, "case")} passed${x.failed ? `, ${num(x.failed)} failed` : ""}${x.unclear ? `, ${num(x.unclear)} not settled` : ""}${x.cases > x.played ? `, ${num(x.cases - x.played)} not played` : ""}`;
+  return [`Your own eval files: ${said(t)}.`, ...(evals.files ?? []).slice(0, 12).map((f) => `  ${f.file}: ${said(f)}.`)];
+}
+
 function measuredLines(d) {
-  const lines = [...promiseLines(d.promises), ...failedLines(d.failedReplies)];
+  const lines = [...promiseLines(d.promises), ...evalLines(d.evals), ...failedLines(d.failedReplies)];
   const of = has(d.questionsAsked) && has(d.questionsOf) && d.questionsOf > 0;
   if (of) lines.push(`${num(d.questionsAsked)} of ${plural(d.questionsOf, "check")} measured.`);
   // The dissection says what was not measured in its own line.
@@ -177,7 +184,9 @@ function runLines(d, prefix = "") {
   for (const f of d.faults ?? []) lines.push(`Fault${SIDE[f.side] ? ` ${SIDE[f.side]}` : ""}: ${f.what}${f.fix ? ` ${f.fix}` : ""}`);
   for (const s of d.data ?? []) lines.push(`Data: ${s}`);
   // A run the stop line already explains is not said twice as an error.
-  if (d.error && !(d.stopped && d.error.startsWith(d.stopped.why))) lines.push(`Error: ${d.error}`);
+  // A failed run with no stop line of its own was stopped by Cortad, never by their app: said as that, with
+  // our error after it for a note to the team. "Error: timeout exceeded when trying to connect" read as the app's.
+  if (d.error && !(d.stopped && d.error.startsWith(d.stopped.why))) lines.push(d.status === "failed" && !d.stopped ? `The run stopped on Cortad's side, not your app's. Start another run. (Cortad's error: ${d.error})` : `Error: ${d.error}`);
   if (d.verify) lines.push(...verifyLines(d.verify));
   return lines;
 }
@@ -239,10 +248,10 @@ export function nextCall(d) {
   return d.kind === "verify" || d.findings > 0 ? "findings" : "status";
 }
 
-// One line for the person while a run plays: conversations done of the total, whose side any failed
+// One line to hand the person while a run plays: conversations done of the total, whose side any failed
 // reply is on, and the minutes left at the pace measured so far. Cost is measured only at the end.
 export function progressLine(d, now = Date.now()) {
-  if (!d.of) return "For the person: the run has started and is choosing its conversations; none has played yet.";
+  if (!d.of) return "The run has started. No conversation has played yet.";
   const parts = [`${num(d.played ?? 0)} of ${plural(d.of, "conversation")} done.`];
   const total = d.replies?.total ?? d.waited?.of;
   const crashed = d.replies?.crashed ?? 0;
@@ -254,7 +263,7 @@ export function progressLine(d, now = Date.now()) {
   if (total > 0 && ours) parts.push(`${num(ours)} of ${plural(total, "reply", "replies")} so far failed on Cortad's side, not your app's.`);
   const left = Date.parse(d.pace?.endsAt ?? "") - now;
   if (left > 0) parts.push(`About ${plural(Math.ceil(left / 60_000), "minute")} left at the pace your app has answered so far.`);
-  return `For the person: ${parts.join(" ")}`;
+  return parts.join(" ");
 }
 
 export function runText(d) {
@@ -265,7 +274,7 @@ export function runText(d) {
   if (plan) lines.push(plan);
   const offer = productionOffer(d);
   if (offer) lines.push(offer);
-  if (finished(d) && d.url) lines.push(`For the person: the report is at ${d.url}`);
+  if (finished(d) && d.url) lines.push(`The report is at ${d.url}`);
   lines.push(`next: ${nextCall(d)}`);
   return verifyOnceAPage(lines.join("\n"));
 }
@@ -275,7 +284,7 @@ export function runText(d) {
 function productionOffer(d) {
   const v = d.verify;
   if (d.kind !== "verify" || !finished(d) || v?.verdict !== "gone" || !["gone", "less often"].includes(v.heldOut?.moved) || d.field?.connected !== false) return null;
-  return `For the person: the failure in ${v.findingId} is gone on its replays. Connect production to see what your real users are doing as it happens and where your AI still lets them down; field_connect has the steps.`;
+  return `The failure in ${v.findingId} is gone on its replays. Connecting production shows what real users are doing as it happens; field_connect has the steps.`;
 }
 
 export function startedText(d, kind, findingId, said = []) {
@@ -303,7 +312,7 @@ export function waitingText(p, now, limitMs, runner, app) {
   const kind = p.kind === "verify" ? "verify" : "run";
   const waited = `${num((now - Date.parse(p.startedAt)) / 1000)} of up to ${num(limitMs / 1000)} seconds`;
   const head = runner?.state === "up" ? `${answeringText(runner, app)}\nThe ${kind} has waited ${waited}.` : `Your app is still starting for the ${kind}: ${waited}.`;
-  return `${head}\nFor the person: the run has not started yet, after ${waited}.\nnext: run_status pending`;
+  return `${head}\nnext: run_status pending`;
 }
 
 // A spent plan: what the last run found, what was fixed since, what the next run would play.
@@ -314,7 +323,7 @@ export function refusedText(d) {
   if (d.ledger) lines.push(...ledgerLines(d.ledger));
   if (!d.ledger?.plan && d.plans?.length) lines.push(`Plans: ${d.plans.map((p) => `${p.name} $${p.monthlyUsd} a month`).join(", ")}.`);
   lines.push("Nothing ran.");
-  if (d.checkout) lines.push(`For the person: plans and checkout at ${d.checkout}`);
+  if (d.checkout) lines.push(`Plans and checkout are at ${d.checkout}`);
   return lines.join("\n");
 }
 
@@ -392,7 +401,14 @@ function findingsTail(d) {
 function findingsPages(d, budget = PAGE_CHARS - 60) {
   // Unrecorded is not unused (dissection-text.mjs): no tool is said never to have run.
   const unseen = (d.tools ?? d.dissection?.tools)?.recorded === false;
-  const blocks = [...(d.findings ?? []).map((f) => findingBlock(f, unseen)), findingsTail(d)].filter(Boolean);
+  // The findings from their own eval files are headed as theirs, once, where the first one stands.
+  let headed = false;
+  const blocks = [...(d.findings ?? []).map((f) => {
+    const block = findingBlock(f, unseen);
+    if (f.group !== "eval" || headed) return block;
+    headed = true;
+    return `From your own eval files:\n${block}`;
+  }), findingsTail(d)].filter(Boolean);
   const pages = [];
   let page = findingsHead(d);
   let filled = false;
@@ -521,7 +537,7 @@ function alsoLines(f) {
 export function fieldText(d) {
   const t = d.totals;
   const pct = (k, n) => (n ? `${Math.round((100 * k) / n)}%` : "n/a");
-  const link = d.url ? [`For the person: ${d.url}`] : [];
+  const link = d.url ? [`The person sees this at ${d.url}`] : [];
   if (!t || !t.n) return [`No production conversations read in the last ${plural(d.days, "day")}.`, ...link].join("\n");
   const lines = [
     `Production, last ${plural(d.days, "day")}: ${plural(t.n, "conversation")}, ${num(t.read)} read.`,

package/lib/trace.cjs

@@ -17,7 +17,7 @@ if (FILE) {
     const http = require("node:http");
     const https = require("node:https");
     const als = new AsyncLocalStorage();
-    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
+    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
     const row = (value) => { try { fs.appendFileSync(FILE, JSON.stringify(scrubbed(value)) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ } };
     // What the app writes into its own folder while a run is on: each file copied once before its
     // first write, so the command puts every one back when the run ends (lib/writes.mjs). Trials
@@ -798,15 +798,87 @@ if (FILE) {
     // ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
     // background writes is the upgrade when that matters.
     const RUN_LIVE_MS = 10 * 60_000;
+    // The copies this hook makes of Qdrant collections carry this suffix (copyOf below).
+    const OUR_COPY = /_cortad_\d+$/;
     const heldHere = (u, method, headerOf) => {
       const ctx = als.getStore();
       if (!WRITES.test(method) || (ctx ? !ctx.turn : Date.now() - lastTurnAt > RUN_LIVE_MS)) return false;
+      // A read of a Qdrant collection, however its server is named (a bare address holds no word
+      // like qdrant), and any call to a copy this hook made, go out.
+      const q = qdrantCall(u, method);
+      if (q && (!q.write || (q.collection && OUR_COPY.test(q.collection)))) return false;
       try {
         const host = targetOf(u, headerOf);
         if (THIS_MACHINE.test(host) || SANDBOX_HOST.test(host) || isModelCall(u.host, u.pathname) || isRetrieval(u) || TOKEN_PATH.test(u.pathname) || readsByName(method, u.pathname) || KEY_HEADERS.some((name) => testKey(authText(headerOf(name))))) return false;
         return !passNow().some((p) => host === p || host.endsWith("." + p));
       } catch { return true; }
     };
+    // A write to a Qdrant collection made inside a run goes to a copy of that collection on the same
+    // server, made at the first such write: the collection is read page by page and written under
+    // `<name>_cortad_<pid>`, and from then on every call to that collection, reads too, goes to the
+    // copy, so the app finds what it wrote. The original is never written. A copy that cannot be
+    // made (a collection over the size a run copies, a server that refused) leaves the write held
+    // like any other. Each copy is reported as a `copy` row, and the command deletes them when it
+    // ends. A copy of ours is never copied again. ulaim's hosted Qdrant held Run for the person's
+    // yes for seventeen minutes; this is what the yes stood in for.
+    const copies = new Map();
+    // What one process copies at most: collections, and points across them. Past it a write is held
+    // like any other, and the app's output says so once. A run is a few conversations' writes, never
+    // a cluster's.
+    const COPIES_MAX = 8;
+    const POINTS_MAX = 300_000;
+    let copied = 0, pointsCopied = 0;
+    const nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch : null;
+    let qdrantLib = null;
+    const qdrantMod = () => (qdrantLib ??= import(require("node:url").pathToFileURL(require("node:path").join(__dirname, "qdrant.mjs")).href));
+    const inRun = () => { const ctx = als.getStore(); return ctx ? Boolean(ctx.turn) : Date.now() - lastTurnAt <= RUN_LIVE_MS; };
+    // What to do with a call: null to leave it alone; `hold` for a write of the server itself
+    // (/collections/aliases); else the collection's copy when there is one, or none yet for a write
+    // in a run, which makes it.
+    const guarded = (u, method) => {
+      if (!/^https?:$/.test(u.protocol)) return null;
+      const call = qdrantCall(u, method);
+      if (!call) return null;
+      if (!call.collection) return call.write && inRun() ? { hold: true } : null;
+      // The person's own calls, outside a run, go where they were sent: their writes are theirs to keep.
+      if (OUR_COPY.test(call.collection) || !inRun()) return null;
+      const key = `${u.host}|${call.collection}`;
+      const copy = copies.get(key);
+      if (copy) return { key, call, copy };
+      if (!call.write) return null;
+      // A change to the collection's shape, or a write past this process's copy budget, is held.
+      if (call.kind === "schema") return { hold: true };
+      if (copied >= COPIES_MAX || pointsCopied >= POINTS_MAX) { copySay(u.host, call.collection, `this run already copied ${copied} collections, ${pointsCopied} points`); return { hold: true }; }
+      return { key, call, copy: null };
+    };
+    // Said once per collection in the app's own output when no copy could be made and the write was
+    // kept on this machine instead, with the reason the server gave.
+    const copySaid = new Set();
+    const copySay = (host, collection, why) => {
+      if (copySaid.has(`${host}|${collection}`)) return;
+      copySaid.add(`${host}|${collection}`);
+      try { process.stderr.write(`cortad: a request Cortad sent made this app write into the Qdrant collection ${collection} at ${host}. Cortad could not copy that collection on its server (${why}), so the write was kept on this machine and answered with a stand-in success.\n`); } catch { /* no stderr */ }
+    };
+    const toCopy = (u, clone, call) => { const t = new URL(u.href); t.pathname = `/collections/${encodeURIComponent(clone)}${call.rest}`; return t; };
+    // The copy's name, made now when none exists; null when none could be made. The key the app sent
+    // is the key the copy is made with, and never leaves this process.
+    const copyOf = (u, headerOf, g) => {
+      const have = copies.get(g.key);
+      if (have) return Promise.resolve(have);
+      if (!nativeFetch) return Promise.resolve(null);
+      const clone = `${g.call.collection.slice(0, 40)}_cortad_${process.pid}`;
+      const bearer = /^Bearer\s+(\S+)/i.exec(headerOf("authorization") || "");
+      const conn = { base: `${u.protocol}//${u.host}`, apiKey: headerOf("api-key") || (bearer ? bearer[1] : ""), fetch: nativeFetch };
+      const made = qdrantMod().then(({ cloneQdrant }) => cloneQdrant(conn, g.call.collection, clone)).then((got) => {
+        if (!got || got.why) { copies.delete(g.key); copySay(u.host, g.call.collection, got ? got.why : "nothing"); return null; }
+        copied += 1; pointsCopied += got.points ?? 0;
+        copies.set(g.key, clone);
+        row({ copy: { host: u.hostname, base: conn.base, collection: g.call.collection, clone } });
+        return clone;
+      }, (e) => { copies.delete(g.key); copySay(u.host, g.call.collection, e && e.message ? e.message : "error"); return null; });
+      copies.set(g.key, made);
+      return made;
+    };
     // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
     // a SELECT can write through a function) is held.
     // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
@@ -878,23 +950,31 @@ if (FILE) {
             heldWaiting.delete(id);
             const sent = Buffer.concat(parts);
             const text = sent.toString("utf8").slice(0, MAX);
-            // A body that only reads, known now that it is here, goes on to where it was sent, as it was
-            // sent, and its answer comes back through this server.
-            if (w && parts.length < 256 && readsOnly(text, w.u, (name) => String(req.headers[name] || ""), w.port)) {
+            const headerOf = (name) => String(req.headers[name] || "");
+            // The call goes on to where it was sent, as it was sent, or to `to` instead, and its
+            // answer comes back through this server.
+            const forward = (to) => {
               const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
               const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
-              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true };
+              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true, ...(to && !given ? { path: to.pathname + to.search } : {}) };
               // Sent inside the request that asked, so the call is recorded behind that reply.
-              const send = () => (w.secure ? https : http).request(...(given ? [w.args[0], options] : [options]));
+              const send = () => (w.secure ? https : http).request(...(given ? [to ? to.href : w.args[0], options] : [options]));
               const up = w.ctx ? als.run(w.ctx, send) : send();
               up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
               up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
               res.on("close", () => up.destroy());
               return up.end(sent);
-            }
-            if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
-            res.writeHead(200, { "content-type": "application/json" });
-            res.end(heldReply(text, req.headers["content-type"]));
+            };
+            const answer = () => {
+              if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
+              res.writeHead(200, { "content-type": "application/json" });
+              res.end(heldReply(text, req.headers["content-type"]));
+            };
+            // A body that only reads, known now that it is here, goes on as it was sent.
+            if (w && parts.length < 256 && readsOnly(text, w.u, headerOf, w.port)) return forward(null);
+            // A call to a Qdrant collection goes to the run's copy of it, made now when this is its first write.
+            if (w && w.copy) return copyOf(w.u, headerOf, w.copy).then((clone) => (clone ? forward(toCopy(w.u, clone, w.copy.call)) : answer()), answer);
+            answer();
           });
         });
         server[HELD] = true;
@@ -917,12 +997,19 @@ if (FILE) {
       const method = String(o.method || "GET").toUpperCase();
       const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
       const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      return heldHere(u, method, headerOf) ? { u, method, o, args: args.filter((a) => typeof a !== "function"), port: o.port || (given && given.port) || "", cb: args.find((a) => typeof a === "function") } : null;
+      const port = o.port || (given && given.port) || "";
+      // The server's address whole, port included, names a collection's copy; the hold is decided on
+      // the host alone, as before.
+      const at = new URL(u.href);
+      if (port) at.port = String(port);
+      const g = guarded(at, method);
+      if (!g && !heldHere(u, method, headerOf)) return null;
+      return { u: at, method, o, args: args.filter((a) => typeof a !== "function"), port, cb: args.find((a) => typeof a === "function"), ...(g && !g.hold ? { copy: g } : {}) };
     };
     const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb, args, port }, secure) => {
+    const sendHeld = ({ u, method, o, cb, args, port, copy }, secure) => {
       const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure });
+      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure, copy });
       const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
       // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
       const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
@@ -943,15 +1030,31 @@ if (FILE) {
     const bodyText = (body) => (typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : "");
     if (typeof globalThis.fetch === "function") {
       const realFetch = globalThis.fetch;
+      // A call to a Qdrant collection, sent again through this same wrapper at the copy's address, so
+      // it is recorded like any retrieval; held when no copy could be made.
+      const guardedFetch = async (self, wrapped, input, init, u, method, g) => {
+        if (g.hold) return heldFetch(realFetch, input, init);
+        const req = new Request(input, init);
+        const clone = await (typeof g.copy === "string" ? g.copy : copyOf(u, (name) => req.headers.get(name) || "", g));
+        if (!clone) return heldFetch(realFetch, input, init);
+        const body = method === "GET" || method === "HEAD" ? undefined : await req.arrayBuffer();
+        return wrapped.call(self, toCopy(u, clone, g.call).href, { method, headers: req.headers, body, signal: req.signal });
+      };
       globalThis.fetch = function (input, init) {
         let url = null;
         let hold = false;
+        let guard = null;
+        let at = null;
+        let method = "GET";
         try {
           const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input));
+          at = u;
           if (isModelCall(u.host, u.pathname)) url = u;
-          const method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
-          hold = !url && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
+          method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
+          guard = !url ? guarded(u, method) : null;
+          hold = !url && !guard && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
         } catch { /* not a URL we can read */ }
+        if (guard) return guardedFetch(this, globalThis.fetch, input, init, at, method, guard);
         if (hold) return heldFetch(realFetch, input, init);
         if (!url) {
           // Every outbound host, named by the setting that points at it when one does, and by the

package/lib/verbs.mjs

@@ -16,7 +16,7 @@ import { fieldConnectText, fieldText, findingsText, finished, linesOf, notStarte
 // the run before them has its numbers in and its job is still ending: the server holds them until it
 // has, up to the same 45 seconds.
 
-const NOT_CONNECTED = "This folder is not connected to Cortad. Run npx cortad in this folder as a background command: it prints a link for the person to approve.\nFor the person: approve the link npx cortad prints, in a browser where you are signed in to Cortad.";
+const NOT_CONNECTED = "This folder is not connected to Cortad. Run npx cortad in this folder as a background command: it prints a link for the person to approve in a browser where they are signed in to Cortad.";
 const HOLD_S = 45;
 // `wait`: how often it asks whether a run has started, how long the connect command may be gone
 // before no run can start, and how long it waits for one at all.
@@ -193,8 +193,8 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
     return [logSaid(appFailed(d)), back].filter(Boolean).reduce(withBack, runText(withTested(d, id)));
   };
 
-  // `npx cortad wait`: returns when the next run ends, started from the browser or by the agent, with
-  // what it found. A coding agent starts it in the background and is woken when it exits; it is a shell
+  // `npx cortad wait`: returns when the next run or verify ends, started from the browser or by the
+  // agent, with what it found. A coding agent starts it in the background and is woken when it exits; it is a shell
   // verb alone, since an MCP call is cut at about 60 seconds. A run playing when it starts is that run,
   // and so is a finished one the agent has not read: a first run can end before the agent starts this.
   const wait = async () => {
@@ -211,10 +211,13 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
       if ([401, 403, 404].includes(res.status)) return failed(res);
       if (res.ok && id && finished(res.data)) {
         const text = shown(res.data, id).replace(/\nnext: [^\n]*$/, "");
-        return { text: `${text}\nnext: findings ${res.data.jobId ?? id}`, data: res.data };
+        // A verify's verdict is read by run_status; a run's problems by findings.
+        return { text: `${text}\nnext: ${res.data.verify ? `run_status ${id}` : `findings ${res.data.jobId ?? id}`}`, data: res.data };
       }
       const r = res.ok && !id ? res.data?.run : null;
-      if (r?.jobId && r.kind !== "verify" && (!finished(r) || !wasRead(r.jobId))) { id = r.jobId; continue; }
+      // A verify is followed like a run: the agent that started it is woken at its end instead of
+      // polling run_status twelve times a round.
+      if (r?.jobId && (!finished(r) || !wasRead(r.jobId))) { id = r.jobId; continue; }
       // A run being followed holds on the server; a failed call, or no run yet, is asked again later.
       if (!id || !res.ok) await sleep(WAIT_POLL_MS);
     }

package/lib/wire.cjs

@@ -481,6 +481,30 @@ const passagesIn = (sent) => {
 const RETRIEVAL_HOST = /pinecone\.io|qdrant|weaviate|chroma|zilliz|milvus|turbopuffer|upstash\.io|algolia|typesense|meilisearch|elastic|opensearch|vespa|tavily\.com|exa\.ai|serper\.dev|serpapi\.com|search\.brave\.com|bing\.microsoft\.com|jina\.ai/i;
 const RETRIEVAL_PATH = /\/(?:query|search|_search|retrieve|similarity_search|rerank|hybrid)(?:\/|$)|\/points\/(?:search|query)|\/rpc\/match\w*/i;
 const isRetrieval = (u) => RETRIEVAL_HOST.test(u.hostname) || RETRIEVAL_PATH.test(u.pathname);
+// A call to one Qdrant collection, by Qdrant's own REST shape: /collections/{name}[/...]. `write`:
+// the call changes the collection. Every PUT, PATCH and DELETE does; a POST does unless it is one
+// of Qdrant's reads spelled as a POST (search, query, scroll, recommend, discover, count, facet, a
+// retrieve of points by id at /points itself). A path under /collections that names no collection
+// (/collections/aliases) is a write of the server, not of one collection: `collection` is null.
+// `kind`, on a write: "points" changes what the collection holds (an upsert, a delete, a payload or
+// vector change, a batch) and is what a copy stands in for; "create" makes the collection; anything
+// else ("schema": a payload index, an alias, a snapshot, a shard, the collection's own settings or
+// its deletion) changes the collection's shape and is held, never copied. ulaim creates a payload
+// index on every one of its 300 collections at its first request, and copying each of them for
+// that filled its cluster with copies and its searches with 503s.
+const QDRANT_COLLECTION = /^\/collections\/([^/]+)(\/.*)?$/;
+const QDRANT_READ_POST = /^\/points(?:\/(?:search|query|recommend|discover)(?:\/(?:batch|groups))?|\/scroll|\/count|\/facet|\/search\/matrix\/(?:pairs|offsets))?$/;
+const QDRANT_POINTS = /^\/points(?:\/(?:delete|payload|payload\/delete|payload\/clear|vectors|vectors\/delete|batch))?(?:\?.*)?$/;
+const qdrantCall = (u, method) => {
+  const m = QDRANT_COLLECTION.exec(u.pathname);
+  if (!m) return null;
+  const [, name, rest = ""] = m;
+  const collection = name === "aliases" ? null : decodeURIComponent(name);
+  const verb = String(method || "GET").toUpperCase();
+  const write = verb === "PUT" || verb === "PATCH" || verb === "DELETE" || (verb === "POST" && !QDRANT_READ_POST.test(rest));
+  const kind = !write ? null : rest === "" && verb === "PUT" ? "create" : QDRANT_POINTS.test(rest) && verb !== "DELETE" ? "points" : "schema";
+  return { collection, rest, write, kind };
+};
 const PASSAGE_KEY = /^(?:text|content|page_?content|pageContent|chunk|snippet|passage|body|document|documents|description|answer|raw_content|highlights?|excerpt)$/i;
 const passagesFrom = (raw) => {
   const out = [];
@@ -880,6 +904,6 @@ function makeRecorder({ row, rulesFile, onTurn = () => {}, onEnded = () => {} })
 
 module.exports = {
   MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, MODEL_HOST,
-  scrubbed, list, clipped, argsText, turnOf, toolText, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames,
+  scrubbed, list, clipped, argsText, turnOf, toolText, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames,
   fitted, makeRecorder, asChat, GATEWAY_MODEL,
 };

package/local.mjs

@@ -28,7 +28,7 @@ import { changesOf, commandText, RELOADER, sourceOf } from "./lib/fresh.mjs";
 import { chainOf, elapsedMs, holderOf, listening, listenerOn, portInError, spawnTied, stopTree, supervisorOf } from "./lib/proc.mjs";
 import { claimRunner, readRunner, releaseRunner, replaceRunner, startedAtOf, writeRunner } from "./lib/runner.mjs";
 import { registerAll } from "./lib/register.mjs";
-import { machineText } from "./lib/read-text.mjs";
+import { connectedText } from "./lib/read-text.mjs";
 import { VERSION } from "./lib/spec.mjs";
 import { maskedLines, maskWith, secretValues } from "./lib/env-secrets.mjs";
 import { finished, unseenText } from "./lib/text.mjs";
@@ -134,10 +134,11 @@ async function holdProject() {
 // A verb waits on this record from the moment it starts this process, so it is taken first.
 if (viaToken) await holdProject();
 
-// ---- what leaves the machine: the source git would commit, and nothing git is told to ignore
+// ---- what leaves the machine
 const SKIP_DIR = /^(node_modules|\.git|dist|build|out|coverage|vendor|venv|\.venv|env|target|tmp|\.next|\.nuxt|\.turbo|\.cache|__pycache__|\.terraform|\.wrangler|\.svelte-kit|\.output|\.parcel-cache|\.idea|\.vscode|secrets?|\.secrets?)$/i;
 // Env files by any name (scripts/books.env is one), keys, credentials, media and compiled output.
 const SKIP_FILE = /^\.env(\..*)?$|^\.envrc$|\.env$|\.(pem|key|p12|pfx|jks|keystore|sqlite|sqlite3|db|log|lock|map|zip|tar|gz|tgz|7z|rar|png|jpe?g|gif|webp|ico|svg|mp3|mp4|wav|mov|pdf|woff2?|ttf|otf|eot|bin|exe|dll|so|dylib|wasm|onnx|pt|pth|safetensors|numbers|DS_Store)$/i;
+const EVALS = /(?:^|\/)(?:evals?|evaluations?|benchmarks?|gold(?:ens?)?|red[-_]?team)\/|(?:^|[\/._-])(?:evals?|evaluations?|gold(?:en)?|benchmarks?|fidelity|red[-_]?team|cases)(?:[._-][^\/]*)?$/i;
 const MAX_FILE = 25_000_000;
 const MAX_TOTAL = 256_000_000;
 const ENV_FILE = /^\.env(\.(local|staging|stage|development|dev|test|example|sample))?$/;
@@ -178,7 +179,7 @@ function gitListed() {
 function shareable(rel, askGit = true) {
   const parts = rel.split(sep);
   if (parts.slice(0, -1).some((d) => SKIP_DIR.test(d)) || SKIP_FILE.test(parts.at(-1))) return false;
-  if (listed === null || listed.has(rel)) return true;
+  if (listed === null || listed.has(rel) || EVALS.test(parts.join("/"))) return true;
   // Off the list git gave a moment ago: ignored, or inside a nested checkout. The walk takes git's
   // word for it; asking per file was one process each, two minutes on a repository with a worktree
   // inside it. A read asked later, of a file made after the list was taken (an agent edit), asks.
@@ -597,7 +598,9 @@ async function verb(job) {
       } catch { return { text: "", root, size: 0 }; }
     }
     // The person changed what they said yes to while this command runs.
-    case "consent": await allowOutbound(b); return { ok: true };
+    // Said in the terminal: an agent that read "one question for the person" here told them the run
+    // was still waiting two minutes after they had answered.
+    case "consent": await allowOutbound(b); say("the person's answer on the card in the browser arrived"); return { ok: true };
     // A line for the agent reading this terminal: the read of the code landing, said the moment it does.
     // One marked news (a run ending) is also kept for the hook, so an agent that was not listening
     // hears it on its next prompt or edit.
@@ -947,6 +950,7 @@ const keeping = makeKeeping({
   root, work, ledgerFile: join(homeOf(project), "made.json"), onPath, say, hold, typed: Boolean(flag("--start")),
   launch: (plan) => sidecar(plan.cmd, plan.cwd),
   connections: () => capture?.connections() ?? [],
+  copies: () => capture?.copies() ?? [],
   settings: () => {
     const from = {};
     for (const file of envFiles.filter((f) => !/\.(example|sample)$/.test(f))) {
@@ -1196,7 +1200,7 @@ if (explain) {
   ].join("\n"));
   process.exit(0);
 }
-if (kept.length) say(`not uploaded, left on this machine: ${kept.join(", ")}`);
+if (kept.length) say(`left on this machine because it holds a key: ${kept.join(", ")}`);
 const keepSecret = (v) => { if (v && v.length >= 12 && !secrets.includes(v)) secrets.push(v); };
 identities = makeIdentities({ root, work, envFiles, sourceFiles: () => files, say, keepSecret, appDir: () => appDir });
 // A real request that reached their model proves its door (lib/proof.mjs). What it proved goes up,
@@ -1262,7 +1266,8 @@ const firstStart = startApp();
 firstStart.catch(() => { /* appLife reads the failure */ });
 const archive = join(work, "tree.tgz");
 step("connecting");
-await exec("tar", ["-czf", archive, "-C", root, "-T", list]);
+// COPYFILE_DISABLE: a Mac's tar adds no "._name" entries.
+await exec("tar", ["-czf", archive, "-C", root, "-T", list], { env: { ...process.env, COPYFILE_DISABLE: "1" } });
 const bytes = readFileSync(archive);
 const PART = 1_500_000;
 let resumed = false;
@@ -1294,7 +1299,7 @@ stepDone(moved ? "connected: your change is in, and what Cortad read before stil
 if (!viaToken && process.env.CORTAD_NO_REGISTER !== "1") {
   const got = await registerAll().catch((err) => { if (verbose) say(`could not register with your coding agents: ${err?.message ?? err}`); return { clients: [], changed: [] }; });
   const and = (list) => new Intl.ListFormat("en", { type: "conjunction" }).format(list);
-  if (got.changed.length) say(`For the person: ${and(got.clients)} can now use Cortad: its MCP server and skill were added to ${got.changed.map((f) => `~/${f}`).join(", ")}. This repository was not changed.`);
+  if (got.changed.length) say(`${and(got.clients)} can now use Cortad: its tools and skill were added to ${got.changed.map((f) => `~/${f}`).join(", ")}. This repository was not changed.`);
 }
 
 lock = await makeLock({ root, work });
@@ -1386,7 +1391,7 @@ async function appLife(firstStart) {
   say(`your app is answering on port ${app.port}${app.cmd ? ` · ${app.cmd}` : ""}`);
   if (launched) say(`your app's output for this session is kept in ${bootLog}, with the values from your env files masked`);
   if (proxy) say(`send requests to port ${proxy.port}: it passes them to your app and Cortad sees each one. Requests sent straight to port ${app.port} are not seen`);
-  for (const line of machineText(machineOf())) say(line);
+  for (const line of connectedText(machineOf())) say(line);
   say("leave this open. Go back to the browser; Ctrl-C disconnects.");
   let downSince = 0;
   let toldDown = false;
@@ -1516,9 +1521,12 @@ const autoReach = makeAutoReach({
   stampOf: (m) => { try { return m.file ? String(statSync(join(root, m.file)).mtimeMs) : ""; } catch { return ""; } },
   asked: () => existsSync(join(homeOf(project), ASK)),
   report: async (answers) => {
-    if (!answers.length && reachedBox === box) return;
+    if (!answers.length && reachedBox === box) return true;
     const to = box;
-    if ((await call("POST", `/local/${to}/reached`, { answers }, { timeoutMs: 15_000 })).ok) reachedBox = to;
+    // False where the server did not take it: the answers are kept and said again (lib/auto-reach.mjs).
+    const ok = Boolean((await call("POST", `/local/${to}/reached`, { answers }, { timeoutMs: 15_000 }).catch(() => null))?.ok);
+    if (ok) reachedBox = to;
+    return ok;
   },
   say,
   fetchImpl: countedFetch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"