firedrill-run 2.2.4 → 3.0.0

package/dist/cli/src/native/evidence-filter.js

@@ -0,0 +1,255 @@
+/**
+ * client-filtered-v1 evidence profile (Plan20 W09; root native assignment artifacts).
+ *
+ * Root inspects every committed JSON evidence record and refuses the whole
+ * record (`native_evidence_privacy_refused`) when it finds, anywhere in it:
+ *  - depth above 8, more than 4096 values, a dict or list above 100 entries,
+ *    a string above 16000 characters, a key above 128 characters;
+ *  - a key that looks private (password/secret/token/authorization/cookie/
+ *    api_key/private_key/credential as a `_`-separated word), or one of
+ *    thinking/reasoning/system_prompt/provider_configuration;
+ *  - a string (or key) that root's `public_text` would change: known token
+ *    shapes, PEM private keys, or URLs with user info, a query, a fragment, an
+ *    uppercase host or an unusual port; or an `export NAME_TOKEN=value`-style
+ *    line whose name looks private.
+ *
+ * This module rewrites a value so that root's inspection finds none of those,
+ * removing (never guessing at) what it cannot keep, and counts every change.
+ * It is a client filter, not a guarantee: redaction of the plan's declared
+ * secrets still happens first, in the drivers. Regular expressions mirror root's
+ * Python patterns, including Python's Unicode whitespace, digits and case folding.
+ */
+/** Characters Python's `str.isspace()` (and so `re` `\s` on str) treats as whitespace. */
+const WS = '\\t\\n\\v\\f\\r \\x1c-\\x1f\\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000';
+/** Root `privacy.PRIVATE_KEYS` (re.I with Unicode case folding). */
+const PRIVATE_KEYS = /(?:^|_)(?:password|passwd|secret|token|authorization|cookie|api_key|private_key|credential)(?:$|_)/iu;
+const FORBIDDEN_KEYS = new Set(['thinking', 'reasoning', 'system_prompt', 'provider_configuration']);
+/** Root `privacy.KNOWN_VALUES` (Python `\d` matches any Unicode decimal digit). */
+const KNOWN_VALUES = /(?<![A-Za-z0-9_])(?:fd_tool_[a-f0-9-]{36}\.[A-Za-z0-9_-]{64}|(?:sk-ant-api\p{Nd}+-|sk-proj-|sk-svcacct-|gh[pousr]_|github_pat_)[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{16,}|AKIA[A-Z0-9]{16})(?![A-Za-z0-9_-])/gu;
+/** Root `privacy.PRIVATE_PEM`. */
+const PRIVATE_PEM = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g;
+/** Root `privacy.URL`. */
+const URL_PATTERN = new RegExp(`https?://[^${WS}<>"']+`, 'gu');
+/** Root `privacy.ASSIGNMENT` (Python `^` without MULTILINE is the string start). */
+const ASSIGNMENT = new RegExp(`(?:^|\\n)[${WS}]*(?:export[${WS}]+)?([A-Za-z_][A-Za-z0-9_]*)[${WS}]*=[${WS}]*([^${WS}][^\\n]*)`, 'gu');
+export const EVIDENCE_LIMITS = {
+    maxDepth: 8,
+    maxNodes: 4096,
+    maxEntries: 100,
+    maxStringChars: 16_000,
+    maxKeyChars: 128,
+};
+/**
+ * Default value budget the walk enforces. The headroom covers the markers a
+ * container appends after its loop (MARKER_HEADROOM) and a small envelope
+ * around the filtered content. A document with more values outside the content
+ * (an attachment reference) passes `outsideNodes` to shrink the budget.
+ */
+const NODE_BUDGET = EVIDENCE_LIMITS.maxNodes - 32;
+/** Markers added once the budget is spent: at most one per open container (content at depth >= 1, so at most 7). */
+const MARKER_HEADROOM = 8;
+const REDACTED = '[redacted]';
+const PRIVATE_LINK = '[private link]';
+const NESTED = '[nested content omitted]';
+/**
+ * Reduce one URL match to `scheme://host[:port]/path`, which root's URL
+ * cleaning (urlsplit/urlunsplit with no query or fragment) leaves unchanged.
+ * Anything root would parse differently or reject becomes `[private link]`.
+ */
+function reduceUrl(url) {
+    const separator = url.indexOf('://');
+    const scheme = url.slice(0, separator);
+    const rest = url.slice(separator + 3);
+    const end = rest.search(/[/?#]/);
+    const netloc = end === -1 ? rest : rest.slice(0, end);
+    const tail = end === -1 ? '' : rest.slice(end);
+    const pathEnd = tail.search(/[?#]/);
+    const path = pathEnd === -1 ? tail : tail.slice(0, pathEnd);
+    if (netloc.includes('[') || netloc.includes(']'))
+        return PRIVATE_LINK;
+    const hostinfo = netloc.slice(netloc.lastIndexOf('@') + 1);
+    const colon = hostinfo.indexOf(':');
+    const host = (colon === -1 ? hostinfo : hostinfo.slice(0, colon)).toLowerCase();
+    if (!host || !/^[\x21-\x7e]+$/.test(host))
+        return PRIVATE_LINK;
+    let port = '';
+    if (colon !== -1) {
+        const raw = hostinfo.slice(colon + 1);
+        if (!/^[0-9]{1,5}$/.test(raw) || Number(raw) > 65_535)
+            return PRIVATE_LINK;
+        // Root drops port 0 and normalises leading zeros.
+        if (Number(raw) !== 0)
+            port = `:${Number(raw)}`;
+    }
+    return `${scheme}://${host}${port}${path}`;
+}
+/**
+ * Root's `PRIVATE_KEYS.search(name)` under Python semantics: `$` also matches
+ * before one final newline, and `re.I` treats dotless ı and dotted İ as `i`
+ * (JS Unicode case folding does not).
+ */
+function privateName(name) {
+    const folded = name.replace(/[İı]/g, 'i');
+    return PRIVATE_KEYS.test(folded) || (folded.endsWith('\n') && PRIVATE_KEYS.test(folded.slice(0, -1)));
+}
+/** One pass: redact known values and PEM keys, reduce links, redact private-looking assignment lines. */
+function cleanOnce(text) {
+    let value = text.includes('\u0000') ? text.replaceAll('\u0000', '') : text;
+    value = value.replace(PRIVATE_PEM, REDACTED).replace(KNOWN_VALUES, REDACTED).replace(URL_PATTERN, reduceUrl);
+    return value.replace(ASSIGNMENT, (whole, name) => privateName(name) ? `${whole.startsWith('\n') ? '\n' : ''}${REDACTED}` : whole);
+}
+const CLEAN_PASSES = 4;
+const OMITTED = '[content omitted]';
+/**
+ * Clean until nothing changes: one rewrite can create a new match (a lowercased
+ * host forming a token, a redaction completing a PEM block). Text that does not
+ * settle within a few passes is omitted rather than sent for root to refuse.
+ */
+function settle(text) {
+    let value = text;
+    for (let pass = 0; pass < CLEAN_PASSES; pass++) {
+        const next = cleanOnce(value);
+        if (next === value)
+            return value;
+        value = next;
+    }
+    return OMITTED;
+}
+/** Make `text` a fixed point of root's `public_text`, free of private-looking assignments and within `maxChars`. */
+function cleanText(text, stats, maxChars) {
+    let value = settle(text);
+    if (value === OMITTED && value !== text)
+        stats.truncated = (stats.truncated ?? 0) + 1;
+    if (value.length > maxChars) {
+        stats.truncated = (stats.truncated ?? 0) + 1;
+        // UTF-16 length bounds the code-point count root measures; never split a
+        // surrogate pair. The marker is space-separated so it can never join a link,
+        // and the result is cleaned again in case the cut exposed a new match.
+        let cut = Math.max(0, maxChars - 64);
+        if (cut > 0 && /[\uD800-\uDBFF]/.test(value.charAt(cut - 1)))
+            cut -= 1;
+        value = settle(`${value.slice(0, cut)} [truncated]`);
+        if (value.length > maxChars)
+            value = OMITTED;
+    }
+    if (value !== text)
+        stats.rewritten++;
+    return value;
+}
+/** True when root keeps this key as-is; otherwise the entry is removed. */
+function acceptableKey(key) {
+    if (key.length > EVIDENCE_LIMITS.maxKeyChars || privateName(key) || FORBIDDEN_KEYS.has(key))
+        return false;
+    return cleanOnce(key) === key;
+}
+/**
+ * Filter `value` (placed at `depth` inside the evidence document; the document
+ * root is depth 0) so root's inspection accepts it. `budget.nodes` is shared
+ * across one document and counts every value root will visit, up to
+ * `budget.limit`; `budget.maxString` caps each string (root's limit, or less
+ * when a record must shrink to fit).
+ */
+export function filterEvidence(value, depth, budget, stats) {
+    budget.nodes += 1;
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (Number.isFinite(value))
+            return value;
+        stats.truncated = (stats.truncated ?? 0) + 1;
+        stats.removed++;
+        return null;
+    }
+    if (typeof value === 'string')
+        return cleanText(value, stats, budget.maxString);
+    if (typeof value !== 'object') {
+        stats.truncated = (stats.truncated ?? 0) + 1;
+        stats.removed++;
+        return null;
+    }
+    const entries = Array.isArray(value) ? value.length : Object.keys(value).length;
+    // Children of a container at the maximum depth would exceed it, and so would
+    // any child once the document's value budget is spent.
+    if (entries > 0 && (depth >= EVIDENCE_LIMITS.maxDepth || budget.nodes >= budget.limit)) {
+        stats.truncated = (stats.truncated ?? 0) + 1;
+        stats.removed++;
+        return NESTED;
+    }
+    if (Array.isArray(value)) {
+        const out = [];
+        for (let index = 0; index < value.length; index++) {
+            const lastSlot = out.length === EVIDENCE_LIMITS.maxEntries - 1 && value.length - index > 1;
+            if (lastSlot || budget.nodes >= budget.limit) {
+                stats.truncated = (stats.truncated ?? 0) + 1;
+                budget.nodes += 1;
+                stats.removed++;
+                out.push(`[${value.length - index} more items omitted]`);
+                break;
+            }
+            out.push(filterEvidence(value[index], depth + 1, budget, stats));
+        }
+        return out;
+    }
+    const source = value;
+    const out = {};
+    const keys = Object.keys(source);
+    let kept = 0, dropped = 0;
+    for (let index = 0; index < keys.length; index++) {
+        const key = keys[index];
+        if (!acceptableKey(key) || key === 'omitted_entries') {
+            if (key.length > EVIDENCE_LIMITS.maxKeyChars || key === 'omitted_entries')
+                stats.truncated = (stats.truncated ?? 0) + 1;
+            dropped++;
+            continue;
+        }
+        if ((kept === EVIDENCE_LIMITS.maxEntries - 1 && keys.length - index > 1) || budget.nodes >= budget.limit) {
+            stats.truncated = (stats.truncated ?? 0) + 1;
+            dropped += keys.length - index;
+            break;
+        }
+        // defineProperty keeps a `__proto__` key an ordinary entry instead of replacing the prototype.
+        Object.defineProperty(out, key, { value: filterEvidence(source[key], depth + 1, budget, stats), enumerable: true, writable: true, configurable: true });
+        kept++;
+    }
+    // The 100th key is kept only when it is the last one; make room for the count.
+    if (dropped > 0 && kept === EVIDENCE_LIMITS.maxEntries) {
+        stats.truncated = (stats.truncated ?? 0) + 1;
+        delete out[keys[keys.length - 1]];
+        dropped++;
+        kept--;
+    }
+    if (dropped > 0) {
+        // Root sees how many entries were removed, never their names or values.
+        stats.removed += dropped;
+        budget.nodes += 1;
+        out.omitted_entries = dropped;
+    }
+    return out;
+}
+/**
+ * Filter one evidence value placed at `depth` in its document. `outsideNodes`
+ * counts the values the document holds outside this one (envelope fields, an
+ * attachment reference); the budget leaves room for them and for the markers,
+ * and never exceeds the default.
+ */
+export function filterEvidenceValue(value, depth, maxStringChars = EVIDENCE_LIMITS.maxStringChars, outsideNodes = 0) {
+    const stats = { removed: 0, rewritten: 0 };
+    const maxString = Math.max(64, Math.min(EVIDENCE_LIMITS.maxStringChars, Math.floor(maxStringChars)));
+    const outside = Number.isSafeInteger(outsideNodes) && outsideNodes > 0 ? outsideNodes : 0;
+    const limit = Math.max(1, Math.min(NODE_BUDGET, EVIDENCE_LIMITS.maxNodes - MARKER_HEADROOM - outside));
+    return { value: filterEvidence(value, depth, { nodes: 0, limit, maxString }, stats), stats };
+}
+/** How many values root's inspection visits in `value`: one per value, containers included. */
+export function evidenceNodes(value) {
+    let nodes = 0;
+    const stack = [value];
+    while (stack.length) {
+        const item = stack.pop();
+        nodes += 1;
+        if (Array.isArray(item))
+            stack.push(...item);
+        else if (item !== null && typeof item === 'object')
+            stack.push(...Object.values(item));
+    }
+    return nodes;
+}

package/dist/cli/src/native/isolated-access.js

@@ -0,0 +1,241 @@
+import { request as httpsRequest } from 'node:https';
+import { api } from '../auth.js';
+import { CliError } from '../http.js';
+import { toolConnectionReads } from '../tool-connection-reads.js';
+import { toolLifecycleReads } from '../tool-lifecycle-reads.js';
+import { toolConnectionAccepted, toolConnectionMatches, toolConnectionTokenMatches, } from '../tool-connection-contracts.js';
+import { SecretValue } from './contracts.js';
+import { isTransient } from './control-plane.js';
+import { header } from './dependency-proxy.js';
+/** Connection-option pages read per instance (25 operations per page). */
+const OPTION_PAGES = 40;
+/** Root's operation argument limit plus its JSON envelope. */
+export const ISOLATED_BODY_MAX_BYTES = 8 * 1_048_576 + 65_536;
+/** A whole answer streamed back: root's 16 MiB response, base64-encoded, plus envelope. */
+const ISOLATED_RESPONSE_MAX_BYTES = 24 * 1_048_576;
+/** An MCP tools/call streams for up to 90 seconds with heartbeats before root answers. */
+const STREAM_TIMEOUT_MS = 150_000;
+/** Own time for finding and revoking a grant, also after the command was cancelled. */
+export const CLEANUP_MS = 15_000;
+/** Effects that never change the tool's state. */
+const READ_EFFECTS = new Set(['read', 'none']);
+/** Request headers an MCP client sends that root's gateway reads. Nothing else (no cookie, no Origin) is passed on. */
+export const MCP_REQUEST_HEADERS = ['accept', 'content-type', 'mcp-session-id', 'mcp-protocol-version'];
+/** Response headers passed back. Root's 401 challenge is not: the agent authenticates to this proxy, never to root. */
+export const MCP_RESPONSE_HEADERS = ['content-type', 'mcp-session-id', 'allow', 'retry-after'];
+export const OPERATION_RESPONSE_HEADERS = ['content-type', 'allow', 'retry-after'];
+const connectionScope = (scope, instance, epoch) => ({ workspace: scope.workspace, actor: scope.owner, instance, epoch });
+/**
+ * Issue one grant for an isolated child: the selected operations the human's
+ * mode allows (read-only unless writes were allowed), over HTTP and MCP, for the
+ * instance's remaining time. `requestKey` is the original Idempotency-Key, which
+ * the caller keeps (and reports) before this sends anything. Throws a CliError
+ * naming why it is not served.
+ */
+export async function openIsolatedGrant(scope, input) {
+    const instance = await toolLifecycleReads(scope, input.signal).instance(input.instanceId);
+    if (!instance.observation_current)
+        throw new CliError('tool_instance_not_ready', 'This isolated tool has no current observation yet. Run tools access again shortly.', 2);
+    const connections = toolConnectionReads(scope, input.instanceId, input.signal);
+    const effects = new Map();
+    let duration = 0;
+    for (let page = 1; page <= OPTION_PAGES; page++) {
+        const choices = await connections.options(page, '', instance.state_epoch);
+        duration = choices.duration_seconds;
+        for (const one of choices.results)
+            if (one.service_key === input.serviceKey)
+                effects.set(one.operation_name, one.effect);
+        if (!choices.next)
+            break;
+    }
+    const allowed = input.operations.filter((name) => effects.has(name) && (input.mode === 'interactive' || READ_EFFECTS.has(effects.get(name))));
+    if (!allowed.length) {
+        throw new CliError('tool_operations_unavailable', input.mode === 'read'
+            ? 'None of its selected operations is read-only. Add --allow-writes only if the human asked for writes.'
+            : 'None of its selected operations can be connected.', 2);
+    }
+    if (duration < 60)
+        throw new CliError('tool_instance_ending', 'It has less than a minute left.', 2);
+    const permission = {
+        operations: allowed.map((operation_name) => ({ service_key: input.serviceKey, operation_name })),
+        protocols: ['http', 'mcp'], duration_seconds: duration,
+    };
+    const key = input.requestKey;
+    const path = `/api/workspaces/${scope.workspace}/tools/instances/${input.instanceId}/connections`;
+    const auth = { actor: scope.owner, workspace: scope.workspace, signal: input.signal };
+    let issued;
+    try {
+        issued = await api(path, { ...auth, method: 'POST', idempotencyKey: key, body: { ...permission, data_transfer_consent: true } });
+    }
+    catch (error) {
+        // An answered refusal created nothing. No answer, or a cancellation while it was being sent, may have
+        // created it: its token cannot be recovered, so the original is found and revoked on its own bounded
+        // time (the command's signal may already be aborted), and nothing is reissued.
+        if (error instanceof CliError && error.httpStatus !== null && !isTransient(error))
+            throw error;
+        const cleanup = AbortSignal.timeout(CLEANUP_MS);
+        const original = await toolConnectionReads(scope, input.instanceId, cleanup).original(key, { input: permission }).catch(() => null);
+        const revoked = original ? await revokeGrant(scope, input.instanceId, original.id, cleanup) : false;
+        throw new CliError('tool_connection_unconfirmed', `Its connection was not confirmed (request ${key}), and no replacement was requested. `
+            + (original ? (revoked ? `It had been created as ${original.id} and is now revoked.` : `It was created as ${original.id}; revoke it with firedrill tools disconnect ${input.instanceId} ${original.id} --approve-tool-change.`)
+                : `Whether it was created is unknown. If it was, find it with firedrill tools connections ${input.instanceId} and revoke it.`) + ' Run tools access again to connect it.');
+    }
+    const matches = await toolConnectionAccepted(issued, connectionScope(scope, input.instanceId, instance.state_epoch), key, permission).catch(() => false)
+        && toolConnectionTokenMatches(issued) && issued.token_available_once && typeof issued.token === 'string'
+        && issued.mcp_url !== null && issued.http_url !== null && !issued.revoked_at;
+    if (!matches) {
+        const id = typeof issued?.id === 'string' ? issued.id : null;
+        const revoked = id ? await revokeGrant(scope, input.instanceId, id, AbortSignal.timeout(CLEANUP_MS)) : false;
+        throw new CliError('native_response_unconfirmed', 'Its connection response could not be confirmed, so it is not served'
+            + (id ? (revoked ? ' and was revoked.' : `; revoke it with firedrill tools disconnect ${input.instanceId} ${id} --approve-tool-change.`) : '.'));
+    }
+    return {
+        instance_id: input.instanceId, service_key: input.serviceKey, grant_id: issued.id, request_key: key, expires_at: issued.expires_at,
+        state_epoch: issued.state_epoch,
+        operations: issued.operations.map((one) => ({ service_key: one.service_key, operation_name: one.operation_name })),
+        token: new SecretValue(issued.token, `tool-connection:${issued.id}`),
+        mcp_url: issued.mcp_url, operations_url: issued.http_url, requests_url: `${issued.audience}/requests`,
+    };
+}
+/** Revoke a grant this access issued; true only when root confirms the revocation. */
+export async function revokeGrant(scope, instanceId, grantId, signal) {
+    try {
+        const row = await api(`/api/workspaces/${scope.workspace}/tools/instances/${instanceId}/connections/${grantId}`, { actor: scope.owner, workspace: scope.workspace, signal, method: 'DELETE' });
+        return toolConnectionMatches(row, connectionScope(scope, instanceId), { id: grantId, revoked: true });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a served grant can still be used, after root refused a call with it.
+ * Root answers 401 for a revoked or expired grant, a reset or ended instance,
+ * and also for an operation or original request outside the grant, so a 401
+ * alone never ends an entry: this reads the grant and the instance. `unknown`
+ * when either read fails for another reason (the entry keeps being served and
+ * root keeps refusing what it must).
+ */
+export async function isolatedGrantState(scope, grant, signal) {
+    try {
+        const row = await toolConnectionReads(scope, grant.instance_id, signal).original(grant.request_key, { id: grant.grant_id });
+        if (row.revoked_at || !(Date.parse(row.expires_at) > Date.now()))
+            return 'connection_ended';
+    }
+    catch (error) {
+        if (error instanceof CliError && (error.httpStatus === 404 || error.httpStatus === 410))
+            return 'connection_ended';
+        return 'unknown';
+    }
+    try {
+        const instance = await toolLifecycleReads(scope, signal).instance(grant.instance_id);
+        return instance.state === 'active' && !instance.terminal_at && instance.state_epoch === grant.state_epoch ? 'usable' : 'instance_ended';
+    }
+    catch (error) {
+        if (error instanceof CliError && (error.httpStatus === 404 || error.httpStatus === 410))
+            return 'instance_ended';
+        return 'unknown';
+    }
+}
+/** The request body, or null once it exceeds `limit` (the rest is drained, not buffered). */
+export function readBounded(request, limit) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0, over = false;
+        request.on('data', (chunk) => {
+            if (over)
+                return;
+            size += chunk.length;
+            if (size > limit) {
+                over = true;
+                chunks.length = 0;
+                resolve(null);
+                return;
+            }
+            chunks.push(chunk);
+        });
+        request.once('end', () => { if (!over)
+            resolve(Buffer.concat(chunks)); });
+        request.once('error', reject);
+    });
+}
+/** The named request headers that are present once, as given. */
+export function pickHeaders(request, names) {
+    const picked = {};
+    for (const name of names) {
+        const value = request.headers[name];
+        if (typeof value === 'string')
+            picked[name] = value;
+    }
+    return picked;
+}
+/**
+ * One call to the grant's endpoint, its answer streamed back as it arrives
+ * (an MCP tools/call answers as an event stream). Only `passBack` response
+ * headers are returned. Never retried: root keys each operation by its original
+ * request, and a disconnect after acceptance neither cancels nor repeats it.
+ * Returns root's status once its answer started, or `unanswered`: nothing came
+ * back, so the call may or may not have taken effect.
+ */
+export function forwardIsolated(input) {
+    return new Promise((resolve) => {
+        let target;
+        try {
+            target = new URL(input.url);
+        }
+        catch {
+            resolve('unanswered');
+            return;
+        }
+        if (target.protocol !== 'https:' || target.username || target.password || target.hash) {
+            resolve('unanswered');
+            return;
+        }
+        const headers = { ...input.headers, authorization: `Bearer ${input.token.reveal()}` };
+        if (input.body)
+            headers['content-length'] = String(input.body.length);
+        let done = false, status = 0;
+        const finish = (value) => { if (!done) {
+            done = true;
+            resolve(value === 'sent' ? status : value);
+        } };
+        const upstream = httpsRequest(target, { method: input.method, headers, signal: AbortSignal.any([input.signal, AbortSignal.timeout(STREAM_TIMEOUT_MS)]) }, (reply) => {
+            const passed = { 'cache-control': 'no-store', ...input.extra };
+            for (const name of input.passBack) {
+                const value = header(reply.headers, name);
+                if (value !== null)
+                    passed[name] = value;
+            }
+            status = reply.statusCode ?? 502;
+            input.response.writeHead(status, passed);
+            let size = 0;
+            reply.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > ISOLATED_RESPONSE_MAX_BYTES) {
+                    reply.destroy();
+                    input.response.destroy();
+                    finish('sent');
+                    return;
+                }
+                if (!input.response.write(chunk)) {
+                    reply.pause();
+                    input.response.once('drain', () => reply.resume());
+                }
+            });
+            reply.once('end', () => { input.response.end(); finish('sent'); });
+            reply.once('error', () => { input.response.destroy(); finish('sent'); });
+            reply.once('aborted', () => { input.response.destroy(); finish('sent'); });
+        });
+        // The agent hung up: stop reading. Root keeps an accepted operation; nothing is cancelled or repeated.
+        input.response.once('close', () => { if (!done)
+            upstream.destroy(); });
+        upstream.once('error', () => {
+            if (status) {
+                input.response.destroy();
+                finish('sent');
+            }
+            else
+                finish('unanswered');
+        });
+        upstream.end(input.body ?? undefined);
+    });
+}