orcareplay 0.2.2 → 0.2.4

package/dist/commands/quickstart.js

@@ -0,0 +1,373 @@
+import { execFile } from 'node:child_process';
+import { cp, mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { parseArgs } from '../args.js';
+import { Output } from '../out.js';
+import { replayCommand } from './replay.js';
+import { showCommand } from './inspect.js';
+/**
+ * The first two minutes, with nothing installed and nothing spent.
+ *
+ * Everything orca does well is visual — a timeline, a causal chain, a comparison — and none of it
+ * can be seen until a run exists. Producing one costs an agent, a key, a network and real tokens,
+ * so the shortest honest path from `npm i` to "oh, I see what this is" ran through four things a
+ * person has to arrange first. Most of them do not.
+ *
+ * So the package carries a run. A real one: a small agent, a real model, a genuine bug in
+ * timezone arithmetic that it genuinely fixes. `quickstart` puts the project and the recording
+ * somewhere, then replays the recording against the project with the network off — which is the
+ * product's own guarantee doing the work of its own demonstration.
+ *
+ * The agent it was recorded from is a Node script that ships with it, which is the reason replay
+ * needs nothing installed: orca already requires the runtime that agent runs on.
+ *
+ * The default output fits on one screen, and that is the whole design of it. The first version
+ * printed the full timeline and the replayed agent's own chatter — sixty-eight lines, with the
+ * failing test count and the passing one fifty lines apart. The comparison is the point, and a
+ * comparison you have to scroll between is not one. `--full` still prints everything.
+ */
+/** Where the shipped asset lives, relative to the built `dist/commands/`. */
+const ASSET = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'quickstart');
+const DEFAULT_DIR = 'orca-quickstart';
+const exec = promisify(execFile);
+async function events() {
+    const jsonl = await readFile(join(ASSET, 'trace', 'events.jsonl'), 'utf8');
+    return jsonl
+        .split('\n')
+        .filter((l) => l.trim())
+        .map((l) => JSON.parse(l));
+}
+/** Read the run id out of the shipped trace, so nothing has to hardcode it. */
+async function shippedRunId() {
+    const manifest = JSON.parse(await readFile(join(ASSET, 'trace', 'manifest.json'), 'utf8'));
+    const id = manifest.run_id;
+    if (id === undefined)
+        throw new Error('the shipped quickstart trace has no run_id');
+    return id;
+}
+/**
+ * Whether it is safe to write a project into this path.
+ *
+ * Only a missing path counts as free. Swallowing every error meant a path that exists and is not a
+ * directory read as empty, so `orca quickstart --dir notes.txt` skipped the sentence that explains
+ * the problem and surfaced `ENOTDIR: not a directory, mkdir` from three lines further on.
+ */
+async function isEmptyish(dir) {
+    try {
+        return (await readdir(dir)).length === 0;
+    }
+    catch (err) {
+        return err.code === 'ENOENT';
+    }
+}
+/**
+ * Tell the trace where it now lives.
+ *
+ * The shipped manifest names a neutral directory, because a trace records the absolute path it was
+ * captured in and publishing one on npm would publish that. But `replay` compares that path against
+ * the directory it is running in, and on a mismatch it declines to restore the recorded filesystem
+ * — correctly, since restoring a stranger's tree over yours is not a thing to do on a guess.
+ *
+ * Left alone, that lands on the first person who follows the tour. `orca quickstart` replays with
+ * `--in-place` and is unaffected, but the obvious next thing to type is the command from the top of
+ * the README, and `orca replay last` in the quickstart directory reported `exact=1` with two
+ * divergences and a warning — the flagship guarantee failing on the second look, against a tree the
+ * first replay had already changed.
+ *
+ * So the path is rewritten as the trace is placed. The asset on npm stays neutral, and the copy on
+ * disk is honest about where it is. Safe to edit because the integrity digest covers
+ * `events.jsonl`, and the replay matcher reads request bodies — neither reads this field.
+ */
+async function adoptTrace(runDir, target) {
+    const path = join(runDir, 'manifest.json');
+    const manifest = JSON.parse(await readFile(path, 'utf8'));
+    manifest['cwd'] = target;
+    await writeFile(path, `${JSON.stringify(manifest, null, 2)}
+`, 'utf8');
+}
+/**
+ * The project's own test suite, summarised.
+ *
+ * Run before and after, because the arc is the demo: two tests fail, a recording of an agent
+ * fixing them is replayed with the network off, and the same two pass. Telling someone to go and
+ * check afterwards does not work — by then the replay has already written the fix, so the
+ * instruction to "see two failures" would show them four passes.
+ */
+async function testSummary(dir) {
+    let tap = '';
+    try {
+        // The reporter is named, and the environment that could name a second one is taken away.
+        //
+        // The counts are read out of TAP, and node picks its reporter from the ambient default and
+        // from `NODE_OPTIONS`. A developer with `--test-reporter=spec` set — an ordinary thing to have
+        // — got `? passing, ? failing` for both halves of the before-and-after, from a command that
+        // still reported success. Naming `tap` on the command line does not fix that on its own:
+        // reporters accumulate, and two of them with one destination makes node refuse to start at
+        // all. So the variable goes, which is right regardless — this is orca running a fixed test
+        // file of its own to read two numbers out of it, not the user running their suite.
+        ({ stdout: tap } = await exec(process.execPath, ['--test', '--test-reporter=tap', 'test/schedule.test.js'], { cwd: dir, env: withoutNodeOptions(process.env) }));
+    }
+    catch (err) {
+        tap = err.stdout ?? '';
+    }
+    const pass = /^# pass (\d+)/m.exec(tap)?.[1] ?? '?';
+    const fail = /^# fail (\d+)/m.exec(tap)?.[1] ?? '?';
+    const failing = tap
+        .split('\n')
+        .filter((l) => l.startsWith('not ok'))
+        .map((l) => l.replace(/^not ok \d+ - /, ''));
+    return { line: `${pass} passing, ${fail} failing`, failing };
+}
+/** A copy of the environment with `NODE_OPTIONS` removed. */
+function withoutNodeOptions(env) {
+    const copy = { ...env };
+    delete copy['NODE_OPTIONS'];
+    return copy;
+}
+/** What the recording did, in three lines rather than nineteen. */
+export function recordingSummary(all) {
+    const turns = all.filter((e) => e.type === 'model.response');
+    const model = String(turns[0]?.attrs?.['model'] ?? 'a model').replace(/-\d{4}-\d{2}-\d{2}$/, '');
+    const tokensIn = turns.reduce((n, e) => n + Number(e.attrs?.['input_tokens'] ?? 0), 0);
+    const tokensOut = turns.reduce((n, e) => n + Number(e.attrs?.['output_tokens'] ?? 0), 0);
+    const read = new Set();
+    for (const e of all) {
+        if (e.type !== 'tool.call')
+            continue;
+        const input = e.attrs?.['input'];
+        if (e.attrs?.['name'] === 'read_file' && input?.path)
+            read.add(input.path);
+    }
+    // Straight off each event. Reading the path out and then looking the event back up gives two
+    // changes to one file the *first* one's counts twice, which is a summary that quietly lies.
+    const wrote = all
+        .filter((e) => e.type === 'fs.change')
+        .map((e) => {
+        const a = e.attrs ?? {};
+        return `${String(a['path'])} (+${a['insertions']} −${a['deletions']})`;
+    });
+    const lines = [
+        `${all.length} events · ${turns.length} model turns · ${model} · ${tokensIn.toLocaleString()} in · ${tokensOut.toLocaleString()} out`,
+    ];
+    if (read.size > 0)
+        lines.push(`read ${[...read].join(', ')}`);
+    if (wrote.length > 0)
+        lines.push(`wrote ${wrote.join(', ')}`);
+    return lines;
+}
+/** Files the recording changed on disk. */
+function writtenPaths(all) {
+    return all
+        .filter((e) => e.type === 'fs.change')
+        .map((e) => String(e.attrs?.['path']))
+        .filter((p) => p !== 'undefined');
+}
+/**
+ * What the model said, from the recording rather than from the replayed process.
+ *
+ * Trimmed to its first sentences and labelled. Unlabelled, eleven lines of an assistant explaining
+ * daylight saving read as orca talking — and the recorded reply ends with "If you want, I can also
+ * explain the DST edge case in more detail", which in an offline replay invites the obvious
+ * question of who it is addressed to.
+ */
+export function modelSaid(all, lines) {
+    const alreadySaid = writtenPaths(all);
+    for (const e of [...all].reverse()) {
+        if (e.type !== 'model.response' || !e.payload)
+            continue;
+        try {
+            const body = JSON.parse(e.payload);
+            const text = body.choices?.[0]?.message?.content;
+            if (!text)
+                continue;
+            const kept = text
+                .split('\n')
+                .map((l) => l.trim())
+                .filter(Boolean)
+                // Two lines of excerpt is no place to repeat what the summary three lines above already
+                // said. A section header on its own carries nothing, and "Fixed src/schedule.js." is the
+                // `wrote src/schedule.js` line again — the excerpt is here for the why, not the what.
+                .filter((l) => lines > 4 || (!l.endsWith(':') && !restatesTheSummary(l, alreadySaid)))
+                .map((l) => (lines > 4 ? l : plain(l)));
+            return kept.slice(0, lines);
+        }
+        catch {
+            return [];
+        }
+    }
+    return [];
+}
+/**
+ * Whether a line only names a file the summary has already reported as written.
+ *
+ * Short and path-shaped: "Fixed `src/schedule.js`." carries nothing the `wrote` line above did not,
+ * and length is what separates it from a sentence that happens to mention the same file while
+ * saying something about it.
+ */
+function restatesTheSummary(line, written) {
+    const flat = plain(line);
+    return flat.length < 60 && written.some((p) => flat.includes(p));
+}
+/**
+ * The excerpt as it is printed: a label and its lines, or nothing at all.
+ *
+ * Nothing at all is a real outcome, not a defensive branch. The lines are filtered — section
+ * headers dropped, restatements of the file the summary already reported dropped — so a reply made
+ * entirely of those leaves the label standing over empty space, which reads as output that went
+ * missing rather than as output that was never worth printing.
+ */
+export function excerptBlock(all, lines) {
+    const said = modelSaid(all, lines);
+    if (said.length === 0)
+        return [];
+    return [
+        '              the model, out of the recording:',
+        ...said.map((l) => `                ${l}`),
+    ];
+}
+/** Markdown emphasis and bullet syntax removed, clipped to something a terminal can hold. */
+function plain(line) {
+    const flat = line
+        .replace(/^[-*]\s+/, '')
+        .replace(/\*\*(.+?)\*\*/g, '$1')
+        .replace(/`(.+?)`/g, '$1');
+    return flat.length > 84 ? `${flat.slice(0, 83)}…` : flat;
+}
+/**
+ * Whether the replay demonstrated the thing, rather than merely failing to fail.
+ *
+ * `turns > 0` is the clause that is easy to leave out and is the whole point. Without it an empty
+ * recording makes `0 === 0` true, and the command congratulates itself on a run that never
+ * happened — which is what it did, over a project whose tests were still red, until a directory
+ * with a space in its name stopped the agent from starting at all.
+ */
+export function replayDemonstrated(turns, served, unmatched) {
+    return turns > 0 && served === turns && unmatched === 0;
+}
+export async function quickstartCommand(args, out, cwd = process.cwd()) {
+    const target = resolve(cwd, args.str('dir') ?? DEFAULT_DIR);
+    const full = args.bool('full');
+    const runId = await shippedRunId();
+    // Refusing rather than merging: this writes a source tree and a trace, and quietly mixing those
+    // into a directory someone already has work in is the kind of help nobody asks for twice.
+    if (!(await isEmptyish(target))) {
+        throw new Error(`${target} already exists and is not an empty directory\n` +
+            '  pick somewhere else: orca quickstart --dir <path>');
+    }
+    await mkdir(join(target, '.orca', 'runs'), { recursive: true });
+    await cp(join(ASSET, 'project'), target, { recursive: true });
+    const runDir = join(target, '.orca', 'runs', runId);
+    await cp(join(ASSET, 'trace'), runDir, { recursive: true });
+    await adoptTrace(runDir, target);
+    const all = await events();
+    const before = await testSummary(target);
+    out.info('quickstart.ready', { dir: target, run: runId });
+    out.plain('');
+    out.plain('  A reminder scheduler with a bug in it, and a recording of an agent fixing it.');
+    out.plain('  Nothing here needs a key, a network, or an agent installed.');
+    out.plain('');
+    out.plain(`  Before      ${before.line}`);
+    for (const f of before.failing)
+        out.plain(`                  ✗ ${f}`);
+    out.plain('');
+    const summary = recordingSummary(all);
+    out.plain(`  Recorded    ${summary[0]}`);
+    for (const l of summary.slice(1))
+        out.plain(`              ${l}`);
+    out.plain('');
+    const replayed = await runReplay(target, runId, out, full);
+    // The denominator is the recording's, not the replay's. `matchedExact + unmatched` is the number
+    // of turns the replay was asked about, which is zero when the agent never started — and `0/0`
+    // reads like a pass. Counting the model turns in the trace makes that case print `0/3`.
+    const turns = all.filter((e) => e.type === 'model.response').length;
+    const ok = replayDemonstrated(turns, replayed.matchedExact, replayed.unmatched);
+    if (full)
+        out.plain('');
+    out.plain(`  Replayed    ${replayed.matchedExact}/${turns} turns from the trace · ` +
+        `${replayed.divergences} divergences · ${replayed.liveCalls} live calls · network blocked`);
+    out.plain('');
+    const excerpt = excerptBlock(all, full ? 40 : 2);
+    if (excerpt.length > 0) {
+        for (const line of excerpt)
+            out.plain(line);
+        out.plain('');
+    }
+    const after = await testSummary(target);
+    out.plain(`  After       ${after.line}`);
+    out.plain('');
+    // Said rather than hidden, and reflected in the exit code: a quickstart that quietly reports a
+    // success it did not have teaches the opposite of the guarantee it exists to demonstrate.
+    if (ok) {
+        out.plain('  Nothing above talked to a model. The fix came out of the recording.');
+    }
+    else if (replayed.matchedExact === 0) {
+        out.plain(`  The replay served none of the ${turns} recorded turns — the agent did not run.`);
+        out.plain('  Re-run with --full to see what it printed.');
+    }
+    else {
+        out.plain(`  ${replayed.unmatched} turn(s) could not be served from the recording.`);
+    }
+    out.plain('');
+    out.plain(`  cd ${target}`);
+    out.plain('');
+    // `orca` is on PATH only after a global install. Saying so here rather than letting someone
+    // meet `command not found` as the next thing that happens to them.
+    out.plain('  See it      orca ui                       # the timeline, in a browser');
+    out.plain('  Dig in      orca show · orca graph · orca export -o run.html');
+    out.plain('  Your own    orca record claude -- -p "..."');
+    out.plain('');
+    out.plain('  Installed locally rather than with -g? Put npx in front: npx orca ui');
+    if (!full)
+        out.plain('  --full for the whole timeline and the replay as it happened.');
+    return {
+        dir: target,
+        runId,
+        unmatched: replayed.unmatched,
+        turns,
+        served: replayed.matchedExact,
+        ok,
+    };
+}
+/**
+ * Replay the shipped run, printing everything or nothing.
+ *
+ * `--full` calls the command in process, so the timeline and the replayed agent's own output land
+ * on the terminal exactly as they would from `orca replay`.
+ *
+ * The default passes `--json`, which is what `replay` already keys its quiet mode on: the agent is
+ * spawned with inherited stdio, so under anything else its output reaches the terminal without
+ * passing through something orca could filter. The result document goes to a discarded `Output`,
+ * and this command prints the two numbers worth reading instead.
+ *
+ * Not a child process. Spawning `../cli.js` resolves from `dist` and not from source, which is a
+ * split between how the tests run this and how a user does — and a path that only works in one of
+ * those is the shape of bug this project keeps finding in other people's harnesses.
+ */
+async function runReplay(target, runId, out, full) {
+    if (full) {
+        out.plain('── the recording ──────────────────────────────────');
+        out.plain('');
+        await showCommand(parseArgs(['show', runId]), out, target);
+        out.plain('');
+        out.plain('── replaying it, offline ──────────────────────────');
+        out.plain('');
+        const result = await replayCommand(parseArgs(['replay', runId, '--in-place']), out, target);
+        return {
+            matchedExact: result.matchedExact,
+            unmatched: result.unmatched,
+            divergences: result.divergences,
+            liveCalls: result.liveCalls,
+        };
+    }
+    const quiet = new Output({ write: () => { }, color: false, ci: true });
+    const result = await replayCommand(parseArgs(['replay', runId, '--in-place', '--json', '--quiet']), quiet, target);
+    return {
+        matchedExact: result.matchedExact,
+        unmatched: result.unmatched,
+        divergences: result.divergences,
+        liveCalls: result.liveCalls,
+    };
+}
+//# sourceMappingURL=quickstart.js.map

package/dist/commands/quickstart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quickstart.js","sourceRoot":"","sources":["../../src/commands/quickstart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,6EAA6E;AAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAEtF,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAQjC,KAAK,UAAU,MAAM;IACnB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,YAAY;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAExF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACpF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IACrF,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACzB,MAAM,SAAS,CACb,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;CACvC,EACG,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,yFAAyF;QACzF,EAAE;QACF,2FAA2F;QAC3F,+FAA+F;QAC/F,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,mFAAmF;QACnF,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAC3B,OAAO,CAAC,QAAQ,EAChB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,EAC1D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,GAAI,GAA2B,CAAC,MAAM,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,6DAA6D;AAC7D,SAAS,kBAAkB,CAAC,GAAsB;IAChD,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAkC,CAAC;QAClE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,6FAA6F;IAC7F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,GAAG;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;IACzE,CAAC,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG,CAAC,MAAM,aAAa,KAAK,CAAC,MAAM,kBAAkB,KAAK,MAAM,QAAQ,CAAC,cAAc,EAAE,SAAS,SAAS,CAAC,cAAc,EAAE,MAAM;KACtI,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2CAA2C;AAC3C,SAAS,YAAY,CAAC,GAAiB;IACrC,OAAO,GAAG;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,KAAa;IACxD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAEhC,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,IAAI,GAAG,IAAI;iBACd,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC;gBAChB,wFAAwF;gBACxF,yFAAyF;gBACzF,sFAAsF;iBACrF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;iBACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAiB;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,gDAAgD;QAChD,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,IAAI,GAAG,IAAI;SACd,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC;SAC/B,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc,EAAE,SAAiB;IACjF,OAAO,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,SAAS,KAAK,CAAC,CAAC;AAC1D,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgB,EAChB,GAAW,EACX,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IAEnC,gGAAgG;IAChG,0FAA0F;IAC1F,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,iDAAiD;YACxD,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,GAAG,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC7F,GAAG,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC3E,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,GAAG,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEd,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEd,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,iGAAiG;IACjG,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEhF,IAAI,IAAI;QAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,CACP,iBAAiB,QAAQ,CAAC,YAAY,IAAI,KAAK,0BAA0B;QACvE,GAAG,QAAQ,CAAC,WAAW,kBAAkB,QAAQ,CAAC,SAAS,+BAA+B,CAC7F,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,+FAA+F;IAC/F,0FAA0F;IAC1F,IAAI,EAAE,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,0CAA0C,CAAC,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,SAAS,kDAAkD,CAAC,CAAC;IACvF,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,GAAG,CAAC,KAAK,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,4FAA4F;IAC5F,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACtF,GAAG,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC5E,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACd,GAAG,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI;QAAE,GAAG,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAEvF,OAAO;QACL,GAAG,EAAE,MAAM;QACX,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,YAAY;QAC7B,EAAE;KACH,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,SAAS,CACtB,MAAc,EACd,KAAa,EACb,GAAW,EACX,IAAa;IAEb,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5F,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAC/D,KAAK,EACL,MAAM,CACP,CAAC;IACF,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/commands/record.d.ts

@@ -14,4 +14,17 @@ export interface RecordResult {
     exitCode: number;
 }
 export declare function recordCommand(args: ParsedArgs, out: Output, cwd?: string): Promise<RecordResult>;
+/**
+ * The origins a configured upstream map actually names, deduplicated and safe to print.
+ *
+ * `resolveUpstream` writes one entry per dialect and `openai` and `openai-responses` always share
+ * a value — so the raw map renders a single gateway three times. What a reader wants is the set of
+ * places traffic can go, which is usually one.
+ *
+ * Through `recordableOrigin` for the same reason the trace goes through it, and against the same
+ * sentence: `orca setup --gateway` accepts a URL carrying the key — `https://user:pw@gw.example`,
+ * `https://gw.example?key=…` — and `config.ts` says of that file that "nothing ever prints it
+ * back". A line on the terminal is printing it back, and it is a line that ends up in CI logs.
+ */
+export declare function distinctOrigins(upstream: Record<string, string> | undefined): string[];
 //# sourceMappingURL=record.d.ts.map

package/dist/commands/record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/commands/record.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AA0BD,wBAAsB,aAAa,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,SAAgB,GAClB,OAAO,CAAC,YAAY,CAAC,CAUvB"}
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/commands/record.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AA0BD,wBAAsB,aAAa,CACjC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,SAAgB,GAClB,OAAO,CAAC,YAAY,CAAC,CAUvB;AA+mBD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,EAAE,CActF"}

package/dist/commands/record.js

@@ -3,14 +3,14 @@ import { readFile } from 'node:fs/promises';
 import { delimiter, resolve } from 'node:path';
 import { TraceWriter, ensureRunsDir } from '@orcareplay/core';
 import { FsCapture } from '@orcareplay/fs-capture';
-import { createProxy, RunCa } from '@orcareplay/proxy';
+import { createProxy, unusableOrigin, recordableOrigin, RunCa, } from '@orcareplay/proxy';
 import { captureSession, defaultAdapters, resolveLaunch, snapshotDir } from '@orcareplay/adapters';
 import { ExchangeEventDeriver, appendDerivedEvents } from '../exchange-events.js';
 import { installShellShim, readShellFrames } from '@orcareplay/shell-shim';
 import { drainMcpFrames, pointAtMcpConfig, setupMcpCapture } from '../mcp.js';
 import { SerialQueue } from '../serial.js';
 import { appendSnapshot } from '../fs-events.js';
-import { persistNetExchange, setupTlsCapture, trustRunCa } from '../tls-capture.js';
+import { persistNetExchange, planTlsCapture, setupTlsCapture, trustRunCa } from '../tls-capture.js';
 import { upstreamPlan } from '../upstream.js';
 import { ORCA_VERSION } from '../version.js';
 /**
@@ -56,6 +56,23 @@ async function runRecording(args, out, cwd, minted) {
     if (agentName) {
         adapter = registry.get(agentName);
     }
+    else if (args.passthrough.length > 0) {
+        // A command after `--` is not a hint about the environment; it is the answer. Detection is
+        // machine-wide by construction — every adapter's is `detectAgent(binaries, homePaths)`, which
+        // asks whether a binary is on PATH or a directory exists under `$HOME`, and neither is a fact
+        // about this directory. So on a machine with Claude Code installed,
+        // `orca record -- python my_graph.py` detected `claude-code` and launched *that*, handing it
+        // `python my_graph.py` as arguments. The run recorded, so the failure looked like a bad key
+        // rather than like orca having started the wrong program.
+        //
+        // `generic-openai` rather than `exec`: both decline to guess what the command is, but only one
+        // of them redirects anything. `exec` points the agent nowhere and warns that interception is
+        // required — correct for a Go binary with its origin compiled in, and wrong as a default,
+        // because most things run this way read a base-URL variable and would have been captured by
+        // setting the three that `generic-openai` sets. Sending everyone to `--tls-intercept` to record
+        // a Python script is a worse answer than the bug this replaces.
+        adapter = registry.get('generic-openai');
+    }
     else {
         adapter = await registry.detect(cwd);
         if (!adapter) {
@@ -65,6 +82,15 @@ async function runRecording(args, out, cwd, minted) {
         }
         out.info('adapter.detected', { id: adapter.id });
     }
+    // Before the run directory exists, because both of these refuse: `upstreamPlan` an upstream that
+    // is not an origin, `planTlsCapture` a `--tls-hosts` list that names `*` or contradicts itself
+    // and an `ORCA_TLS_UPSTREAM_CA` that cannot be read. Resolved after it, a typo in any of them
+    // left an empty run behind for `orca list` to show. Neither depends on more than the arguments,
+    // the environment and a file the run was going to read anyway, so there is no reason for either
+    // to run later — and `planTlsCapture` is the refusing half of `setupTlsCapture` alone, so the
+    // certificate authority is still minted below, once the run has a directory to mint it into.
+    const plan = await upstreamPlan(args);
+    await planTlsCapture(args);
     const dir = await ensureRunsDir(cwd);
     const writer = await TraceWriter.create(dir, {
         adapter: { id: adapter.id, version: ORCA_VERSION, harness_version: adapter.harnessVersions },
@@ -131,7 +157,6 @@ async function runRecording(args, out, cwd, minted) {
     // Serial, not parallel: each persist snapshots the workspace, and two overlapping `git add`
     // calls collide on index.lock. It also keeps seq in the order exchanges actually happened.
     const writes = new SerialQueue();
-    const plan = await upstreamPlan(args);
     /**
      * TLS interception, off unless the flag is present.
      *
@@ -172,6 +197,17 @@ async function runRecording(args, out, cwd, minted) {
     let commandToolCalls = 0;
     /** Commands the shim actually saw. Zero against a non-zero `commandToolCalls` is the warning. */
     let shellFrames = 0;
+    /**
+     * Exchanges the upstream answered with an error status.
+     *
+     * Counted because a run in which every model call failed is indistinguishable, from the summary
+     * line alone, from one that worked: the harness retries, gives up, exits 0, and orca prints
+     * `recorded … exit=0` over a trace whose every answer is a 503. That happened against a gateway
+     * whose credentials had lapsed, and nothing in the output said so.
+     */
+    let erroredExchanges = 0;
+    /** The status those errors carried, so the warning can name it rather than describe it. */
+    const errorStatuses = new Map();
     const proxy = await createProxy({
         mode: 'record',
         upstream: plan.upstream,
@@ -179,6 +215,10 @@ async function runRecording(args, out, cwd, minted) {
         upstreamHeadersOrigin: plan.headersOrigin,
         onExchange: (exchange) => {
             modelExchanges += 1;
+            if (exchange.status >= 400) {
+                erroredExchanges += 1;
+                errorStatuses.set(exchange.status, (errorStatuses.get(exchange.status) ?? 0) + 1);
+            }
             writes.push(() => persist(exchange));
         },
         // A POST on a path no dialect claims is forwarded rather than refused, and lands in the trace
@@ -290,6 +330,17 @@ async function runRecording(args, out, cwd, minted) {
         run: writer.runId,
         adapter: adapter.id,
         proxy: proxy.url,
+        // `proxy` is orca's own address, so the line said where the agent would call and never where
+        // the call would go on to. A gateway left behind in `~/.orca/config.json` redirects every run
+        // on the machine, and the first sign of it used to be an answer from a model nobody asked for.
+        //
+        // Only when something was configured. Left alone, each dialect has its own vendor default and
+        // there is no single value to print — and `upstream=default` on every ordinary run is noise
+        // that would teach people to stop reading the line. The trace records the origin either way,
+        // per exchange, because that is where it is actually decided.
+        ...(distinctOrigins(plan.upstream).length > 0
+            ? { upstream: distinctOrigins(plan.upstream).join(',') }
+            : {}),
         fs: fs ? 'on' : 'off',
         shell: shell ? 'on' : 'off',
     });
@@ -430,16 +481,49 @@ async function runRecording(args, out, cwd, minted) {
      * the adapters; this guards the run, which is where a user actually meets it.
      */
     if (modelExchanges === 0) {
+        const baseUrls = Object.keys(launch.env)
+            .filter((name) => /(?:_BASE_URL|_API_BASE)$/.test(name))
+            .sort();
+        // Which cause is worth naming depends on how this adapter captures at all, and the line
+        // already carries the evidence: `set=none` means there was never a variable to be ignored.
+        // Printing "it may not read a base-URL variable" next to `set=none` contradicts the run's own
+        // output and sends the reader after a route that was never the route -- which is how the
+        // capture bug fixed earlier in this branch stayed hidden through a dozen rounds of debugging.
+        const cause = baseUrls.length > 0
+            ? 'the agent never called the proxy — it may not read a base-URL variable'
+            : tls.ca
+                ? 'this adapter captures at the transport, and nothing orca decrypted looked like a model call'
+                : 'this adapter captures at the transport, and interception was not on';
         out.warn('capture.empty', {
             exchanges: 0,
-            cause: 'the agent never called the proxy — it may not read a base-URL variable',
-            set: Object.keys(launch.env)
-                .filter((name) => /(?:_BASE_URL|_API_BASE)$/.test(name))
-                .sort()
-                .join(',') || 'none',
+            cause,
+            set: baseUrls.join(',') || 'none',
             next: 'orca doctor',
         });
     }
+    /**
+     * Every model call came back an error.
+     *
+     * `capture.empty` covers the run the proxy never saw. This covers the run it saw all of, where
+     * every answer was a refusal: an expired gateway credential, a model the account cannot reach, a
+     * provider outage. The harness retries, exhausts its attempts, prints its own error and exits 0,
+     * so the summary reads exactly like a successful recording — `recorded events=27 exit=0` — over
+     * a trace that contains no model output at all. Replaying it faithfully reproduces the failures.
+     *
+     * Only when *all* of them failed. A run that retried once and then worked is a run that worked,
+     * and warning about it would train people to ignore the line that matters.
+     */
+    if (modelExchanges > 0 && erroredExchanges === modelExchanges) {
+        const commonest = [...errorStatuses.entries()].sort((a, b) => b[1] - a[1])[0];
+        out.warn('capture.errors', {
+            exchanges: modelExchanges,
+            errors: erroredExchanges,
+            status: commonest ? commonest[0] : 'unknown',
+            cause: 'every model call the proxy forwarded came back an error',
+            effect: 'the trace holds the failures, not any model output — a replay reproduces those',
+            next: 'orca show to read the errors, then check the upstream credential or model id',
+        });
+    }
     /**
      * Shell capture that was on and recorded nothing.
      *
@@ -535,4 +619,31 @@ async function runChild(command, argv, env, cwd, quietStdout = false) {
         });
     });
 }
+/**
+ * The origins a configured upstream map actually names, deduplicated and safe to print.
+ *
+ * `resolveUpstream` writes one entry per dialect and `openai` and `openai-responses` always share
+ * a value — so the raw map renders a single gateway three times. What a reader wants is the set of
+ * places traffic can go, which is usually one.
+ *
+ * Through `recordableOrigin` for the same reason the trace goes through it, and against the same
+ * sentence: `orca setup --gateway` accepts a URL carrying the key — `https://user:pw@gw.example`,
+ * `https://gw.example?key=…` — and `config.ts` says of that file that "nothing ever prints it
+ * back". A line on the terminal is printing it back, and it is a line that ends up in CI logs.
+ */
+export function distinctOrigins(upstream) {
+    const safe = Object.values(upstream ?? {})
+        // Dropped only where sanitising cannot work, so a gateway configured with its key in the URL
+        // still says *where* the traffic went. `recordableOrigin` removes userinfo and query, which is
+        // enough for every `http(s)://` value — but a scheme-less URL parses with its username as the
+        // protocol, so it comes back as `myuser://PASSWORD@gw.example/v1`, credential intact, and a
+        // filter keeping everything that is not `undefined` kept it. There is no sanitising that: with
+        // no scheme there is no telling which half of `a:b` was meant as the host. `upstreamPlan`
+        // refuses these before a run starts; this is here because the function is exported and one
+        // line from a terminal.
+        .filter((origin) => unusableOrigin(origin) === undefined)
+        .map(recordableOrigin)
+        .filter((origin) => origin !== undefined);
+    return [...new Set(safe)];
+}
 //# sourceMappingURL=record.js.map