reqtrail v0.3.0 — the transport

reqtrail v0.3.0 — the transport

reqtrail run sends the request it just showed you. Real output, not a sketch:

$ API_TOKEN=... reqtrail run example.reqtrail.json --request get-user
GET http://api.internal/users/42?q=a%20b
Host: api.internal  (derived)
Authorization: Bearer ••••
X-Tag: alpha
X-Tag: beta
X-Empty: 

Substitutions
  url         {{baseUrl}}         variables.baseUrl  http://api.internal
  url         {{userId}}          variables.userId   42
  url         {{query}}           variables.query    "a b" → a%20b
  headers[0]  {{$env.API_TOKEN}}  environment        •••• (masked)

200

What changed

run is a second consumer of the same pair resolve reads. It builds no
request of its own — that was the point of shipping 0.2.0 early. What it sends
is what resolve displays, and test/wire.mjs checks that on every npm test
by comparing bytes a raw socket recorded against the request the core built.

Host is derived and shown. It used to be supplied invisibly by node:http
from an object of headers. reqtrail now hands the transport an ordered array,
the runtime supplies no Host, and reqtrail derives its own from the URL — with
the same secret-masking the URL gets, so a secret hostname is masked in Host
too. Connection is now the only header reaching a receiver without appearing
in the display.

Exit code 3 is reachable. Documented since 0.1.0 and impossible until now.
run exits 3 when bytes were attempted and the transport failed. A non-2xx
response is exit 0 — the send worked and the server answered.

A failed send reports a code and nothing else. Node puts request values in
its error prose (getaddrinfo ENOTFOUND your-host), and a hostname can come
from a secret. Only the code is surfaced.

Breaking

--json header arrays changed shape.

• Every entry gains "origin", either "workspace" or "derived".
• A Host entry is prepended when the URL resolves. Anything indexing
  projection.headers[0] now gets Host.

A workspace that sets its own Host is refused (header.host). Two Host
headers on the wire is a request-smuggling shape, so this is a refusal rather
than a merge.

Scope

Plain HTTP only. resolve will show an https:// request; run refuses it
with exit 1, because the fix is in your file rather than in the network.
node:https is imported by nothing. Response bodies, redirects and timeouts are
not in this release. reqtrail ui stays read-only with no send button.

Evidence

TRANSPORT-EVIDENCE.md records what was found, including the predictions that
were wrong and a defect found after the release was called complete.
TRANSPORT-PREREGISTRATION.md holds the predictions, written before the code
and unedited.

Suite at this tag: refusals 41/41, selftest 196/196, leak-audit 0 of 28 fixtures
leaking, ui 27/27, parity 7/7 byte-identical, server 51/51, server-slow 2/2,
wire 24/24.