@basein/runner 0.1.1 → 0.2.1

package/dist/bin/bir.js

@@ -28,7 +28,7 @@ import { isScenarioServer, isWrapped, PACKAGE_NAME, readSidecar, scenarioEntry,
 import { isRemote, resolveServers } from "../config/resolve.js";
 import { buildHooksBlock, claudeCodePaths, fileForScope, installHooks, readTextOrNull, setServerEntry, sha256, uninstallHooks, } from "../config/adapters/claude-code.js";
 import { readGenericServers, setGenericServerEntry } from "../config/adapters/generic.js";
-import { AUTH_URL_HINT, authenticate, clearCredentials, describeAuthService, normalizeAuthUrl, resolveAuthUrl, } from "../auth/client.js";
+import { AUTH_URL_HINT, DeviceFlowAborted, DeviceFlowUnsupported, authenticate, deviceLogin, describeAuthService, legacyPasswordLogin, tokenLogin, logout, normalizeAuthUrl, resolveAuthUrl, } from "../auth/client.js";
 import { DEFAULT_CONTROL_PORT } from "../control/server.js";
 import { errText } from "../util/log.js";
 import { packageVersion } from "../util/version.js";
@@ -45,8 +45,8 @@ Commands:
   status      what is installed for this directory
   doctor      is it actually working right now?
   wrap        print a proxied entry for one server (any MCP client)
-  login       sign in to the BaseIn service
-  logout      forget the cached credentials
+  login       sign in to the BaseIn service (opens your browser)
+  logout      revoke this machine's session and forget it
 
   scenario list                     recorded runs and their calculated scenarios
   scenario show <runId>             a run's scenario: intent, params, steps
@@ -65,7 +65,10 @@ Options:
   --replay          install/remove the scenario server, enabling calculated replay
   --port <n>        control-server port to write into the hook URLs (default ${DEFAULT_CONTROL_PORT})
   --json            machine-readable output for status / doctor
-  --dry             replay against recorded outputs only; run no real tools`);
+  --dry             replay against recorded outputs only; run no real tools
+  --no-browser      login: print the link and code, open nothing (SSH, headless)
+  --token <value>   login: redeem a one-time setup token from the console (no browser)
+  --password        login: use the old email/password prompt (deprecated)`);
     process.exit(code);
 }
 function parseArgs(argv) {
@@ -83,6 +86,7 @@ function parseArgs(argv) {
         positionals: [],
         dry: false,
         force: false,
+        password: false,
     };
     for (let i = 1; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -106,6 +110,15 @@ function parseArgs(argv) {
             case "--force":
                 args.force = true;
                 break;
+            case "--password":
+                args.password = true;
+                break;
+            case "--no-browser":
+                args.browser = false;
+                break;
+            case "--token":
+                args.token = argv[++i] ?? "";
+                break;
             case "--config":
                 args.configPath = argv[++i];
                 break;
@@ -531,6 +544,20 @@ async function doctor(args) {
         else {
             notes.push(`recording to ${String(health.authUrl ?? "the configured BaseIn service")}`);
         }
+        // Whether a recurring sub-task the service found may actually run mid-task
+        // (segmented.md R-LIFE-8). Observe-only is the default and must be visible
+        // without reading a log: an operator turns arming on by reading what *would*
+        // have armed, and needs to know which of the two states this machine is in.
+        notes.push(health.segmentArm === true
+            ? "recurring sub-tasks MAY run mid-task (BIR_SEGMENT_ARM=1)"
+            : "recurring sub-tasks are observed only — nothing is replaced (BIR_SEGMENT_ARM unset)");
+        const sessions = health.sessions ?? [];
+        const probes = sessions.reduce((n, s) => n + (s.intent?.probes ?? 0), 0);
+        const armed = sessions.reduce((n, s) => n + (s.intent?.armed ?? 0), 0);
+        if (sessions.length > 0) {
+            notes.push(`mid-turn matching this session: ${probes} probe${probes === 1 ? "" : "s"}, ` +
+                `${armed} armed`);
+        }
     }
     else if (!resolveAuthUrl()) {
         // No control server to ask, and nothing in this shell either. That is a
@@ -875,30 +902,85 @@ async function main() {
         case "replay":
             return replayCommand(args);
         case "login": {
-            // Settle the URL the way every other command does, then refuse to ask for
-            // a password when what is there is not the service. "Signed in" must mean
-            // the service at BIR_AUTH_URL accepted these credentials — not that a
-            // cached token exists for some other address.
+            // Settle the URL the way every other command does, then refuse to go on
+            // when what is there is not the service. "Signed in" must mean the service
+            // at BIR_AUTH_URL issued this session — not that a cached token exists for
+            // some other address.
             const configured = resolveAuthUrl();
-            const baseUrl = configured ? await normalizeAuthUrl(configured) : "";
-            if (baseUrl) {
-                const problem = await describeAuthService(baseUrl);
-                if (problem) {
-                    process.stderr.write(`[bir] ${baseUrl} is not a BaseIn service: ${problem}\n`);
-                    process.stderr.write(`[bir] ${AUTH_URL_HINT}\n`);
+            if (!configured) {
+                process.stderr.write("[bir] BIR_AUTH_URL is not set — there is nothing to sign in to.\n");
+                process.stderr.write(`[bir] ${AUTH_URL_HINT}\n`);
+                return 1;
+            }
+            const baseUrl = await normalizeAuthUrl(configured);
+            const problem = await describeAuthService(baseUrl);
+            if (problem) {
+                process.stderr.write(`[bir] ${baseUrl} is not a BaseIn service: ${problem}\n`);
+                process.stderr.write(`[bir] ${AUTH_URL_HINT}\n`);
+                return 1;
+            }
+            let session;
+            if (args.token !== undefined) {
+                // A setup token from the console: already approved for one account, so
+                // there is no page to open and nothing to wait for.
+                if (!args.token.trim()) {
+                    process.stderr.write("[bir] --token needs the token itself: bir login --token <token>\n");
                     return 1;
                 }
+                try {
+                    session = await tokenLogin(baseUrl, args.token);
+                }
+                catch (err) {
+                    if (err instanceof DeviceFlowAborted) {
+                        process.stderr.write(`[bir] ${err.message}\n`);
+                        return 1;
+                    }
+                    if (err instanceof DeviceFlowUnsupported) {
+                        process.stderr.write("[bir] this service does not offer setup tokens; run `bir login` without --token.\n");
+                        return 1;
+                    }
+                    throw err;
+                }
+            }
+            else if (args.password) {
+                process.stderr.write("[bir] --password is deprecated and will be removed in the next release. " +
+                    "Browser sign-in works for every account, including Google-only ones.\n");
+                session = await legacyPasswordLogin(baseUrl);
+            }
+            else {
+                try {
+                    session = await deviceLogin(baseUrl, { openBrowser: args.browser });
+                }
+                catch (err) {
+                    if (err instanceof DeviceFlowUnsupported) {
+                        // A runner newer than its service. Falling back beats stranding
+                        // someone on an install that used to work.
+                        process.stderr.write("[bir] this service does not offer browser sign-in yet; " +
+                            "falling back to email and password.\n");
+                        session = await legacyPasswordLogin(baseUrl);
+                    }
+                    else if (err instanceof DeviceFlowAborted) {
+                        process.stderr.write(`[bir] ${err.message}\n`);
+                        return 1;
+                    }
+                    else {
+                        throw err;
+                    }
+                }
             }
-            const session = await authenticate(baseUrl ? { authUrl: baseUrl } : undefined);
             if (!session)
                 return 1;
             out(`Signed in to ${baseUrl} as ${session.user.email}.`);
             return 0;
         }
-        case "logout":
-            clearCredentials();
+        case "logout": {
+            // Revoke server-side before forgetting locally, so a stolen credentials
+            // file is dead rather than merely absent from this machine.
+            const configured = resolveAuthUrl();
+            await logout(configured ? await normalizeAuthUrl(configured) : undefined);
             out("Logged out — cached credentials cleared.");
             return 0;
+        }
         default:
             usage(2);
     }

package/dist/control/server.d.ts

@@ -23,6 +23,7 @@
  * token on every route, and never echoes the token back. A loopback port that
  * accepts unauthenticated step reports is a local exfiltration channel.
  */
+import { type IntentSource } from "./transcript.js";
 import { type Recorder } from "../record/recorder.js";
 import { type ReplayOptions } from "../replay/controller.js";
 /** The subset of the Claude Code hook payload we consume (all optional, all defensive). */
@@ -41,6 +42,13 @@ export interface HookPayload {
 }
 export interface ControlServerOptions {
     recorder: Recorder;
+    /**
+     * Tool results of the current prompt handed to derivation
+     * (`BIR_DERIVE_RECENT_RESULTS`, segmented.md R-PARAM-2). Default 5; 0 off.
+     */
+    deriveRecentResults?: number;
+    /** `BIR_INTENT_SOURCES` — which intent rungs may be sent (R-INTENT-3). */
+    intentSources?: ReadonlySet<IntentSource>;
     /** Session working directory — keys the discovery file. */
     cwd: string;
     /** Preferred port; 0 (or a busy port) falls back to an ephemeral one. */
@@ -107,6 +115,18 @@ export declare class ControlServer {
     private readonly pendingSeals;
     /** Calculated replay. Inert unless `opts.replay.enabled`. */
     private readonly replay;
+    /**
+     * How many of this prompt's tool results derivation may read
+     * (`BIR_DERIVE_RECENT_RESULTS`, segmented.md R-PARAM-2). A target is often
+     * named by an earlier step's output and never by the prompt.
+     */
+    private readonly deriveRecentResults;
+    /**
+     * Which rungs of R-INTENT-1 the runner may send (`BIR_INTENT_SOURCES`). It
+     * governs only what is *sent*: with every source off, the probe still goes out
+     * with an empty text and the server builds the tool line (R-HIT-4).
+     */
+    private readonly intentSources;
     constructor(opts: ControlServerOptions);
     listen(): Promise<ControlServerAddress>;
     close(): Promise<void>;
@@ -167,6 +187,8 @@ export declare class ControlServer {
      * false` and zero rather than a number that is confidently wrong.
      */
     private runCost;
+    /** Transcript cost since `mark`; unmeasured (and zero) without one. */
+    private costSince;
     private reportExecution;
     /** Seal the run *and* wait for everything queued to reach the service. */
     private finalizeRun;
@@ -183,6 +205,67 @@ export declare class ControlServer {
      *    record `tool_selected`. The hook is this step's only observer.
      */
     private onToolPre;
+    /** A controller decision as a `PreToolUse` answer, or undefined to carry on. */
+    private preToolAnswer;
+    /**
+     * Recordings this turn must not count a step hit against (segmented.md
+     * R-HIT-7).
+     *
+     * A repeat of a recording's own prompt is *prompt* recurrence, counted as
+     * `iterations`, never step recurrence. Without this, three prompt repeats
+     * would reach `SEGMENT_MIN_HITS` on every step of the whole recording and the
+     * detector would build a whole-run-sized segment beside the whole-run
+     * scenario.
+     */
+    private excludeRunsFor;
+    /**
+     * Per recording a plan of this turn came from, how far that plan got
+     * (segmented.md R-OUT-6).
+     *
+     * The server uses it to refuse a segment that starts *before* where this turn
+     * already is: re-running steps the turn has just done is worse than not
+     * replaying at all. The largest position per recording wins, and a plan
+     * declined for anything but a known-bad first step reports nothing — it ran
+     * none of the recording, so it blocks none of it.
+     *
+     * Rebuilt on every probe rather than cached: a plan that hands over between
+     * two calls changes the answer.
+     */
+    private ranThroughFor;
+    /**
+     * Intent matching in the ReAct loop (fallbk.md §Runner 4, segmented.md 10.3).
+     *
+     * Called only while the model is driving. Every unsteered, non-housekeeping
+     * tool call is sent: the service counts it as a hit on whatever recorded step
+     * it matches, and may hand back a scenario or a segment to run in its place.
+     *
+     * A call made with **no reasoning at all** still probes (R-HIT-4): the server
+     * builds an intent from the tool name and arguments, and a step the agent took
+     * without narrating it is exactly as much a recurrence as one it explained.
+     * Every failure is a miss.
+     */
+    private tryIntentMatch;
+    /**
+     * Schedule a fragment once a matched turn's plan has handed over (fallbk.md
+     * D7). Only a turn that is not already recording needs one: an unmatched turn
+     * whose intent-armed plan handed over is recording the model's work anyway.
+     */
+    private noteHandover;
+    /**
+     * Open the fragment run and record from this call on (fallbk.md D7).
+     *
+     * The run id is swapped in place: steps allocated before belonged to a turn
+     * the service never created a run for, and nothing of theirs may land in the
+     * fragment — so pending correlations are latched and built-ins forgotten.
+     */
+    private openFragment;
+    /** Resolve with `p`, or null once `ms` passes or it rejects. */
+    private withinBudget;
+    /**
+     * `PostToolUse`, and where a hand-over noticed while threading this call's
+     * output reaches the model at once, as `additionalContext` (fallbk.md D4).
+     */
+    private onToolPost;
     /**
      * `PostToolUse` / `PostToolUseFailure`. For a built-in this closes the pair.
      * For a correlated MCP call it normally does nothing — the proxy owns that
@@ -190,7 +273,7 @@ export declare class ControlServer {
      * or the call never reached it), the hook's own view is recorded after
      * {@link PROXY_REPORT_GRACE_MS} rather than the step being lost entirely.
      */
-    private onToolPost;
+    private toolPost;
     private errorText;
     /**
      * `SubagentStart` / `SubagentStop`. These carry `agent_id`, which is the only