@basein/runner 0.3.12 → 0.3.13

package/dist/bin/bir-scenario.d.ts

@@ -24,7 +24,14 @@
  * MCP call's `params._meta["claudecode/toolUseId"]` — the same id that hook
  * carried as `tool_use_id` — so the request forwards it as `toolUseId` and the
  * control server matches it exactly instead of inferring the session. A host
- * that names nothing sends an empty body, as before.
+ * that names nothing sends no `toolUseId`, as before.
+ *
+ * WHOSE PROXIES. The request also carries `ppid`, the process that started
+ * this server. Claude Code starts all of a session's MCP servers, so that is
+ * the parent of the session's proxies too, and the control server binds them
+ * to the session before the plan's first step (replay/executor.ts,
+ * `bindSiblings`): that step is the session's first call to their server, so
+ * nothing else could yet say which proxies are its own.
  *
  * IT RUNS IN EVERY SESSION, SO IT MUST NEVER BE WHY ONE GOES WRONG. Startup and
  * `tools/list` are answered from local files alone (the hello to the recorder

package/dist/bin/bir-scenario.js

@@ -24,7 +24,14 @@
  * MCP call's `params._meta["claudecode/toolUseId"]` — the same id that hook
  * carried as `tool_use_id` — so the request forwards it as `toolUseId` and the
  * control server matches it exactly instead of inferring the session. A host
- * that names nothing sends an empty body, as before.
+ * that names nothing sends no `toolUseId`, as before.
+ *
+ * WHOSE PROXIES. The request also carries `ppid`, the process that started
+ * this server. Claude Code starts all of a session's MCP servers, so that is
+ * the parent of the session's proxies too, and the control server binds them
+ * to the session before the plan's first step (replay/executor.ts,
+ * `bindSiblings`): that step is the session's first call to their server, so
+ * nothing else could yet say which proxies are its own.
  *
  * IT RUNS IN EVERY SESSION, SO IT MUST NEVER BE WHY ONE GOES WRONG. Startup and
  * `tools/list` are answered from local files alone (the hello to the recorder
@@ -206,7 +213,8 @@ async function runArmedPlan(cwd, flight, toolUseId) {
                 "content-type": "application/json",
                 authorization: `Bearer ${found.token}`,
             },
-            body: JSON.stringify(toolUseId ? { toolUseId } : {}),
+            // `ppid`: the host that started this server and the session's proxies (WHOSE PROXIES above).
+            body: JSON.stringify(toolUseId ? { toolUseId, ppid: process.ppid } : { ppid: process.ppid }),
             signal: controller.signal,
         });
         const raw = await res.text();

package/dist/bin/investigate.d.ts

@@ -29,6 +29,16 @@ export interface Turn {
     startedAt: string;
     finishedAt?: string;
     prompt?: string;
+    /**
+     * Claude Code's own blocks the runner took off the front of the prompt, in
+     * order (fx121.md): `run.prompt_stripped`. Absent when there were none.
+     */
+    stripped?: string[];
+    /** The turn was a task notification, with no words of the user's: never matched. */
+    eventOnly?: boolean;
+    /** The prompt's length as the hook gave it, and as the service got it. */
+    rawChars?: number;
+    promptChars?: number;
     matched?: {
         runId: string;
         scenarioId?: string;

package/dist/bin/investigate.js

@@ -99,6 +99,12 @@ export function turnsFromJournal(entries) {
             case "run.prompt":
                 turn.prompt = str(e.prompt);
                 break;
+            case "run.prompt_stripped":
+                turn.stripped = list(e.stripped);
+                turn.eventOnly = bool(e.eventOnly);
+                turn.rawChars = num(e.rawChars);
+                turn.promptChars = num(e.chars);
+                break;
             case "run.matched":
                 turn.matched = { runId: str(e.matchedRun) ?? "", scenarioId: str(e.scenario), similarity: num(e.similarity) };
                 break;
@@ -313,13 +319,17 @@ const pct = (v) => `${(v * 100).toFixed(1)}%`;
 export function localFindings(turn) {
     const out = [];
     if (!turn.matched) {
-        out.push({
-            code: "no_match",
-            severity: "info",
-            title: "This turn matched no recording, so the agent did the task itself.",
-            cause: "The service found no recording whose prompt is similar enough (its SIMILARITY_THRESHOLD). A run that is below the recording threshold is never embedded and can never be matched.",
-            fix: "If a recording of this task exists, run the prompt closer to its wording. The service section below says whether this turn became a recording.",
-        });
+        // A task notification is never matched (fx121 R7), so no prompt was
+        // compared and none can be reworded: "no match" would explain nothing.
+        if (!turn.eventOnly) {
+            out.push({
+                code: "no_match",
+                severity: "info",
+                title: "This turn matched no recording, so the agent did the task itself.",
+                cause: "The service found no recording whose prompt is similar enough (its SIMILARITY_THRESHOLD). A run that is below the recording threshold is never embedded and can never be matched.",
+                fix: "If a recording of this task exists, run the prompt closer to its wording. The service section below says whether this turn became a recording.",
+            });
+        }
     }
     else if (turn.decision?.verdict === "no-steer") {
         const code = turn.decision.code ?? "";
@@ -483,6 +493,8 @@ export function savedPct(turn) {
     return baseline > 0 ? r.savedUsd / baseline : null;
 }
 const short = (id) => (id ? id.slice(0, 13) : "—");
+/** 4624 → "4,624", whatever the machine's locale. */
+const count = (n) => String(n).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
 const money = (v) => (v == null ? "—" : usd(v));
 const when = (iso) => (iso ? iso.replace("T", " ").replace(/\.\d+Z$/, "Z") : "—");
 function renderFindings(out, findings, heading) {
@@ -500,12 +512,21 @@ function renderFindings(out, findings, heading) {
 }
 export function renderTurn(out, turn) {
     out(`Turn ${turn.runId}  ${when(turn.startedAt)}${turn.sessionId ? `  session ${turn.sessionId.slice(0, 8)}` : ""}`);
-    if (turn.prompt)
+    if (turn.prompt) {
         out(`  prompt    ${turn.prompt.replace(/\s+/g, " ").slice(0, 110)}`);
+    }
+    else if (turn.eventOnly) {
+        // No `run.prompt` line: nothing of the user's was left to send (fx121 R7).
+        out("  prompt    (none: a task notification, never matched)");
+    }
+    if (turn.stripped?.length) {
+        const sizes = turn.rawChars != null ? `  (${count(turn.rawChars)} → ${count(turn.promptChars ?? 0)} chars)` : "";
+        out(`  stripped  ${turn.stripped.join(", ")}${sizes}`);
+    }
     if (turn.matched) {
         out(`  matched   ${turn.matched.runId}${turn.matched.similarity != null ? ` (similarity ${turn.matched.similarity.toFixed(3)})` : ""}${turn.matched.scenarioId ? ` → scenario ${turn.matched.scenarioId}` : " → no scenario"}`);
     }
-    else {
+    else if (!turn.eventOnly) {
         out("  matched   no recording — the agent ran the task; this turn was recorded");
     }
     if (turn.decision?.verdict === "no-steer") {
@@ -672,6 +693,8 @@ export async function investigateCommand(args, deps) {
             out(`  ${when(t.startedAt)}  ${t.runId}  ${verdict}${saved}`);
             if (t.prompt)
                 out(`      "${t.prompt.replace(/\s+/g, " ").slice(0, 90)}"`);
+            else if (t.eventOnly)
+                out("      (none: a task notification)");
         }
         out();
         out("Investigate one with `bir investigate <run_…>`; the newest with `bir investigate`.");

package/dist/control/client.d.ts

@@ -46,6 +46,12 @@ export interface ProxyIdentity {
     /** Process start, epoch ms. */
     startedAt: number;
     pid: number;
+    /**
+     * The process that started the proxy: its session's host. `bir-scenario`
+     * reports its own, so a session's proxies can be told apart before they
+     * have called anything (replay/executor.ts, `bindSiblings`).
+     */
+    ppid: number;
 }
 export declare class ControlClient {
     private readonly url;

package/dist/control/server.d.ts

@@ -567,6 +567,8 @@ export declare class ControlServer {
      *
      * `asked` is what the prompt that opens the run asked for, in a session of
      * another host: whether its adapter wants a plan (`HookPayload.replay`).
+     * `cleaned` is how `onPrompt` got `input` from the hook's prompt, the only
+     * caller that has one (fx121.md).
      */
     private ensureRun;
     private runMetadata;
@@ -1166,6 +1168,14 @@ export declare class ControlServer {
      * ONE RUN PER PLAN. A second call while the plan is executing would run
      * every step again beside the first — duplicated writes — and is told so.
      *
+     * WHOSE PROXIES. `run_scenario` is the session's first call, so no
+     * correlated call has bound its proxies yet, and with another session open
+     * an unbound proxy may be either's: the plan's first step was refused. But
+     * Claude Code starts all of a session's MCP servers as its own children, and
+     * `bir-scenario` sends its parent's pid (`ppid`), as every proxy does with its
+     * poll. The proxies with that parent are this session's, and are bound to it
+     * before the plan runs (replay/executor.ts, `bindSiblings`).
+     *
      * `signal` aborts when `bir-scenario`'s request goes away — the host
      * cancelled the call (Esc) or its own timeout fired — so no further step is
      * started for a caller that can no longer read the result.

package/dist/control/server.js

@@ -33,6 +33,7 @@ import { pidAlive } from "./discovery.js";
 import { pinCompatible } from "./pin-guard.js";
 import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, thinkingForToolUse, usageSince, } from "./transcript.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
+import { asSent, userText } from "../record/prompt-text.js";
 import { redact, redactText } from "../record/redact.js";
 import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateString, truncateStrings, } from "../record/truncate.js";
 import { StepQueue } from "../record/queue.js";
@@ -1561,8 +1562,10 @@ export class ControlServer {
      *
      * `asked` is what the prompt that opens the run asked for, in a session of
      * another host: whether its adapter wants a plan (`HookPayload.replay`).
+     * `cleaned` is how `onPrompt` got `input` from the hook's prompt, the only
+     * caller that has one (fx121.md).
      */
-    ensureRun(session, input = "", asked = {}) {
+    ensureRun(session, input = "", asked = {}, cleaned) {
         if (session.run && !session.run.finished)
             return session.run;
         // The sealed run stays reachable for a moment: a report or a post that
@@ -1572,7 +1575,12 @@ export class ControlServer {
         // A run of another host says so in its `framework`: the service keeps a
         // plan inside the host, and the scope, that recorded it.
         const framework = frameworkOf(session);
-        const runId = this.recorder.startRun(input, this.runMetadata(session), framework ? { framework } : undefined);
+        // fx121 R8: blocks taken off the front of the prompt are said on the run
+        // itself, and in the journal below. A prompt that was only unwrapped is not.
+        const removed = cleaned && cleaned.stripped.length > 0
+            ? { stripped: cleaned.stripped, eventOnly: cleaned.eventOnly, rawChars: cleaned.rawChars }
+            : undefined;
+        const runId = this.recorder.startRun(input, removed ? { ...this.runMetadata(session), prompt: removed } : this.runMetadata(session), framework ? { framework } : undefined);
         const run = {
             runId,
             input,
@@ -1607,6 +1615,8 @@ export class ControlServer {
         // on stderr, and never more than a preview.
         if (input)
             journal("run.prompt", { run: runId, prompt: input.slice(0, 200) });
+        if (removed)
+            journal("run.prompt_stripped", { run: runId, ...removed, chars: input.length });
         // Started here so the round trip overlaps whatever the caller does next;
         // `onPrompt` awaits the same memoized promise under its own budget.
         void this.watchForMatch(session, run);
@@ -2580,7 +2590,14 @@ export class ControlServer {
     }
     async onPrompt(payload) {
         const session = this.ensureSession(payload);
-        const input = payload.prompt ?? "";
+        const other = otherHost(session);
+        const raw = typeof payload.prompt === "string" ? payload.prompt : "";
+        // fx121 R1, R6: the user's words, without Claude Code's own blocks in front
+        // of them, and from here on the prompt everywhere. `input` is what the
+        // service embeds, and its model reads 512 tokens: the Claude in Chrome
+        // guide alone is 1,008. Another host's text goes as it was sent.
+        const prompt = other ? asSent(raw) : userText(raw);
+        const input = prompt.text;
         const open = session.run && !session.run.finished ? session.run : undefined;
         if (open?.promptSeen) {
             // A second prompt in the same session: close the previous turn's run and
@@ -2627,14 +2644,13 @@ export class ControlServer {
             });
             return {};
         }
-        const other = otherHost(session);
         if (other) {
             // What a host hands over with its prompt, kept before the run opens:
             // the match watched from there may start a plan at once, and the places
             // that do have no prompt payload in reach.
             session.hostSinks = hostSinksOf(payload);
         }
-        const run = this.ensureRun(session, input, { replay: other && payload.replay === true });
+        const run = this.ensureRun(session, input, { replay: other && payload.replay === true }, prompt);
         run.promptSeen = true;
         run.input = input;
         session.prompts += 1;
@@ -4432,10 +4448,13 @@ export class ControlServer {
             return { error: "serverName required" };
         const hold = Number(body.holdMs);
         const startedAt = Number(body.startedAt);
+        const ppid = Number(body.ppid);
         const work = await this.replay.work.waitForWork(serverName, Number.isFinite(hold) && hold > 0 ? Math.min(hold, POLL_HOLD_MS) : POLL_HOLD_MS, signal, {
             proxyId: typeof body.proxyId === "string" ? body.proxyId : undefined,
             startedAt: Number.isFinite(startedAt) ? startedAt : undefined,
             pid: Number.isFinite(pid) ? pid : undefined,
+            // The host process that started the proxy (see `onScenarioRun`).
+            ppid: Number.isInteger(ppid) && ppid > 0 ? ppid : undefined,
         });
         return work ? { work } : {};
     }
@@ -4509,6 +4528,14 @@ export class ControlServer {
      * ONE RUN PER PLAN. A second call while the plan is executing would run
      * every step again beside the first — duplicated writes — and is told so.
      *
+     * WHOSE PROXIES. `run_scenario` is the session's first call, so no
+     * correlated call has bound its proxies yet, and with another session open
+     * an unbound proxy may be either's: the plan's first step was refused. But
+     * Claude Code starts all of a session's MCP servers as its own children, and
+     * `bir-scenario` sends its parent's pid (`ppid`), as every proxy does with its
+     * poll. The proxies with that parent are this session's, and are bound to it
+     * before the plan runs (replay/executor.ts, `bindSiblings`).
+     *
      * `signal` aborts when `bir-scenario`'s request goes away — the host
      * cancelled the call (Esc) or its own timeout fired — so no further step is
      * started for a caller that can no longer read the result.
@@ -4530,6 +4557,12 @@ export class ControlServer {
             });
             return { ok: false, why: ALREADY_RUNNING };
         }
+        // `bir-scenario` and this session's proxies share the host process that
+        // started them: bind those proxies to the session now, so the plan's first
+        // step can run even while another session's proxies are live.
+        const hostPid = Number(body.ppid);
+        if (Number.isInteger(hostPid) && hostPid > 0)
+            this.replay.work.bindSiblings(hostPid, call.sessionId);
         this.runningPlans.add(state);
         // The session is busy for as long as its plan runs, and sends no hook
         // meanwhile: the host is waiting on this very call.

package/dist/proxy/session.js

@@ -438,6 +438,7 @@ export class ProxySession {
                 proxyId: this.proxyId,
                 startedAt: this.startedAt,
                 pid: process.pid,
+                ppid: process.ppid,
             });
         const registered = await client.register({
             serverName: this.serverName,

package/dist/record/prompt-text.d.ts

@@ -0,0 +1,32 @@
+/**
+ * prompt-text — the user's words in a Claude Code prompt (fx121.md).
+ *
+ * Claude Code puts blocks of its own in front of what the user typed: the Claude
+ * in Chrome guide, the file open in the IDE, the selection, a background task's
+ * notification. The hook's `prompt` carries them all, and the service embeds the
+ * prompt with a model that reads 512 tokens. The Chrome guide alone is 1,008: in
+ * a session with Claude in Chrome connected, every prompt was embedded as the
+ * guide, and every one matched the same recording at 1.000.
+ *
+ * The prompt-side twin of `housekeeping.ts`. That file covers host tools that
+ * are not work; this one covers host text that is not the user's. Like it, it is
+ * deliberately narrow: a closed list of blocks, complete ones only, from the
+ * front only. When in doubt, the text is the user's.
+ */
+/** Blocks Claude Code adds in front of the user's text (fx121 R2). Closed list. */
+export declare const HOST_BLOCKS: readonly string[];
+export interface PromptText {
+    /** The user's words: what the service embeds and matches, and what derive reads. */
+    text: string;
+    /** Tags of the blocks removed from the front, in order. Empty for a plain prompt. */
+    stripped: string[];
+    /** Nothing of the user's is left, and the turn was a task notification (fx121 R7). */
+    eventOnly: boolean;
+    /** Length of the prompt as the hook gave it. */
+    rawChars: number;
+}
+/** The prompt exactly as the hook gave it: another host's text (fx121 R1), or one with nothing to clean. */
+export declare function asSent(raw: string): PromptText;
+/** The user's words in a Claude Code prompt, and what was taken off the front of them. */
+export declare function userText(raw: string): PromptText;
+//# sourceMappingURL=prompt-text.d.ts.map

package/dist/record/prompt-text.js

@@ -0,0 +1,65 @@
+/**
+ * prompt-text — the user's words in a Claude Code prompt (fx121.md).
+ *
+ * Claude Code puts blocks of its own in front of what the user typed: the Claude
+ * in Chrome guide, the file open in the IDE, the selection, a background task's
+ * notification. The hook's `prompt` carries them all, and the service embeds the
+ * prompt with a model that reads 512 tokens. The Chrome guide alone is 1,008: in
+ * a session with Claude in Chrome connected, every prompt was embedded as the
+ * guide, and every one matched the same recording at 1.000.
+ *
+ * The prompt-side twin of `housekeeping.ts`. That file covers host tools that
+ * are not work; this one covers host text that is not the user's. Like it, it is
+ * deliberately narrow: a closed list of blocks, complete ones only, from the
+ * front only. When in doubt, the text is the user's.
+ */
+/** Blocks Claude Code adds in front of the user's text (fx121 R2). Closed list. */
+export const HOST_BLOCKS = [
+    "browser_instruction", // Claude in Chrome: the tool guide, or "[Browser disconnected …]"
+    "ide_opened_file", // the IDE: the file that happens to be open
+    "ide_selection", // the IDE: the selected lines and their text
+    "system-reminder", // Claude Code's general wrapper for injected text
+    "task-notification", // a background task finished: a turn with no user text
+];
+/** An opening tag, after any whitespace, starting exactly at `lastIndex`. */
+const OPENING_TAG = /\s*<([a-z][\w-]*)(?:\s[^<>]*)?>/y;
+/** Claude Code's wrapper around text the user pasted, opening and closing. */
+const PASTED_TAGS = /<\/?pasted_content(?:\s[^<>]*)?>/g;
+/** The prompt exactly as the hook gave it: another host's text (fx121 R1), or one with nothing to clean. */
+export function asSent(raw) {
+    return { text: raw, stripped: [], eventOnly: false, rawChars: raw.length };
+}
+/** The user's words in a Claude Code prompt, and what was taken off the front of them. */
+export function userText(raw) {
+    const stripped = [];
+    let at = 0;
+    // fx121 R2, R3: complete host blocks, from the front only. A block ends at its
+    // first closing tag; one with no closing tag stays, and so does all after it.
+    for (;;) {
+        OPENING_TAG.lastIndex = at;
+        const open = OPENING_TAG.exec(raw);
+        if (!open || !HOST_BLOCKS.includes(open[1]))
+            break;
+        const closing = `</${open[1]}>`;
+        const end = raw.indexOf(closing, OPENING_TAG.lastIndex);
+        if (end < 0)
+            break;
+        stripped.push(open[1]);
+        at = end + closing.length;
+    }
+    const rest = raw.slice(at);
+    // fx121 R4: after R2, never before. A paste that starts with a copy of the
+    // Chrome guide would otherwise become a leading block, and R2 would remove it.
+    const unwrapped = rest.replace(PASTED_TAGS, "");
+    // fx121 R3: nothing to remove or unwrap, so the prompt goes as it came.
+    if (stripped.length === 0 && unwrapped === rest)
+        return asSent(raw);
+    const text = unwrapped.trim();
+    return {
+        text,
+        stripped,
+        eventOnly: text === "" && stripped.includes("task-notification"), // fx121 R7
+        rawChars: raw.length,
+    };
+}
+//# sourceMappingURL=prompt-text.js.map

package/dist/replay/executor.d.ts

@@ -29,14 +29,16 @@
  * every proxy polls under its own id, and a step goes to, in order:
  *
  *   1. a proxy bound to the step's session — learned from a correlated step the
- *      proxy reported, or from an earlier step of this session it ran;
+ *      proxy reported, from an earlier step of this session it ran, or, when a
+ *      direct plan starts, from the host process it shares with the
+ *      `bir-scenario` that asked for the plan ({@link ProxyWorkQueue.bindSiblings});
  *   2. otherwise an unbound proxy, but ONLY while no other session is live
  *      (none bound elsewhere, and no server with two proxies polling — each
  *      session starts its own). A lone session's unbound proxy can only be
- *      its own. With two sessions open, the one that has not called the server
- *      yet cannot be told apart from the other: "the newest" was a guess, and
- *      when the older session asked it ran the step on the newer one's
- *      upstream — another browser page, another database session — and
+ *      its own. With two sessions open, a proxy nothing has tied to a session
+ *      cannot be told apart from the other session's: "the newest" was a
+ *      guess, and when the older session asked it ran the step on the newer
+ *      one's upstream — another browser page, another database session — and
  *      answered wrongly;
  *   3. otherwise NOBODY. A proxy bound, or possibly belonging, to another
  *      session is never used for this one: the call rejects with a
@@ -76,6 +78,12 @@ export interface PollerIdentity {
     /** When the proxy process started, epoch ms — "newest" is judged by this. */
     startedAt?: number;
     pid?: number;
+    /**
+     * The process that started the proxy: its session's host. `bir-scenario`
+     * sends its own with `/scenario/run`, so a session's proxies can be told
+     * apart before they have called anything ({@link ProxyWorkQueue.bindSiblings}).
+     */
+    ppid?: number;
 }
 /** Rejection reason when no proxy is polling for a server. */
 export declare const NO_PROXY = "no_proxy";
@@ -113,6 +121,19 @@ export declare class ProxyWorkQueue {
      * `/clear` starts a new session on the same proxies.
      */
     bindProxy(proxyId: string, sessionId: string): void;
+    /**
+     * Bind to `sessionId` every live proxy started by host process `hostPid` —
+     * the process that also started the `bir-scenario` asking for this
+     * session's plan. Claude Code starts a session's MCP servers as its own
+     * children, so a shared parent ties a proxy to the session before it has
+     * called anything. Without it a direct plan's first step was refused
+     * whenever another session held a proxy for the same server: `run_scenario`
+     * is the session's first call, so no correlated call could have bound one.
+     *
+     * A proxy proven to belong to another session (a correlated call) is left
+     * alone. A legacy one, which sends no id, stays a pool.
+     */
+    bindSiblings(hostPid: number, sessionId: string): void;
     /**
      * `POST /proxy/poll`. Resolves with work, or with `undefined` at the poll
      * deadline so the proxy re-polls. Work held for this proxy while it was

package/dist/replay/executor.js

@@ -29,14 +29,16 @@
  * every proxy polls under its own id, and a step goes to, in order:
  *
  *   1. a proxy bound to the step's session — learned from a correlated step the
- *      proxy reported, or from an earlier step of this session it ran;
+ *      proxy reported, from an earlier step of this session it ran, or, when a
+ *      direct plan starts, from the host process it shares with the
+ *      `bir-scenario` that asked for the plan ({@link ProxyWorkQueue.bindSiblings});
  *   2. otherwise an unbound proxy, but ONLY while no other session is live
  *      (none bound elsewhere, and no server with two proxies polling — each
  *      session starts its own). A lone session's unbound proxy can only be
- *      its own. With two sessions open, the one that has not called the server
- *      yet cannot be told apart from the other: "the newest" was a guess, and
- *      when the older session asked it ran the step on the newer one's
- *      upstream — another browser page, another database session — and
+ *      its own. With two sessions open, a proxy nothing has tied to a session
+ *      cannot be told apart from the other session's: "the newest" was a
+ *      guess, and when the older session asked it ran the step on the newer
+ *      one's upstream — another browser page, another database session — and
  *      answered wrongly;
  *   3. otherwise NOBODY. A proxy bound, or possibly belonging, to another
  *      session is never used for this one: the call rejects with a
@@ -139,6 +141,38 @@ export class ProxyWorkQueue {
             by: "correlated",
         });
     }
+    /**
+     * Bind to `sessionId` every live proxy started by host process `hostPid` —
+     * the process that also started the `bir-scenario` asking for this
+     * session's plan. Claude Code starts a session's MCP servers as its own
+     * children, so a shared parent ties a proxy to the session before it has
+     * called anything. Without it a direct plan's first step was refused
+     * whenever another session held a proxy for the same server: `run_scenario`
+     * is the session's first call, so no correlated call could have bound one.
+     *
+     * A proxy proven to belong to another session (a correlated call) is left
+     * alone. A legacy one, which sends no id, stays a pool.
+     */
+    bindSiblings(hostPid, sessionId) {
+        for (const info of this.proxies.values()) {
+            if (info.ppid !== hostPid || !this.isLive(info) || isLegacy(info.proxyId))
+                continue;
+            if (info.sessionId === sessionId)
+                continue;
+            if (info.sessionId && info.boundBy === "correlated")
+                continue;
+            info.sessionId = sessionId;
+            info.boundBy = "sibling";
+            logDetail("replay.proxy_bound", {
+                server: info.serverName,
+                proxy: shortId(info.proxyId),
+                pid: info.pid,
+                sess: sessionId,
+                by: "sibling",
+                host: hostPid,
+            });
+        }
+    }
     /**
      * `POST /proxy/poll`. Resolves with work, or with `undefined` at the poll
      * deadline so the proxy re-polls. Work held for this proxy while it was
@@ -325,6 +359,7 @@ export class ProxyWorkQueue {
             serverName,
             startedAt: Number.isFinite(started) && started > 0 ? started : now,
             pid: who.pid,
+            ppid: who.ppid,
             lastSeen: now,
         });
     }

package/docs/calculatedReplay.md

@@ -126,9 +126,12 @@ plan, and keeps the stop.
 
 Server-side, and worth stating because the threshold in §4 is a judgement about it:
 
-- The embedding is of the run's **`input`** — the user's prompt — computed by
-  `Xenova/all-MiniLM-L6-v2` (`EMBEDDING_MODEL`), mean-pooled and normalized
-  (`recordings/embeddings.ts`).
+- The embedding is of the run's **`input`**, computed by `Xenova/all-MiniLM-L6-v2`
+  (`EMBEDDING_MODEL`), mean-pooled and normalized (`recordings/embeddings.ts`). The `input` is the
+  user's prompt as the runner cleaned it: Claude Code's own blocks in front of it removed and pasted
+  text unwrapped (fx121.md). Another host's prompt goes as it was sent. The model reads the first
+  512 tokens and drops the rest. The Claude in Chrome guide alone is 1,008, so a runner that sent it
+  in front of the prompt had only the guide embedded.
 - Candidates are **the caller's own canonical runs only** (`listUserRunEmbeddings(userId)`);
   duplicates and sub-threshold runs are excluded from the pool at record time.
 - **Inside one host** — on the service as built, which is not deployed yet. A run created with
@@ -1383,7 +1386,7 @@ fail because of BaseInstRunner.**
 | A call arrives while a pinned step is still running | It waits briefly for the pin to thread; still beside it, the plan hands over (`replay.concurrent_call`), `fell_back` or `failed` |
 | A pinned step fails (`PostToolUseFailure`, an error report from its proxy) | The plan hands over; nothing after it is pinned or approved |
 | A step cannot be sent: a built-in reached by a divergence, no proxy polling for its server, a server off `BIR_REPLAY_ALLOW_SERVERS` | Nothing is sent. The plan stops at that step and hands over (*"did not run … Nothing of it happened"*). With `BIR_REPLAY_RECORDED_OUTPUTS=1` its recorded output stands in instead |
-| Two sessions are open, and none of the server's proxies is known to be this session's | Nothing is sent: the step is not run, the plan hands over, and the model calls the tool on its own upstream. A lone session uses its unbound proxy as before |
+| Two sessions are open, and none of the server's proxies is known to be this session's | Nothing is sent: the step is not run, the plan hands over, and the model calls the tool on its own upstream. A lone session uses its unbound proxy as before. A direct plan first binds the proxies started by the same host process as its `bir-scenario`, so for one this is left to a proxy or `bir-scenario` that sends no `ppid` (an older runner), or a server the host started through a wrapper (a shell, `npx`), which gives it another parent |
 | A direct step exceeds `BIR_STEP_TIMEOUT_MS` | The proxy cancels the call upstream (`notifications/cancelled`) just before the control server gives up; the plan stops and hands over (*"was sent but did not answer … may or may not have completed"*). No recorded output stands in |
 | Whole plan exceeds its budget (`BIR_REPLAY_PLAN_BUDGET_MS`) | Return what completed behind a hand-over note, marked partial; outcome `diverged` (`failed` when no step had run) |
 | `run_scenario` cancelled (Esc) or `bir-scenario`'s 290 s timeout | No further step starts. The note saying which steps ran reaches the model on its next prompt or tool call; `fell_back` or `failed`, `measured: false` |
@@ -1512,7 +1515,12 @@ export class ProxyWorkQueue {
 > interchangeable: each holds its own upstream (another browser page, another database session). A
 > step goes to a proxy bound to the step's session — learned from a correlated call it reported, or
 > an earlier step of the session it ran — and otherwise to an unbound proxy **only while no other
-> session is live**. With two sessions open, a session with no bound proxy for the server gets none:
+> session is live**. A direct plan starts with `run_scenario`, the session's first call, so no call
+> of its own can have bound a proxy yet. But Claude Code starts all of a session's MCP servers as its
+> own children: every proxy sends its parent's pid (`ppid`) with its poll, `bir-scenario` sends its
+> own with `/scenario/run`, and before the plan runs the proxies with that parent are bound to the
+> session (`bindSiblings`). A proxy proven by a correlated call to be another session's is never
+> rebound. With two sessions open, a session with no bound proxy for the server still gets none:
 > the call rejects with `NoSessionProxyError`, nothing is sent, the step is recorded as `skipped`,
 > and the plan hands over so the model calls the tool on its own upstream. `bir replay` has no
 > session and takes the newest proxy.

package/docs/calculatedReplayGuide.md

@@ -637,6 +637,7 @@ Code's pool, as before.
 |---|---|---|
 | No `run.matched`, ever | Prompt below the server's `SIMILARITY_THRESHOLD` | Rephrase closer, or lower it server-side. Confirm the original run is in the list — a sub-`RECORDING_MIN_ACTIONS` run is never embedded |
 | `run.matched` but no `plan.armed` | A gate declined | Read the `replay.decision` line's `why=`. Ranked by frequency: replay off — `bir replay off`, `BIR_REPLAY=0`, or never switched on here (a `bir install` without `--replay`; `bir replay status` says which) · scenario not `ready` · similarity below threshold · no step is executable |
+| Every prompt in a session with Claude in Chrome connected matches the same recording, at 1.000 | A runner up to 0.3.12 sent the Claude in Chrome guide (1,008 tokens) as part of the prompt, and the service's model reads 512, so only the guide was embedded | Update the runner. Switch off the recordings whose prompt starts with `<browser_instruction>` (`bir investigate list` shows them), and record those tasks again: a recording keeps the embedding it was made with |
 | `replay.decision … code=match_timeout` or `code=service_unhealthy` on many prompts | The service answered the match slower than `BIR_MATCH_BUDGET_MS` (3 s), or is failing and in its cool-down | Nothing breaks: those turns run normally, and after a slow match prompts stop waiting on it for a while by themselves (`replay.match_gate`). `bir doctor` shows the service's state. Raise `BIR_MATCH_BUDGET_MS` only if the service is reliably just over it — every prompt pays it |
 | `replay.decision … code=arm_timeout`, `code=missing_target … derivation did not answer within …ms`, or `code=no_derive_key why="service: …"`, on a prompt that names its values | The reading of the prompt's values (the derivation) was too slow for the hook, or failed on the service. A hook waits `BIR_HOOK_DERIVE_BUDGET_MS` (8 s) for it, and the prompt hook never past 7.5 s from the prompt, match included; the service gives one reading `RUNNER_DERIVE_TIMEOUT_MS` (6 s) and then answers `service: error` or `service: timeout`, so its answer arrives inside the prompt's wait either way | Nothing to change in the prompt, and nothing to sign in to: that turn ran normally. The `replay.derived` line that follows says when the reading landed and what it cost. If it is slow every time, the service's reading model is the cause; `BIR_DERIVE_API_KEY` where Claude Code starts moves the reading to this machine |
 | `replay.decision … code=no_delivery_tool` | A direct plan, and no running `bir` server has told the recorder it serves `run_scenario`: the server is missing, disabled or failed in `/mcp`, was not added (a subdirectory or worktree of a repository), or the session was started with `BIR_OFF=1` | `/mcp` shows whether `bir` is connected. `bir install --replay` adds it, in the project's own directory; then start a new session |
@@ -652,7 +653,7 @@ Code's pool, as before.
 | `run_scenario` answers "Nothing to run for this request; continue normally." | The model called it on a turn with no plan, the runner is off, or no recorder is running for this directory | Harmless, and not an error. It happens when the model remembers the tool from an earlier turn |
 | `run_scenario` answers "The prepared results are not available for this request. Do the task normally with your tools." | The plan could not be delivered — a recorder that does not answer, a timeout, an HTTP error — and the model does the task itself | The `scenario.answered` line on the `bir` server's stderr has the real reason. `BIR_SCENARIO_DEBUG=1` in that server's environment hands the raw reason to the model as an error, for debugging |
 | A hand-over note says a step "was sent but did not answer … may or may not have completed" | The step timed out, or its upstream went away mid-call; nothing after it ran | Check whether its work happened before running it again — the model is told the same. Repeats: look at that upstream, or raise `BIR_STEP_TIMEOUT_MS` |
-| A hand-over note says "a step never runs on another session's upstream" | Two Claude Code sessions are open in the project, and this one has not yet made a call of its own to that server, so bir cannot tell its proxy from the other session's | Expected: the model calls the tool itself. Once the session's own call to the server has gone through, later replays use its proxy |
+| A hand-over note says "a step never runs on another session's upstream" | Two Claude Code sessions are open in the project, and this one has not yet made a call of its own to that server, so bir cannot tell its proxy from the other session's. A direct plan is told apart by the process that started both the `bir` server and the session's proxies, so for one this means an older proxy or `bir` server (restart the session after an update), or a server started through a wrapper such as a shell or `npx` | Expected: the model calls the tool itself. Once the session's own call to the server has gone through, later replays use its proxy |
 | A hand-over note says a step "was not run by the host", or "ran with arguments a person chose, not the scenario's" | A LangChain application (§6.5). A person said no to the step, or answered in the tool's place, or a call limit blocked the call (`host_rejected`); or a person changed the call before it ran (`host_edited`) | Expected, and no fault of the plan: the step is booked `skipped`, the plan stops there and the model takes over. It is told not to run the step again — after a refusal, unless the user asks. §7 has what the report says |
 | `recorder.send_failed … error="HTTP 409 … invalid_ticket"` | The execution report's ticket was already redeemed, or belongs to another scenario. Or the report came more than an hour after its plan was handed out | Harmless if the body says `duplicate: true`. Otherwise a rollover raced `SessionEnd`; the server books once. A report that came too late is not booked; the service as built (not deployed yet) takes a report for 24 hours |
 | `recorder.send_failed … error="HTTP 429 …"` | The account is over one of the service's limits, and the answer is `429` with `Retry-After`. The limits are built on the service and not deployed yet; each is a setting there. By default: 120 runs a minute · 3,000 steps a minute (a tool call is two steps) · 10 title requests a minute · 20 requests in any one hour for Calculate, Prefer and Recalculate together (`bir scenario calc` then prints a line that begins `Could not start calculation (HTTP 429`) | What it costs: a create, a step or a report is sent once more, at most 2 s later, then dropped. A dropped step is a hole in its recording. A run whose create got the 429 runs without its plan. A 429 that the second try did not cure counts as the service being unwell: for 5 to 60 seconds no prompt of that recorder waits for a match. An intent probe over its own limit (1,500 a minute) is answered with no match, never with `429` |
@@ -702,6 +703,12 @@ fix*. The three questions it answers:
 from the transcript, or the runner has no price for the model: update it."*
 The `run.unmeasured` line names what was missing.
 
+**A prompt the runner cleaned** has a `stripped` line under it: the blocks
+Claude Code put in front of what you typed (the Claude in Chrome guide, the
+open file, the selection), which the service never got, and the size before
+and after. A background task's notification has no words of yours at all: it
+shows `prompt    (none: a task notification, never matched)`.
+
 **A turn of another host** (a LangChain application, §6.5) is told apart by
 the journal's `run.start` line, which carries `host=<app>`. For such a turn:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basein/runner",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "A recording MCP proxy: sits between any MCP client and its MCP servers, executes each call on the client's behalf, and records the run as a reusable BaseIn scenario.",
   "type": "module",
   "license": "MIT",

package/production.md

@@ -537,6 +537,8 @@ Over 2-minute runs with one turn every 8 s (92 hooks):
 
 Truncation is always marked with the original size.
 
+**The prompt.** In a Claude Code session the prompt is sent without the blocks Claude Code puts in front of it (the Claude in Chrome guide, the open file, the selection, a task notification), and pasted text is unwrapped (fx121.md). So the open file's path and the selected text stay on the machine. A task notification with no words of the user's is sent with an empty prompt, which the service never matches. Another host's prompt is sent as it came.
+
 **What the service does with a report.** The service's new build refuses a report less easily for its size or its age (built, not deployed yet):
 
 - The prompt inside a report is cut at 10,000 characters. It used to be refused with 400.