@basein/runner 0.3.20 → 0.3.22

package/dist/control/recorder-main.js

@@ -26,7 +26,7 @@ import { DISCOVERY_CHECK_MS, HEARTBEAT_MS, pidAlive, readDiscovery, removeDiscov
 import { DAEMON_CWD_ENV, DAEMON_ENV, DAEMON_LOG_ENV, DERIVE_KEY_ENV, DaemonLog, USE_API_KEY_ENV, clearPortProblem, compareVersions, probeHealth, projectEndpoint, rediscover, validPort, writePortProblem, } from "./daemon.js";
 import { configDir, normalizePath, supersededLogPath } from "./paths.js";
 import { RecorderKeeper } from "./recorder-keeper.js";
-import { parseBashAllow, parseBuiltinTools } from "../replay/builtins.js";
+import { FILE_BUILTINS, parseBashAllow, parseBuiltinTools, parsePathAllow } from "../replay/builtins.js";
 import { parseAllowList } from "../replay/coverage.js";
 import { sweepDeliveries } from "../replay/bash-channel.js";
 import { exemptLoopbackFromProxy, isWrapped, projectRecord, projectToken, readSidecar, } from "../config/generate.js";
@@ -85,9 +85,8 @@ function wrappedServersFor(cwd) {
  * `BIR_INTENT_SOURCES` — which text a step's intent may be read from
  * (segmented.md R-INTENT-3). Unset or unparseable means all three.
  *
- * It governs only what is *sent*. Turning every source off does not stop a
- * probe: the request still goes out with an empty text and the server builds a
- * line from the tool name and arguments (R-HIT-4).
+ * It governs only what is *sent*. With every source off, a step goes out with
+ * no text, and no intent probe is sent for it.
  */
 function parseIntentSources(value) {
     if (value === undefined)
@@ -152,33 +151,12 @@ export function derivationKey(daemon = process.env[DAEMON_ENV] === "1") {
     }
     return {};
 }
-/**
- * `BIR_SEGMENT_ARM`: whether a segment the service hands out may run mid-task.
- * On unless it is `0`, from runner 0.3.19 (the service's segmentsbreakdown.md
- * SB-21): segments found by repeated work, and the halves after a plan's
- * decision. `0` is observe-only: what would have armed is logged, and nothing
- * is replaced. While it is on, whole plans may start mid-task by intent too:
- * `BIR_INTENT_ARM` follows it unless that is set.
- */
-export function segmentArmFromEnv(env = process.env) {
-    return env.BIR_SEGMENT_ARM !== "0";
-}
-/**
- * What the `replay.enabled` startup line says segments do. A segment starts
- * only where the probe is waited on, so `BIR_INTENT_ARM=0` starts nothing
- * mid-task, segments included — the rule `bir doctor` words from /health.
- */
-export function segmentsAtStartup(segmentArm, env = process.env) {
-    if (!segmentArm)
-        return "observed only (BIR_SEGMENT_ARM=0)";
-    return env.BIR_INTENT_ARM === "0" ? "observed only (BIR_INTENT_ARM=0)" : "run mid-task";
-}
 /**
  * Assemble the replay configuration (docs/calculatedReplay.md §5.3 of the guide).
  *
  * There is no steer threshold: a match the service hands out is steered
  * (controller.ts, gate 4). A recorder started with `BIR_MIN_STEER_SIMILARITY`
- * or `BIR_MIN_SEGMENT_STEER_SIMILARITY` set ignores them.
+ * set ignores it.
  */
 function buildReplayOptions(keeper, policy, key) {
     // The environment still wins — an operator at a terminal is the most
@@ -197,15 +175,18 @@ function buildReplayOptions(keeper, policy, key) {
             : undefined;
     // Which built-ins the runner may execute itself (replay/builtins.ts):
     // all six by default, `BIR_BUILTIN_TOOLS` to narrow them, `BIR_BASH_ALLOW`
-    // to narrow the commands a `Bash` step may run. Environment-only knobs,
-    // like `BIR_REPLAY_RECORDED_OUTPUTS`.
+    // to narrow the commands a `Bash` step may run, `BIR_PATH_ALLOW` the
+    // folders a file step may touch (unset: any, as the agent's own tools).
+    // Environment-only knobs, like `BIR_REPLAY_RECORDED_OUTPUTS`.
     const builtinTools = parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
     const bashAllow = parseBashAllow(process.env.BIR_BASH_ALLOW);
+    const pathAllow = parsePathAllow(process.env.BIR_PATH_ALLOW);
     const opts = {
         enabled,
         allowServers,
         builtinTools,
         bashAllow,
+        pathAllow,
         budgets: {
             // What a prompt may wait for its match (K5). Past it the prompt goes on
             // without one; a service slower than this must not cost every prompt.
@@ -224,22 +205,14 @@ function buildReplayOptions(keeper, policy, key) {
         // BIR_INTENT_MATCH=0 turns it off on its own.
         intentMatch: {
             enabled: process.env.BIR_INTENT_MATCH !== "0",
-            // The probe's own ceiling, not a wait on the hook's path: `PreToolUse`
-            // waits for it only while arming is on — the default, unless
-            // BIR_SEGMENT_ARM=0 or BIR_INTENT_ARM=0 — and then at most
+            // The probe's own ceiling, not a wait on the hook's path: a probe is sent
+            // only with BIR_INTENT_ARM=1, and `PreToolUse` waits for it at most
             // BIR_INTENT_ARM_BUDGET_MS (500 ms), never while the service is failing
-            // (control/server.ts); otherwise it answers without it (hit counting
-            // only). 4 000 leaves a request whose best segment lands in the
-            // not-clear band its one live question under the service's own 2 500 ms
-            // attempt (segmented.md R-HIT-11).
-            budgetMs: positiveInt(process.env.BIR_INTENT_MATCH_BUDGET_MS, 4_000),
+            // (control/server.ts).
+            budgetMs: positiveInt(process.env.BIR_INTENT_MATCH_BUDGET_MS, 1_500),
             maxPerTurn: positiveInt(process.env.BIR_INTENT_MATCHES_PER_TURN, 3),
             maxRequestsPerTurn: positiveInt(process.env.BIR_INTENT_REQUESTS_PER_TURN, 40),
         },
-        // On by default from 0.3.19 (the service's segmentsbreakdown.md SB-21): a
-        // plan that stops at its decision hands the rest to segments of each half,
-        // and they run only mid-task. BIR_SEGMENT_ARM=0 brings back observe-only.
-        segmentArm: segmentArmFromEnv(),
         // Both read live, never captured (C5). The recorder signs in after it
         // listens, refreshes the token as the session outlives it, and may sign
         // in or out while it runs; replay reads whatever holds *now*. The old
@@ -263,6 +236,15 @@ function buildReplayOptions(keeper, policy, key) {
             // all — loud for the same reason as the rest of this line.
             builtins: builtinTools.size > 0 ? [...builtinTools].join(",") : "(none)",
             bashAllow: builtinTools.has("Bash") ? (bashAllow.length > 0 ? bashAllow.join(",") : "(none — Bash steps are steered)") : undefined,
+            // Where the file tools may reach: anywhere, as the agent's own, unless
+            // BIR_PATH_ALLOW names folders (up to 0.3.20 the project alone).
+            pathAllow: [...builtinTools].some((name) => FILE_BUILTINS.has(name))
+                ? pathAllow.includes("*")
+                    ? "(any folder)"
+                    : pathAllow.length > 0
+                        ? pathAllow.join(",")
+                        : "(none — file steps are steered)"
+                : undefined,
             // Who reads what this turn acts on (segmented.md R-PARAM-5). Named at
             // startup because the third state is a replay that silently never runs.
             derive: key.source ??
@@ -270,8 +252,6 @@ function buildReplayOptions(keeper, policy, key) {
                     ? "the service"
                     : "recorded sample values — sign in, or a scenario with a target will not run"),
             intentMatch: opts.intentMatch?.enabled ? "on" : "off",
-            // Whether a segment the service hands out runs, or is only logged.
-            segments: segmentsAtStartup(opts.segmentArm === true),
             source,
             why: "a prompt that matches a calculated scenario runs it: the scenario's own steps run without a " +
                 "permission prompt of their own (never in plan mode); every other tool call is asked about as " +

package/dist/control/server.d.ts

@@ -272,17 +272,14 @@ export interface ControlServerOptions {
      */
     onStopRequested?: () => void;
     /**
-     * Whether an intent probe may arm a plan inside the `PreToolUse` that sent it
-     * (fallbk.md §Runner 4).
+     * Whether a match found mid-turn may arm a plan in the place of the call
+     * that found it (fallbk.md §Runner 4).
      *
      * Arming there means *waiting* there, on every unsteered tool call, for a
-     * service round trip. It waits (at most `BIR_INTENT_ARM_BUDGET_MS`, 500 ms,
-     * and never while the service is failing) when segment arming is on — the
-     * recorder's default from 0.3.19, `BIR_SEGMENT_ARM` unset or `1` — or when
-     * `BIR_INTENT_ARM=1` asks for whole-scenario intent arming. `BIR_INTENT_ARM=0`
-     * never waits. Otherwise, as in a server built with neither (a test, an
-     * embedder), the probe is sent without waiting, for hit counting only, and
-     * nothing arms mid-turn.
+     * service round trip — so it is off by default: no probe is sent and nothing
+     * arms mid-turn. `BIR_INTENT_ARM=1` turns it on, and then each call waits at
+     * most `BIR_INTENT_ARM_BUDGET_MS` (500 ms), and never while the service is
+     * failing. Unset or `BIR_INTENT_ARM=0` is off.
      */
     intentArm?: boolean;
     /**
@@ -441,8 +438,8 @@ export declare class ControlServer {
     private readonly deriveRecentResults;
     /**
      * Which rungs of R-INTENT-1 the runner may send (`BIR_INTENT_SOURCES`). It
-     * governs only what is *sent*: with every source off, the probe still goes out
-     * with an empty text and the server builds the tool line (R-HIT-4).
+     * governs only what is *sent*: with every source off, a step goes out with no
+     * text, and no intent probe is sent for it.
      */
     private readonly intentSources;
     constructor(opts: ControlServerOptions);
@@ -1144,154 +1141,44 @@ export declare class ControlServer {
      */
     private replayOverran;
     /**
-     * Recordings this turn must not count a step hit against (segmented.md
-     * R-HIT-7).
+     * Intent matching in the ReAct loop (fallbk.md §Runner 4).
      *
-     * A repeat of a recording's own prompt is *prompt* recurrence, counted as
-     * `iterations`, never step recurrence. Without this, three prompt repeats
-     * would reach `SEGMENT_MIN_HITS` on every step of the whole recording and the
-     * detector would build a whole-run-sized segment beside the whole-run
-     * scenario.
-     */
-    private excludeRunsFor;
-    /**
-     * Per plan of this turn, its recording and how far the plan got in its own
-     * chain (segmented.md R-OUT-6).
-     *
-     * The server uses it to refuse a segment that starts *before* where this turn
-     * already is: re-running steps the turn has just done is worse than not
-     * replaying at all. The position is the plan's own: the step it handed over
-     * at (its decision included), or its last step when it ran to its end. The
-     * server maps it onto the recording — a segment's first position, a
-     * decision's step before it — and takes the largest per recording (the
-     * service's segmentsbreakdown.md D18). One entry per plan, so that two plans
-     * of one recording, whose own positions are on different scales, never
-     * hide each other. A plan declined for anything but a known-bad first step
-     * reports nothing — it ran none of the recording, so it blocks none of it.
-     *
-     * Rebuilt on every probe rather than cached: a plan that hands over between
-     * two calls changes the answer.
-     */
-    private ranThroughFor;
-    /**
-     * Intent matching in the ReAct loop (fallbk.md §Runner 4, segmented.md 10.3).
-     *
-     * Called only while the model is driving. Every unsteered, non-housekeeping
-     * tool call is sent: the service counts it as a hit on whatever recorded step
-     * it matches, and may hand back a scenario or a segment to run in its place.
+     * Called only while the model is driving, and only when a match may arm a
+     * plan in the call's place ({@link intentArming}, off unless
+     * `BIR_INTENT_ARM=1`): the reasoning the call was made with is sent, and the
+     * service may hand back a whole scenario whose intent it matches. A call made
+     * with no reasoning sends nothing — there is no intent to match. Every
+     * failure is a miss.
      *
-     * A call made with **no reasoning at all** still probes (R-HIT-4): the server
-     * builds an intent from the tool name and arguments, and a step the agent took
-     * without narrating it is exactly as much a recurrence as one it explained.
-     * Every failure is a miss.
-     *
-     * THE PROBE IS NOT WAITED ON unless it may arm ({@link intentArming}). Hit
-     * counting needs no answer at all, and waiting for one put a service round
-     * trip — 70-450 ms healthy, the whole 4 s budget on a hung service — in front
-     * of every Read, Grep, Edit and Bash of every signed-in user. When it may arm,
-     * the wait is {@link intentArmBudgetMs} at most, and none while the service is
+     * The probe sits in front of the call, so it is waited on
+     * {@link intentArmBudgetMs} at most, and not at all while the service is
      * failing. Delivering a match on a *later* call instead is not an option: the
      * matched call has run by then, and the plan's first step would repeat it.
      */
     private tryIntentMatch;
     /**
      * Whether the model's call is plausibly `state`'s first step: its tool, and
-     * arguments the pin guard would pin to that step's input. The input is
-     * computed only for a step of the plan's own frame (a called segment's first
-     * step would build that segment's parameters here); anything that cannot be
-     * computed is "no" — the directive then rides on the call's PostToolUse.
+     * arguments the pin guard would pin to that step's input. Anything that
+     * cannot be computed is "no" — the directive then rides on the call's
+     * PostToolUse.
      */
     private isFirstStep;
     /**
-     * The agent's call against `state`'s first step, value for value (the
-     * service's offer1.md O5): `hit` when every argument is the step's own,
-     * `missing` when the only differences are values the plan does not have
-     * (a target the reading left empty, which the agent's call may hold), and
-     * `other` otherwise.
-     */
-    private firstStepVerdict;
-    /**
-     * Whether `state`'s plan calls `toolName` in a step it would run: what makes
-     * a plan started after a call of that tool make it a second time (the
-     * service's offer1.md O8). A tool that only reads never counts — reading
-     * twice changes nothing — by the service's own rule ({@link readsOnly}): a
-     * `crm_search_customers` mid-task never keeps a plan that searches later from
-     * starting.
-     */
-    private planCallsTool;
-    /**
-     * A plan of this turn stopped at its decision: ask the service, once per
-     * plan, which calculated scenarios can follow it, and arm each in the
-     * background while the agent reads the note and decides (offer1.md O3, O4).
-     * Called wherever a hand-over is first seen; a second call for the same plan
-     * does nothing.
-     */
-    private noteDecision;
-    /**
-     * Ask for a decision's next scenarios (offer1.md O3): each is checkable as
-     * soon as the service answers, and armed in the background, each on its own
-     * (O4). Resolves when the service has answered, not when the arms have.
-     * Never rejects.
-     */
-    private fetchNext;
-    /**
-     * Arm one next scenario in the background (offer1.md O4): its values read
-     * from the turn's request and its results so far — or, once more, with the
-     * agent's own call (O5) — and settled, so a call is compared with the first
-     * step as it would really run. Never rejects.
-     */
-    private armNext;
-    /**
-     * The agent's call after a decision, against the scenarios that can follow
-     * it (offer1.md O5, O6). A hit — the call is a scenario's first step, value
-     * for value — is answered in the call's place with that scenario's directive:
-     * the agent calls `run_scenario`, and the scenario runs every step, this one
-     * included, once. Undefined otherwise: the call runs as the agent wrote it.
-     */
-    private tryNextScenarios;
-    /** A next scenario's hit: bookkeeping as for any plan armed mid-task, then its directive in the call's place. */
-    private nextHit;
-    /**
-     * A next scenario hit after the agent's own calls — looks — opened the
-     * fragment of its work after the decision: the fragment ends here, with what
-     * the agent did itself, and nothing more of this turn is recorded into it.
-     * The scenario's own calls, pinned in steer mode or run in direct mode, are
-     * not the agent's work, and would make the fragment a copy of that scenario
-     * (offer1.md O7). A fragment still due is dropped instead
-     * ({@link dropDecisionFragment}).
-     */
-    private closeDecisionFragment;
-    /**
-     * End this turn's next scenarios (offer1.md O6): every one but the hit is
-     * never announced, so never runs and is never reported.
-     */
-    private endNext;
-    /**
-     * Whether an intent probe may arm a plan in its own `PreToolUse` — and so
-     * whether that hook waits for it. See {@link ControlServerOptions.intentArm}.
+     * Whether a match found mid-turn may arm a plan in its own `PreToolUse` — and
+     * so whether a probe is sent and waited for at all. Off unless
+     * `BIR_INTENT_ARM=1`. See {@link ControlServerOptions.intentArm}.
      */
     private intentArming;
     /** How long an arming probe is waited on: `BIR_INTENT_ARM_BUDGET_MS`, never past the probe's own budget. */
     private intentArmBudgetMs;
-    /** The bookkeeping half of a probe's answer: what `/health` and the log show. */
+    /** A probe's answer, for the log. Never throws: a malformed answer is a log line. */
     private noteProbe;
-    private noteProbeUnsafe;
     /**
      * Schedule a fragment once a matched turn's plan has handed over (fallbk.md
      * D7). Only a turn that is not already recording needs one: an unmatched turn
      * whose intent-armed plan handed over is recording the model's work anyway.
      */
     private noteHandover;
-    /**
-     * Drop a fragment scheduled at a decision (the service's
-     * segmentsbreakdown.md SB-16) when a plan the intent check armed takes the
-     * agent's next call: what follows is that plan's half, not the other one,
-     * and recorded as the other half it would become a wrong segment C. Cleared
-     * rather than ended, so a later hand-over of that plan schedules its own
-     * fragment, as any plan's does in a turn with none. Any other fragment is
-     * left as it is.
-     */
-    private dropDecisionFragment;
     /**
      * Open the fragment run and record from this call on (fallbk.md D7).
      *