@basein/runner 0.3.24 → 0.3.26

package/dist/replay/handover.js

@@ -129,6 +129,24 @@ export function buildHandoverNote(n) {
     }
     return truncate(lines.join("\n"), MAX_HANDOVER_NOTE);
 }
+/**
+ * The note for a plan that ran every one of its steps while its caller was
+ * gone (Esc on `run_scenario`, or the client's timeout), so that the results
+ * reached nobody. Nothing stopped, so no hand-over note exists; without this
+ * one the model was never told the steps ran, and the next request of the same
+ * task ran them again — a row added twice, a mail sent twice.
+ */
+export function buildUnseenResultNote(n) {
+    const intent = n.intent.length > 240 ? `${n.intent.slice(0, 240)}…` : n.intent;
+    const lines = [
+        "[BaseInstRunner calculated replay] The calculated scenario for the earlier request ran while its result",
+        "was not being waited for, so nobody has seen what it did.",
+    ];
+    if (intent)
+        lines.push(`Intent: ${intent}`);
+    lines.push(`${n.executed === n.totalSteps ? `All ${n.totalSteps}` : `${n.executed} of ${n.totalSteps}`} steps of the scenario ran, and their side effects are in place. Do not run them again.`, "If you need what they returned, look at the state they changed, or tell the user what ran and ask.");
+    return truncate(lines.join("\n"), MAX_HANDOVER_NOTE);
+}
 /** "Step 2", "Steps 1–3", "Steps 1, 3 and 5–6": 1-based numbers in order, runs joined. */
 export function stepsPhrase(numbers) {
     if (numbers.length === 0)

package/dist/replay/plan.d.ts

@@ -125,6 +125,14 @@ export interface DriveOptions {
      * they always were (bundle.ts, `AssembleOptions.reportTool`).
      */
     reportTool?: string;
+    /**
+     * Lay a run that went entirely well out briefly, with the plan's summary in
+     * it (bundle.ts, `AssembleOptions.brief`), and say so in the result's
+     * `brief`. For a caller whose agent answers from the bundle alone —
+     * `bir-scenario`'s run of a whole plan — not for an operator's `bir replay`,
+     * which reads every result. A run that went wrong is laid out in full.
+     */
+    brief?: boolean;
 }
 /**
  * Supplies a step's recorded output when its tool cannot run here (§8.1).
@@ -213,6 +221,13 @@ export interface ComposeResult {
      * the end of the planned steps.
      */
     endedAt: number;
+    /**
+     * The bundle is brief ({@link DriveOptions.brief}), and the plan's summary,
+     * when it has one, is in `text`: the caller must not deliver it again.
+     */
+    brief?: boolean;
+    /** Building the summary for a brief bundle threw: why. The bundle went without it. */
+    summaryError?: string;
 }
 /** Where, and why, a run stopped short of the chain's end (fallbk.md). */
 export interface PlanStop {

package/dist/replay/plan.js

@@ -21,7 +21,7 @@
  *      output, and skipping.
  */
 import { evalParamsLogic, evalResponseParamsLogic, evalToolInputLogic, evalToolOutputLogic, evalWhenLogic, LogicTimeoutError, } from "./logic.js";
-import { assembleBundle, bundleInput, MAX_REPLAY_REASON, testWords } from "./bundle.js";
+import { assembleBundle, bundleInput, MAX_REPLAY_REASON, testWords, wentWell, } from "./bundle.js";
 import { redact, redactText } from "../record/redact.js";
 import { sinkOfPlan, unsafeParameter } from "./safety.js";
 import { testedOnlyTargets } from "./targets.js";
@@ -883,6 +883,29 @@ export class ScenarioReplayPlan {
         // The intent is a paragraph the analyser wrote; it is context, not an
         // instruction, so it is clipped rather than dumped whole into the prompt.
         const intent = this.intent.length > 240 ? `${this.intent.slice(0, 240)}…` : this.intent;
+        if (this.mode === "direct") {
+            // The steps are not listed. The model does not call them, and what the
+            // tool returns names every call and says whether the run was whole or
+            // stopped short — what a list here once told it ahead of time. The list
+            // cost the agent up to 2,000 characters in the first call of every turn
+            // a plan was armed for (docs/calculatedReplay.md, "How a bundle reads"),
+            // and the tool's result shows an operator watching the session what ran.
+            return [
+                "[BaseInstRunner calculated replay] A known-good tool sequence was recorded",
+                `for this request${intent ? ` (intent: ${intent})` : ""}.`,
+                "",
+                `Call ${directToolName} once, with no arguments, before any other tool. It runs the`,
+                "sequence and returns what each call did.",
+                subTask
+                    ? "Then continue your task from the results it returns, calling tools as needed."
+                    : this.stopsEarly()
+                        ? "Then continue the user's request from the results it returns."
+                        : "Then answer the user's request from the results it returns.",
+                // A parked step (fallbk.md D3): the model is told up front that the
+                // plan is partial, so the hand-over that follows is expected.
+                ...(this.stopsEarly() ? ["", "The system will then hand the rest of the task back to you."] : []),
+            ].join("\n");
+        }
         // Each step's reasoning is another session's narration ("I'll now drop the
         // temp table…"), injected into this one. It is a label here, not a
         // paragraph: its first line, clipped. A chain long enough that even the
@@ -931,30 +954,6 @@ export class ScenarioReplayPlan {
         const tail = this.stopsEarly()
             ? ["", "The system will then hand the rest of the task back to you."]
             : [];
-        if (this.mode === "direct") {
-            // The sequence is listed even though the model does not call it itself:
-            // it is about to receive these results, and knowing what was run is what
-            // lets it tell a complete answer from a partial one. It is also the only
-            // place an operator watching the session can see what a replay is doing.
-            return [
-                "[BaseInstRunner calculated replay] A known-good tool sequence was recorded",
-                `for this request${intent ? ` (intent: ${intent})` : ""}.`,
-                "",
-                anyTest
-                    ? 'It runs these tools, in order, and returns their results. A step marked "only when" runs only when this request needs it, and the results say which ones did not:'
-                    : "It runs these tools, in order, and returns their results:",
-                "",
-                ...lines,
-                "",
-                `Call ${directToolName} once, with no arguments, before any other tool.`,
-                subTask
-                    ? "Then continue your task from the results it returns, calling tools as needed."
-                    : this.stopsEarly()
-                        ? "Then continue the user's request from the results it returns."
-                        : "Then answer the user's request from the results it returns.",
-                ...tail,
-            ].join("\n");
-        }
         return [
             "[BaseInstRunner calculated replay] A known-good tool sequence was previously",
             "recorded for this request. Call exactly these tools, in order, one at a time:",
@@ -1343,12 +1342,29 @@ export class ScenarioReplayPlan {
                 position: this.stopAt,
             };
         }
+        const layout = {
+            handover: stopped !== undefined,
+            subTask: this.subTask,
+            reportTool: opts.reportTool,
+        };
+        // Brief only for a run that went entirely well (bundle.ts, `wentWell`). A
+        // tool error that is not an MCP `isError` — a JSON-RPC error, which the
+        // bundle cannot tell from a result — is counted in `errored`, and is just
+        // as much a reason for the agent to see everything.
+        const brief = opts.brief === true && errored === 0 && wentWell(entries, layout);
+        let summaryError;
+        if (brief) {
+            let summary;
+            try {
+                summary = this.responseModel();
+            }
+            catch (err) {
+                summaryError = errText(err);
+            }
+            layout.brief = { summary };
+        }
         return {
-            text: assembleBundle(entries, maxChars, {
-                handover: stopped !== undefined,
-                subTask: this.subTask,
-                reportTool: opts.reportTool,
-            }),
+            text: assembleBundle(entries, maxChars, layout),
             executed,
             recorded: recordedCount,
             skipped,
@@ -1359,6 +1375,8 @@ export class ScenarioReplayPlan {
             stopped,
             aborted: aborted || undefined,
             endedAt: this.stepIndex,
+            brief: brief || undefined,
+            summaryError,
         };
     }
     /**

package/dist/replay/pricing.d.ts

@@ -15,27 +15,77 @@
  * numbers are comparable. For that row, right now, they are not.
  *
  * Bump the version — on **every** side — whenever a row changes.
+ *
+ * WHAT A PRICE DEPENDS ON BESIDE THE MODEL (Anthropic's pricing page, read
+ * 2026-11-11). Until this version a turn was priced from four token counts per
+ * model, and three things the bill reads were not looked at:
+ *
+ * - WHICH CACHE WAS WRITTEN. A 5-minute cache write bills at 1.25x input, a
+ *   1-hour one at 2x. Claude Code writes the 1-hour cache: in the transcripts
+ *   this was checked against, every cache write was a 1-hour one, and each was
+ *   priced 37.5% too low.
+ * - THE REQUEST'S OWN PROMPT LENGTH, on Claude Haiku 5.5: a request whose prompt
+ *   (input, cache reads and cache writes together) is over 100,000 tokens pays
+ *   five times the price. Each request is priced on its own.
+ * - HOW THE REQUEST RAN: fast mode bills at twice the standard prices, and
+ *   US-only inference at 1.1x.
+ *
+ * So a usage now says these of itself ({@link TokenUsage}), and whoever folds
+ * requests into totals keeps the requests that are priced differently apart
+ * ({@link requestRates}).
  */
 /** Identifies {@link MODEL_PRICING}. Must equal the service's constant. */
-export declare const PRICING_VERSION = "2026-09-24";
-/**
- * Tolerate provider prefixes (`anthropic/`, `us.anthropic.`), date snapshots and
- * unseen version bumps by falling back to the longest matching family, so a new
- * snapshot never silently prices at $0.
- */
-export declare function resolveModelPricing(model: string): {
+export declare const PRICING_VERSION = "2026-11-11";
+/** One rate card, in $/million tokens. */
+export interface ModelRates {
     input: number;
     output: number;
     cacheRead: number;
+    /** A write to the 5-minute cache. */
     cacheWrite: number;
-} | undefined;
-export declare function hasModelPricing(model: string): boolean;
-export interface TokenUsage {
+    /** A write to the 1-hour cache. */
+    cacheWrite1h: number;
+}
+/**
+ * A model's rate card, or undefined when the table has no row for it. With
+ * `longPrompt`, the card of a request over the model's prompt-length
+ * threshold, for a model that has one.
+ */
+export declare function resolveModelPricing(name: string, opts?: {
+    longPrompt?: boolean;
+}): ModelRates | undefined;
+export declare function hasModelPricing(name: string): boolean;
+/** What of a request, beside its model and its token counts, sets its prices. */
+export interface RateFlags {
+    /** Its prompt was over the model's long-prompt threshold (Haiku 5.5: 100,000 tokens). */
+    longPrompt?: boolean;
+    /** It ran in fast mode. */
+    fast?: boolean;
+    /** It ran on US-only inference. */
+    usOnly?: boolean;
+}
+export interface TokenUsage extends RateFlags {
     inputTokens: number;
     outputTokens: number;
     cacheReadTokens?: number;
+    /** Every cache write, the 1-hour ones among them. */
     cacheCreationTokens?: number;
+    /** Of {@link cacheCreationTokens}, the tokens written to the 1-hour cache. */
+    cacheCreation1hTokens?: number;
 }
+/**
+ * The flags of ONE request, from its own `usage` as the API reports it: its
+ * prompt length (input, cache reads and cache writes together), its `speed`
+ * and its `inference_geo`. Only what is so is set, so two requests priced
+ * alike give equal flags — and {@link rateKey} the same key.
+ */
+export declare function requestRates(name: string, request: {
+    promptTokens: number;
+    speed?: unknown;
+    inferenceGeo?: unknown;
+}): RateFlags;
+/** A short text that is equal for two sets of flags exactly when they price alike. "" for none. */
+export declare function rateKey(flags: RateFlags): string;
 /** Cost in USD. An unpriced model yields 0 — the caller reports `measured: false`. */
-export declare function calculateCostUsd(model: string, usage: TokenUsage): number;
+export declare function calculateCostUsd(name: string, usage: TokenUsage): number;
 //# sourceMappingURL=pricing.d.ts.map

package/dist/replay/pricing.js

@@ -15,70 +15,163 @@
  * numbers are comparable. For that row, right now, they are not.
  *
  * Bump the version — on **every** side — whenever a row changes.
+ *
+ * WHAT A PRICE DEPENDS ON BESIDE THE MODEL (Anthropic's pricing page, read
+ * 2026-11-11). Until this version a turn was priced from four token counts per
+ * model, and three things the bill reads were not looked at:
+ *
+ * - WHICH CACHE WAS WRITTEN. A 5-minute cache write bills at 1.25x input, a
+ *   1-hour one at 2x. Claude Code writes the 1-hour cache: in the transcripts
+ *   this was checked against, every cache write was a 1-hour one, and each was
+ *   priced 37.5% too low.
+ * - THE REQUEST'S OWN PROMPT LENGTH, on Claude Haiku 5.5: a request whose prompt
+ *   (input, cache reads and cache writes together) is over 100,000 tokens pays
+ *   five times the price. Each request is priced on its own.
+ * - HOW THE REQUEST RAN: fast mode bills at twice the standard prices, and
+ *   US-only inference at 1.1x.
+ *
+ * So a usage now says these of itself ({@link TokenUsage}), and whoever folds
+ * requests into totals keeps the requests that are priced differently apart
+ * ({@link requestRates}).
  */
 /** Identifies {@link MODEL_PRICING}. Must equal the service's constant. */
-export const PRICING_VERSION = "2026-09-24";
+export const PRICING_VERSION = "2026-11-11";
 /**
- * A 5-minute cache write bills at 1.25x input. Cache reads bill at 0.1x input,
- * except on models whose list price says otherwise (Opus 5.5, Fable 5.1), which
- * pass their read price in dollars.
+ * A rate card from its list prices. A 5-minute cache write bills at 1.25x
+ * input and a 1-hour one at 2x, on every model. A cache read bills at 0.1x
+ * input, except on the models whose list price says otherwise (0.05x on Opus
+ * 5.5 and Sonnet 5.5; 0.025x on Fable and Mythos 5.1 and 5.2), which pass
+ * their read price in dollars.
  */
 const priced = (input, output, cacheRead = input * 0.1) => ({
     input,
     output,
     cacheRead,
     cacheWrite: input * 1.25,
+    cacheWrite1h: input * 2,
 });
-const MODEL_PRICING = {
-    "claude-haiku-4-5": priced(1.0, 5.0),
-    "claude-haiku-4-5-20251001": priced(1.0, 5.0),
-    "claude-sonnet-4-5": priced(3.0, 15.0),
-    "claude-sonnet-4-6": priced(3.0, 15.0),
-    "claude-sonnet-5": priced(2.0, 10.0),
-    "claude-opus-4-5": priced(5.0, 25.0),
-    "claude-opus-4-6": priced(5.0, 25.0),
-    "claude-opus-4-7": priced(5.0, 25.0),
-    "claude-opus-4-8": priced(5.0, 25.0),
-    "claude-opus-5": priced(5.0, 25.0),
-    "claude-opus-5-5": priced(4.0, 20.0, 0.2),
-    "claude-fable-5": priced(10.0, 50.0),
-    "claude-fable-5-1": priced(10.0, 50.0, 0.25),
-};
+const model = (rates, longPrompt) => longPrompt ? { rates, longPrompt } : { rates };
+/**
+ * A Map, not an object: a model's name comes from a transcript or from another
+ * host's payload, and `table["constructor"]` on an object is a function, which
+ * priced a turn at NaN.
+ */
+const MODEL_PRICING = new Map([
+    ["claude-haiku-4-5", model(priced(1.0, 5.0))],
+    // Priced by prompt length: up to 100,000 tokens, and over.
+    ["claude-haiku-5-5", model(priced(0.1, 0.5), { overTokens: 100_000, rates: priced(0.5, 2.5) })],
+    ["claude-sonnet-4", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-0", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-5", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-6", model(priced(3.0, 15.0))],
+    ["claude-sonnet-5", model(priced(2.0, 10.0))],
+    ["claude-sonnet-5-5", model(priced(2.0, 10.0, 0.1))],
+    ["claude-opus-4", model(priced(15.0, 75.0))],
+    ["claude-opus-4-0", model(priced(15.0, 75.0))],
+    ["claude-opus-4-1", model(priced(15.0, 75.0))],
+    ["claude-opus-4-5", model(priced(5.0, 25.0))],
+    ["claude-opus-4-6", model(priced(5.0, 25.0))],
+    ["claude-opus-4-7", model(priced(5.0, 25.0))],
+    ["claude-opus-4-8", model(priced(5.0, 25.0))],
+    ["claude-opus-5", model(priced(5.0, 25.0))],
+    ["claude-opus-5-5", model(priced(4.0, 20.0, 0.2))],
+    ["claude-fable-5", model(priced(10.0, 50.0))],
+    ["claude-fable-5-1", model(priced(10.0, 50.0, 0.25))],
+    ["claude-fable-5-2", model(priced(8.0, 40.0, 0.2))],
+    ["claude-mythos-5", model(priced(10.0, 50.0))],
+    ["claude-mythos-5-1", model(priced(10.0, 50.0, 0.25))],
+    ["claude-mythos-5-2", model(priced(8.0, 40.0, 0.2))],
+]);
+/** Fast mode bills every kind of token at twice the standard price. */
+const FAST_FACTOR = 2;
+/** US-only inference (`inference_geo: "us"`) bills every kind of token at 1.1x. */
+const US_ONLY_FACTOR = 1.1;
+/**
+ * What may follow a model's name and still be that model: a dated snapshot
+ * (`-20251001`, `@20251001`), a cloud's version tag (`-v1:0`), `-latest`.
+ */
+const SNAPSHOT_SUFFIX = /^(?:[-@]\d{8})?(?:-v\d+(?::\d+)?)?(?:-latest)?$/;
 /**
- * Tolerate provider prefixes (`anthropic/`, `us.anthropic.`), date snapshots and
- * unseen version bumps by falling back to the longest matching family, so a new
- * snapshot never silently prices at $0.
+ * The table's row for a name: the name itself, or the name with a provider
+ * prefix (`anthropic/`, `us.anthropic.`), a host's tag (`[1m]`) or a snapshot
+ * suffix taken off.
+ *
+ * NEVER A NEWER VERSION PRICED AS AN OLDER ONE. This used to take the longest
+ * row that prefixed the name, "so a new snapshot never silently prices at $0".
+ * A new *version* is not a snapshot: `claude-opus-5-5` was priced as Opus 5
+ * until its row came, and `claude-fable-5-2` as Fable 5 — a quarter too dear
+ * on input and output, five times on cache reads — and each such turn was
+ * reported as measured. A version with no row has no price: the turn is
+ * reported unmeasured, and says which model to add (`run.unmeasured`).
  */
-export function resolveModelPricing(model) {
-    const exact = MODEL_PRICING[model];
+function pricedModel(name) {
+    const exact = MODEL_PRICING.get(name);
     if (exact)
         return exact;
-    // Strip a provider prefix: "us.anthropic.claude-haiku-4-5-v1:0" → "claude-haiku-4-5-v1:0".
-    const idx = model.indexOf("claude-");
-    const bare = idx >= 0 ? model.slice(idx) : model;
-    if (MODEL_PRICING[bare])
-        return MODEL_PRICING[bare];
-    // Longest declared family that prefixes the name — so a dated snapshot of a
-    // known model prices as that model rather than as nothing.
+    const at = name.indexOf("claude-");
+    const bare = (at >= 0 ? name.slice(at) : name).replace(/\[[^\]]*\]$/, "");
+    const known = MODEL_PRICING.get(bare);
+    if (known)
+        return known;
     let best;
-    for (const key of Object.keys(MODEL_PRICING)) {
-        if (bare.startsWith(key) && (!best || key.length > best.length))
+    for (const key of MODEL_PRICING.keys()) {
+        if (!bare.startsWith(key) || !SNAPSHOT_SUFFIX.test(bare.slice(key.length)))
+            continue;
+        if (!best || key.length > best.length)
             best = key;
     }
-    return best ? MODEL_PRICING[best] : undefined;
+    return best ? MODEL_PRICING.get(best) : undefined;
+}
+/**
+ * A model's rate card, or undefined when the table has no row for it. With
+ * `longPrompt`, the card of a request over the model's prompt-length
+ * threshold, for a model that has one.
+ */
+export function resolveModelPricing(name, opts = {}) {
+    const row = pricedModel(name);
+    if (!row)
+        return undefined;
+    return opts.longPrompt && row.longPrompt ? row.longPrompt.rates : row.rates;
+}
+export function hasModelPricing(name) {
+    return pricedModel(name) !== undefined;
+}
+/**
+ * The flags of ONE request, from its own `usage` as the API reports it: its
+ * prompt length (input, cache reads and cache writes together), its `speed`
+ * and its `inference_geo`. Only what is so is set, so two requests priced
+ * alike give equal flags — and {@link rateKey} the same key.
+ */
+export function requestRates(name, request) {
+    const flags = {};
+    const over = pricedModel(name)?.longPrompt?.overTokens;
+    if (over !== undefined && request.promptTokens > over)
+        flags.longPrompt = true;
+    if (request.speed === "fast")
+        flags.fast = true;
+    if (request.inferenceGeo === "us")
+        flags.usOnly = true;
+    return flags;
 }
-export function hasModelPricing(model) {
-    return resolveModelPricing(model) !== undefined;
+/** A short text that is equal for two sets of flags exactly when they price alike. "" for none. */
+export function rateKey(flags) {
+    return `${flags.longPrompt ? "|long" : ""}${flags.fast ? "|fast" : ""}${flags.usOnly ? "|us" : ""}`;
 }
 /** Cost in USD. An unpriced model yields 0 — the caller reports `measured: false`. */
-export function calculateCostUsd(model, usage) {
-    const p = resolveModelPricing(model);
+export function calculateCostUsd(name, usage) {
+    const p = resolveModelPricing(name, usage);
     if (!p)
         return 0;
+    const writes = Math.max(0, usage.cacheCreationTokens ?? 0);
+    const writes1h = Math.min(writes, Math.max(0, usage.cacheCreation1hTokens ?? 0));
+    const factor = (usage.fast ? FAST_FACTOR : 1) * (usage.usOnly ? US_ONLY_FACTOR : 1);
     const perToken = 1e-6;
-    return (usage.inputTokens * p.input * perToken +
-        usage.outputTokens * p.output * perToken +
-        (usage.cacheReadTokens ?? 0) * p.cacheRead * perToken +
-        (usage.cacheCreationTokens ?? 0) * p.cacheWrite * perToken);
+    return (factor *
+        perToken *
+        (usage.inputTokens * p.input +
+            usage.outputTokens * p.output +
+            (usage.cacheReadTokens ?? 0) * p.cacheRead +
+            (writes - writes1h) * p.cacheWrite +
+            writes1h * p.cacheWrite1h));
 }
 //# sourceMappingURL=pricing.js.map

package/dist/replay/safety.js

@@ -49,7 +49,30 @@ const WRITE_BUILTINS = new Set(["Edit", "MultiEdit", "Write", "NotebookEdit"]);
  * with the server.
  */
 const MCP_SHELL_WORD = /(?:^|[_.-])(?:shell|bash|sh|zsh|ssh|exec|execute|command|cmd|terminal|powershell|pwsh)(?:$|[_.-])/i;
-const MCP_COMMAND_WORD = /(?:^|[_.-])(?:sql|tsql|query|exec|execute|shell|bash|sh|zsh|ssh|command|cmd|script|eval|terminal|psql|mysql|mssql|sqlite|duckdb|postgres|postgresql|powershell|pwsh)(?:$|[_.-])/i;
+const MCP_COMMAND_WORD = /(?:^|[_.-])(?:sql|tsql|query|exec|execute|shell|bash|sh|zsh|ssh|command|cmd|script|eval|cypher|terminal|psql|mysql|mssql|sqlite|duckdb|postgres|postgresql|powershell|pwsh)(?:$|[_.-])/i;
+/**
+ * A tool whose input is code runs it as surely as a shell runs a command:
+ * `run_code`, `execute_python`, `code_interpreter`, `python_repl`, a
+ * `javascript_tool`, `browser_evaluate`, `evaluate_script`. Known by the words
+ * that say the code is run, and not by the language's name alone: as words of
+ * their own, `code`, `python`, `javascript` and `evaluate` made a command of
+ * `search_code`, `get_postal_code`, `send_verification_code`, `evaluate_answer`
+ * and of every tool of a `python-docs` or `claude-code` server — and with one
+ * such step every value of the plan was held to a command's rules, so a query
+ * with a quote in it handed the plan over. Whole words only, as above:
+ * `decode_token` and a `barcode` have the letters of `code` and are not it.
+ */
+const MCP_CODE_RUNNER = new RegExp(`(?:^|[_.-])(?:${[
+    "(?:run|exec|execute|eval)[_.-](?:code|python|py|javascript|js|typescript|ts|node)",
+    "(?:code|python|py|javascript|js|typescript|node)[_.-](?:run|runner|exec|execute|executor|eval|interpreter|repl)",
+    "(?:javascript|js)[_.-]tool",
+    "(?:browser|page|puppeteer|playwright|frame|tab|chrome|devtools)[_.-]evaluate",
+    "evaluate[_.-](?:script|js|javascript|expression|code)",
+].join("|")})(?:$|[_.-])`, "i");
+/** Whether a name, split into words ({@link nameWords}), says its input is run. */
+function saysRun(words) {
+    return MCP_COMMAND_WORD.test(words) || MCP_CODE_RUNNER.test(words);
+}
 /**
  * A tool or server name as delimited words: camelCase, PascalCase and acronym
  * runs are split with `_`, so `executeSql` reads as `execute_Sql`, `runSQL` as
@@ -66,6 +89,18 @@ function mcpNameSays(toolName, words) {
         return false;
     return words.test(nameWords(mcp.toolName)) || words.test(nameWords(mcp.serverName));
 }
+/**
+ * Whether an MCP tool's name, its server's, or the two read together say its
+ * input is run: `mcp__python__run` says it only with both (`python_run`).
+ */
+function mcpRunsInput(toolName) {
+    const mcp = parseQualifiedName(toolName);
+    if (!mcp)
+        return false;
+    const tool = nameWords(mcp.toolName);
+    const server = nameWords(mcp.serverName);
+    return saysRun(tool) || saysRun(server) || MCP_CODE_RUNNER.test(`${server}_${tool}`);
+}
 /**
  * Characters and sequences that end a quoted string or begin another command
  * in a POSIX shell, PowerShell or SQL. Deliberately wide: an apostrophe in a
@@ -105,13 +140,13 @@ export function sinkOf(toolName, host) {
             return "command";
         if (host.write?.includes(name))
             return "write";
-        return plainNameSays(name, MCP_COMMAND_WORD) ? "command" : undefined;
+        return saysRun(nameWords(name)) ? "command" : undefined;
     }
     if (SHELL_BUILTINS.has(name))
         return "command";
     if (WRITE_BUILTINS.has(name))
         return "write";
-    return mcpNameSays(name, MCP_COMMAND_WORD) ? "command" : undefined;
+    return mcpRunsInput(name) ? "command" : undefined;
 }
 /** Whether this tool's input is run or written: a shell, a file edit, a query. */
 export function isCommandSink(toolName) {
@@ -189,8 +224,11 @@ const SQL_BOOLEAN_WORD = /\b(?:or|and|union)\b/gi;
  * keeps it.
  */
 function offShape(value, sample) {
-    // A number stays a number: `1 OR 1=1` is not a user id.
-    if (typeof sample === "number") {
+    // A number stays a number: `1 OR 1=1` is not a user id. A number kept as
+    // text (`"42"`) is a number all the same: with that sample, `"… WHERE
+    // user_id = " + parameters.v` took the value `user_id` and matched every
+    // row, where the sample 42 refused it.
+    if (typeof sample === "number" || (typeof sample === "string" && NUMERIC.test(sample))) {
         if (typeof value === "number")
             return Number.isFinite(value) ? undefined : String(value);
         if (typeof value !== "string" || !NUMERIC.test(value))

package/dist/upstream/http-client.d.ts

@@ -41,12 +41,14 @@
  *      `initialize` got a 405 and the server showed as failed every session).
  *      A stream that ends — cleanly or not — is noticed, the requests riding it
  *      are answered, and it is re-established with backoff; the new session is
- *      re-initialised with the host's own `initialize` before anything else.
+ *      re-initialised with the host's own `initialize` before anything else,
+ *      and a stream whose re-initialisation fails is a reconnect that failed.
  *   4. **Session expiry is survivable.** A 404 to a request that carried a
  *      session means the server forgot us (a redeploy, an idle timeout). The
  *      spec says start a new session; the proxy does it for the host — replays
  *      the host's cached `initialize` under a `bir:` id, sends `initialized`,
- *      and retries the request once.
+ *      and retries the request once. A replay that fails is tried again when
+ *      the next request meets the same 404.
  *   5. **No timeout shorter than the host's.** The transport (http-transport.ts)
  *      bounds the connect only; how long a tool may take is Claude Code's call,
  *      and its cancellation reaches the server immediately (rule 2). What no
@@ -200,7 +202,8 @@ export declare class HttpUpstreamClient extends BaseUpstreamClient {
     /**
      * Replay the host's `initialize` (under a `bir:` id) and `initialized`.
      * `news`: say it on stderr when it worked — after a forgotten session or an
-     * outage; after a routine reconnect it is detail. A failure is always said.
+     * outage; after a routine reconnect it is detail. A failure is said, unless
+     * `failureSaid`: it is one more of an outage whose first failure was.
      */
     private reinitialize;
     /**