@basein/runner 0.3.25 → 0.3.26

package/dist/replay/pricing.js

@@ -15,70 +15,163 @@
  * numbers are comparable. For that row, right now, they are not.
  *
  * Bump the version — on **every** side — whenever a row changes.
+ *
+ * WHAT A PRICE DEPENDS ON BESIDE THE MODEL (Anthropic's pricing page, read
+ * 2026-11-11). Until this version a turn was priced from four token counts per
+ * model, and three things the bill reads were not looked at:
+ *
+ * - WHICH CACHE WAS WRITTEN. A 5-minute cache write bills at 1.25x input, a
+ *   1-hour one at 2x. Claude Code writes the 1-hour cache: in the transcripts
+ *   this was checked against, every cache write was a 1-hour one, and each was
+ *   priced 37.5% too low.
+ * - THE REQUEST'S OWN PROMPT LENGTH, on Claude Haiku 5.5: a request whose prompt
+ *   (input, cache reads and cache writes together) is over 100,000 tokens pays
+ *   five times the price. Each request is priced on its own.
+ * - HOW THE REQUEST RAN: fast mode bills at twice the standard prices, and
+ *   US-only inference at 1.1x.
+ *
+ * So a usage now says these of itself ({@link TokenUsage}), and whoever folds
+ * requests into totals keeps the requests that are priced differently apart
+ * ({@link requestRates}).
  */
 /** Identifies {@link MODEL_PRICING}. Must equal the service's constant. */
-export const PRICING_VERSION = "2026-09-24";
+export const PRICING_VERSION = "2026-11-11";
 /**
- * A 5-minute cache write bills at 1.25x input. Cache reads bill at 0.1x input,
- * except on models whose list price says otherwise (Opus 5.5, Fable 5.1), which
- * pass their read price in dollars.
+ * A rate card from its list prices. A 5-minute cache write bills at 1.25x
+ * input and a 1-hour one at 2x, on every model. A cache read bills at 0.1x
+ * input, except on the models whose list price says otherwise (0.05x on Opus
+ * 5.5 and Sonnet 5.5; 0.025x on Fable and Mythos 5.1 and 5.2), which pass
+ * their read price in dollars.
  */
 const priced = (input, output, cacheRead = input * 0.1) => ({
     input,
     output,
     cacheRead,
     cacheWrite: input * 1.25,
+    cacheWrite1h: input * 2,
 });
-const MODEL_PRICING = {
-    "claude-haiku-4-5": priced(1.0, 5.0),
-    "claude-haiku-4-5-20251001": priced(1.0, 5.0),
-    "claude-sonnet-4-5": priced(3.0, 15.0),
-    "claude-sonnet-4-6": priced(3.0, 15.0),
-    "claude-sonnet-5": priced(2.0, 10.0),
-    "claude-opus-4-5": priced(5.0, 25.0),
-    "claude-opus-4-6": priced(5.0, 25.0),
-    "claude-opus-4-7": priced(5.0, 25.0),
-    "claude-opus-4-8": priced(5.0, 25.0),
-    "claude-opus-5": priced(5.0, 25.0),
-    "claude-opus-5-5": priced(4.0, 20.0, 0.2),
-    "claude-fable-5": priced(10.0, 50.0),
-    "claude-fable-5-1": priced(10.0, 50.0, 0.25),
-};
+const model = (rates, longPrompt) => longPrompt ? { rates, longPrompt } : { rates };
+/**
+ * A Map, not an object: a model's name comes from a transcript or from another
+ * host's payload, and `table["constructor"]` on an object is a function, which
+ * priced a turn at NaN.
+ */
+const MODEL_PRICING = new Map([
+    ["claude-haiku-4-5", model(priced(1.0, 5.0))],
+    // Priced by prompt length: up to 100,000 tokens, and over.
+    ["claude-haiku-5-5", model(priced(0.1, 0.5), { overTokens: 100_000, rates: priced(0.5, 2.5) })],
+    ["claude-sonnet-4", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-0", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-5", model(priced(3.0, 15.0))],
+    ["claude-sonnet-4-6", model(priced(3.0, 15.0))],
+    ["claude-sonnet-5", model(priced(2.0, 10.0))],
+    ["claude-sonnet-5-5", model(priced(2.0, 10.0, 0.1))],
+    ["claude-opus-4", model(priced(15.0, 75.0))],
+    ["claude-opus-4-0", model(priced(15.0, 75.0))],
+    ["claude-opus-4-1", model(priced(15.0, 75.0))],
+    ["claude-opus-4-5", model(priced(5.0, 25.0))],
+    ["claude-opus-4-6", model(priced(5.0, 25.0))],
+    ["claude-opus-4-7", model(priced(5.0, 25.0))],
+    ["claude-opus-4-8", model(priced(5.0, 25.0))],
+    ["claude-opus-5", model(priced(5.0, 25.0))],
+    ["claude-opus-5-5", model(priced(4.0, 20.0, 0.2))],
+    ["claude-fable-5", model(priced(10.0, 50.0))],
+    ["claude-fable-5-1", model(priced(10.0, 50.0, 0.25))],
+    ["claude-fable-5-2", model(priced(8.0, 40.0, 0.2))],
+    ["claude-mythos-5", model(priced(10.0, 50.0))],
+    ["claude-mythos-5-1", model(priced(10.0, 50.0, 0.25))],
+    ["claude-mythos-5-2", model(priced(8.0, 40.0, 0.2))],
+]);
+/** Fast mode bills every kind of token at twice the standard price. */
+const FAST_FACTOR = 2;
+/** US-only inference (`inference_geo: "us"`) bills every kind of token at 1.1x. */
+const US_ONLY_FACTOR = 1.1;
+/**
+ * What may follow a model's name and still be that model: a dated snapshot
+ * (`-20251001`, `@20251001`), a cloud's version tag (`-v1:0`), `-latest`.
+ */
+const SNAPSHOT_SUFFIX = /^(?:[-@]\d{8})?(?:-v\d+(?::\d+)?)?(?:-latest)?$/;
 /**
- * Tolerate provider prefixes (`anthropic/`, `us.anthropic.`), date snapshots and
- * unseen version bumps by falling back to the longest matching family, so a new
- * snapshot never silently prices at $0.
+ * The table's row for a name: the name itself, or the name with a provider
+ * prefix (`anthropic/`, `us.anthropic.`), a host's tag (`[1m]`) or a snapshot
+ * suffix taken off.
+ *
+ * NEVER A NEWER VERSION PRICED AS AN OLDER ONE. This used to take the longest
+ * row that prefixed the name, "so a new snapshot never silently prices at $0".
+ * A new *version* is not a snapshot: `claude-opus-5-5` was priced as Opus 5
+ * until its row came, and `claude-fable-5-2` as Fable 5 — a quarter too dear
+ * on input and output, five times on cache reads — and each such turn was
+ * reported as measured. A version with no row has no price: the turn is
+ * reported unmeasured, and says which model to add (`run.unmeasured`).
  */
-export function resolveModelPricing(model) {
-    const exact = MODEL_PRICING[model];
+function pricedModel(name) {
+    const exact = MODEL_PRICING.get(name);
     if (exact)
         return exact;
-    // Strip a provider prefix: "us.anthropic.claude-haiku-4-5-v1:0" → "claude-haiku-4-5-v1:0".
-    const idx = model.indexOf("claude-");
-    const bare = idx >= 0 ? model.slice(idx) : model;
-    if (MODEL_PRICING[bare])
-        return MODEL_PRICING[bare];
-    // Longest declared family that prefixes the name — so a dated snapshot of a
-    // known model prices as that model rather than as nothing.
+    const at = name.indexOf("claude-");
+    const bare = (at >= 0 ? name.slice(at) : name).replace(/\[[^\]]*\]$/, "");
+    const known = MODEL_PRICING.get(bare);
+    if (known)
+        return known;
     let best;
-    for (const key of Object.keys(MODEL_PRICING)) {
-        if (bare.startsWith(key) && (!best || key.length > best.length))
+    for (const key of MODEL_PRICING.keys()) {
+        if (!bare.startsWith(key) || !SNAPSHOT_SUFFIX.test(bare.slice(key.length)))
+            continue;
+        if (!best || key.length > best.length)
             best = key;
     }
-    return best ? MODEL_PRICING[best] : undefined;
+    return best ? MODEL_PRICING.get(best) : undefined;
+}
+/**
+ * A model's rate card, or undefined when the table has no row for it. With
+ * `longPrompt`, the card of a request over the model's prompt-length
+ * threshold, for a model that has one.
+ */
+export function resolveModelPricing(name, opts = {}) {
+    const row = pricedModel(name);
+    if (!row)
+        return undefined;
+    return opts.longPrompt && row.longPrompt ? row.longPrompt.rates : row.rates;
+}
+export function hasModelPricing(name) {
+    return pricedModel(name) !== undefined;
+}
+/**
+ * The flags of ONE request, from its own `usage` as the API reports it: its
+ * prompt length (input, cache reads and cache writes together), its `speed`
+ * and its `inference_geo`. Only what is so is set, so two requests priced
+ * alike give equal flags — and {@link rateKey} the same key.
+ */
+export function requestRates(name, request) {
+    const flags = {};
+    const over = pricedModel(name)?.longPrompt?.overTokens;
+    if (over !== undefined && request.promptTokens > over)
+        flags.longPrompt = true;
+    if (request.speed === "fast")
+        flags.fast = true;
+    if (request.inferenceGeo === "us")
+        flags.usOnly = true;
+    return flags;
 }
-export function hasModelPricing(model) {
-    return resolveModelPricing(model) !== undefined;
+/** A short text that is equal for two sets of flags exactly when they price alike. "" for none. */
+export function rateKey(flags) {
+    return `${flags.longPrompt ? "|long" : ""}${flags.fast ? "|fast" : ""}${flags.usOnly ? "|us" : ""}`;
 }
 /** Cost in USD. An unpriced model yields 0 — the caller reports `measured: false`. */
-export function calculateCostUsd(model, usage) {
-    const p = resolveModelPricing(model);
+export function calculateCostUsd(name, usage) {
+    const p = resolveModelPricing(name, usage);
     if (!p)
         return 0;
+    const writes = Math.max(0, usage.cacheCreationTokens ?? 0);
+    const writes1h = Math.min(writes, Math.max(0, usage.cacheCreation1hTokens ?? 0));
+    const factor = (usage.fast ? FAST_FACTOR : 1) * (usage.usOnly ? US_ONLY_FACTOR : 1);
     const perToken = 1e-6;
-    return (usage.inputTokens * p.input * perToken +
-        usage.outputTokens * p.output * perToken +
-        (usage.cacheReadTokens ?? 0) * p.cacheRead * perToken +
-        (usage.cacheCreationTokens ?? 0) * p.cacheWrite * perToken);
+    return (factor *
+        perToken *
+        (usage.inputTokens * p.input +
+            usage.outputTokens * p.output +
+            (usage.cacheReadTokens ?? 0) * p.cacheRead +
+            (writes - writes1h) * p.cacheWrite +
+            writes1h * p.cacheWrite1h));
 }
 //# sourceMappingURL=pricing.js.map

package/dist/replay/safety.js

@@ -49,7 +49,30 @@ const WRITE_BUILTINS = new Set(["Edit", "MultiEdit", "Write", "NotebookEdit"]);
  * with the server.
  */
 const MCP_SHELL_WORD = /(?:^|[_.-])(?:shell|bash|sh|zsh|ssh|exec|execute|command|cmd|terminal|powershell|pwsh)(?:$|[_.-])/i;
-const MCP_COMMAND_WORD = /(?:^|[_.-])(?:sql|tsql|query|exec|execute|shell|bash|sh|zsh|ssh|command|cmd|script|eval|terminal|psql|mysql|mssql|sqlite|duckdb|postgres|postgresql|powershell|pwsh)(?:$|[_.-])/i;
+const MCP_COMMAND_WORD = /(?:^|[_.-])(?:sql|tsql|query|exec|execute|shell|bash|sh|zsh|ssh|command|cmd|script|eval|cypher|terminal|psql|mysql|mssql|sqlite|duckdb|postgres|postgresql|powershell|pwsh)(?:$|[_.-])/i;
+/**
+ * A tool whose input is code runs it as surely as a shell runs a command:
+ * `run_code`, `execute_python`, `code_interpreter`, `python_repl`, a
+ * `javascript_tool`, `browser_evaluate`, `evaluate_script`. Known by the words
+ * that say the code is run, and not by the language's name alone: as words of
+ * their own, `code`, `python`, `javascript` and `evaluate` made a command of
+ * `search_code`, `get_postal_code`, `send_verification_code`, `evaluate_answer`
+ * and of every tool of a `python-docs` or `claude-code` server — and with one
+ * such step every value of the plan was held to a command's rules, so a query
+ * with a quote in it handed the plan over. Whole words only, as above:
+ * `decode_token` and a `barcode` have the letters of `code` and are not it.
+ */
+const MCP_CODE_RUNNER = new RegExp(`(?:^|[_.-])(?:${[
+    "(?:run|exec|execute|eval)[_.-](?:code|python|py|javascript|js|typescript|ts|node)",
+    "(?:code|python|py|javascript|js|typescript|node)[_.-](?:run|runner|exec|execute|executor|eval|interpreter|repl)",
+    "(?:javascript|js)[_.-]tool",
+    "(?:browser|page|puppeteer|playwright|frame|tab|chrome|devtools)[_.-]evaluate",
+    "evaluate[_.-](?:script|js|javascript|expression|code)",
+].join("|")})(?:$|[_.-])`, "i");
+/** Whether a name, split into words ({@link nameWords}), says its input is run. */
+function saysRun(words) {
+    return MCP_COMMAND_WORD.test(words) || MCP_CODE_RUNNER.test(words);
+}
 /**
  * A tool or server name as delimited words: camelCase, PascalCase and acronym
  * runs are split with `_`, so `executeSql` reads as `execute_Sql`, `runSQL` as
@@ -66,6 +89,18 @@ function mcpNameSays(toolName, words) {
         return false;
     return words.test(nameWords(mcp.toolName)) || words.test(nameWords(mcp.serverName));
 }
+/**
+ * Whether an MCP tool's name, its server's, or the two read together say its
+ * input is run: `mcp__python__run` says it only with both (`python_run`).
+ */
+function mcpRunsInput(toolName) {
+    const mcp = parseQualifiedName(toolName);
+    if (!mcp)
+        return false;
+    const tool = nameWords(mcp.toolName);
+    const server = nameWords(mcp.serverName);
+    return saysRun(tool) || saysRun(server) || MCP_CODE_RUNNER.test(`${server}_${tool}`);
+}
 /**
  * Characters and sequences that end a quoted string or begin another command
  * in a POSIX shell, PowerShell or SQL. Deliberately wide: an apostrophe in a
@@ -105,13 +140,13 @@ export function sinkOf(toolName, host) {
             return "command";
         if (host.write?.includes(name))
             return "write";
-        return plainNameSays(name, MCP_COMMAND_WORD) ? "command" : undefined;
+        return saysRun(nameWords(name)) ? "command" : undefined;
     }
     if (SHELL_BUILTINS.has(name))
         return "command";
     if (WRITE_BUILTINS.has(name))
         return "write";
-    return mcpNameSays(name, MCP_COMMAND_WORD) ? "command" : undefined;
+    return mcpRunsInput(name) ? "command" : undefined;
 }
 /** Whether this tool's input is run or written: a shell, a file edit, a query. */
 export function isCommandSink(toolName) {
@@ -189,8 +224,11 @@ const SQL_BOOLEAN_WORD = /\b(?:or|and|union)\b/gi;
  * keeps it.
  */
 function offShape(value, sample) {
-    // A number stays a number: `1 OR 1=1` is not a user id.
-    if (typeof sample === "number") {
+    // A number stays a number: `1 OR 1=1` is not a user id. A number kept as
+    // text (`"42"`) is a number all the same: with that sample, `"… WHERE
+    // user_id = " + parameters.v` took the value `user_id` and matched every
+    // row, where the sample 42 refused it.
+    if (typeof sample === "number" || (typeof sample === "string" && NUMERIC.test(sample))) {
         if (typeof value === "number")
             return Number.isFinite(value) ? undefined : String(value);
         if (typeof value !== "string" || !NUMERIC.test(value))

package/dist/upstream/http-client.d.ts

@@ -41,12 +41,14 @@
  *      `initialize` got a 405 and the server showed as failed every session).
  *      A stream that ends — cleanly or not — is noticed, the requests riding it
  *      are answered, and it is re-established with backoff; the new session is
- *      re-initialised with the host's own `initialize` before anything else.
+ *      re-initialised with the host's own `initialize` before anything else,
+ *      and a stream whose re-initialisation fails is a reconnect that failed.
  *   4. **Session expiry is survivable.** A 404 to a request that carried a
  *      session means the server forgot us (a redeploy, an idle timeout). The
  *      spec says start a new session; the proxy does it for the host — replays
  *      the host's cached `initialize` under a `bir:` id, sends `initialized`,
- *      and retries the request once.
+ *      and retries the request once. A replay that fails is tried again when
+ *      the next request meets the same 404.
  *   5. **No timeout shorter than the host's.** The transport (http-transport.ts)
  *      bounds the connect only; how long a tool may take is Claude Code's call,
  *      and its cancellation reaches the server immediately (rule 2). What no
@@ -200,7 +202,8 @@ export declare class HttpUpstreamClient extends BaseUpstreamClient {
     /**
      * Replay the host's `initialize` (under a `bir:` id) and `initialized`.
      * `news`: say it on stderr when it worked — after a forgotten session or an
-     * outage; after a routine reconnect it is detail. A failure is always said.
+     * outage; after a routine reconnect it is detail. A failure is said, unless
+     * `failureSaid`: it is one more of an outage whose first failure was.
      */
     private reinitialize;
     /**

package/dist/upstream/http-client.js

@@ -41,12 +41,14 @@
  *      `initialize` got a 405 and the server showed as failed every session).
  *      A stream that ends — cleanly or not — is noticed, the requests riding it
  *      are answered, and it is re-established with backoff; the new session is
- *      re-initialised with the host's own `initialize` before anything else.
+ *      re-initialised with the host's own `initialize` before anything else,
+ *      and a stream whose re-initialisation fails is a reconnect that failed.
  *   4. **Session expiry is survivable.** A 404 to a request that carried a
  *      session means the server forgot us (a redeploy, an idle timeout). The
  *      spec says start a new session; the proxy does it for the host — replays
  *      the host's cached `initialize` under a `bir:` id, sends `initialized`,
- *      and retries the request once.
+ *      and retries the request once. A replay that fails is tried again when
+ *      the next request meets the same 404.
  *   5. **No timeout shorter than the host's.** The transport (http-transport.ts)
  *      bounds the connect only; how long a tool may take is Claude Code's call,
  *      and its cancellation reaches the server immediately (rule 2). What no
@@ -72,7 +74,7 @@
  * recovery, a session the server forgot, and a stream that keeps dropping as
  * soon as it opens (once an hour per server at most).
  */
-import { readFrames } from "../jsonrpc/framing.js";
+import { readFrames, receivedText, rememberText } from "../jsonrpc/framing.js";
 import { paramsObject } from "../jsonrpc/types.js";
 import { logDetail, logEvery, logLine, logOnce, errText } from "../util/log.js";
 import { BaseUpstreamClient, BIR_ID_PREFIX, isBirId } from "./client.js";
@@ -341,7 +343,11 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
                 accept: "application/json, text/event-stream",
                 ...this.sessionHeaders(method === "initialize"),
                 ...this.headers,
-            }, JSON.stringify(msg), controller.signal);
+            }, 
+            // The host's own line when this is the message as the relay read it
+            // (jsonrpc/framing.ts): serialised again, an integer past 2^53 in a
+            // tool's arguments reached the server rounded.
+            receivedText(msg) ?? JSON.stringify(msg), controller.signal);
         }
         catch (err) {
             clearTimeout(abandonTimer);
@@ -516,8 +522,16 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
         if (Array.isArray(parsed))
             for (const item of parsed)
                 this.deliver(item);
-        else
+        else {
+            // One message, and this is its text: the relay writes it to the host as
+            // the server wrote it rather than as JavaScript read it (framing.ts).
+            // Without the white space around it — a body often ends in a newline —
+            // and only when it is one line; a batch's members have no text of their
+            // own, and are serialised as before.
+            if (parsed && typeof parsed === "object")
+                rememberText(parsed, raw.trim());
             this.deliver(parsed);
+        }
         return true;
     }
     /** Hand one inbound JSON-RPC message to the relay (or to a `bir:` waiter). */
@@ -601,7 +615,18 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
             if (this.transport === "http") {
                 this.sessionId = undefined;
                 this.resetStandingStream();
-                return this.reinitialize();
+                if (await this.reinitialize())
+                    return true;
+                // No new session: a 503 from an instance still starting, a network
+                // error, no answer in time. Left without an id, every later request
+                // went out bare, the server answered 400 or 404, and none of that
+                // read as "forgotten" any more — errors for the rest of the host's
+                // session, with the proxy up. Holding the forgotten id again makes
+                // the next request's 404 start another attempt. An id this attempt
+                // was handed is dropped with it: its handshake never completed.
+                if (!this.dead)
+                    this.sessionId = staleKey;
+                return false;
             }
             // Legacy: the session *is* the event stream. Drop it and open a new one;
             // reconnect() replays the handshake. A reconnect already under way (the
@@ -634,9 +659,10 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
     /**
      * Replay the host's `initialize` (under a `bir:` id) and `initialized`.
      * `news`: say it on stderr when it worked — after a forgotten session or an
-     * outage; after a routine reconnect it is detail. A failure is always said.
+     * outage; after a routine reconnect it is detail. A failure is said, unless
+     * `failureSaid`: it is one more of an outage whose first failure was.
      */
-    async reinitialize(news = true) {
+    async reinitialize(news = true, failureSaid = false) {
         if (this.initParams === undefined || this.dead)
             return false;
         this.reinitCount += 1;
@@ -663,7 +689,10 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
             return false;
         if (!reply || !("result" in reply)) {
             const error = reply ? paramsObject(reply.error).message : "no answer";
-            logLine("upstream.reinitialize_failed", { server: this.label, error: String(error ?? "error") });
+            (failureSaid ? logDetail : logLine)("upstream.reinitialize_failed", {
+                server: this.label,
+                error: String(error ?? "error"),
+            });
             return false;
         }
         this.noteProtocolVersion(reply.result);
@@ -856,15 +885,27 @@ export class HttpUpstreamClient extends BaseUpstreamClient {
                 return false;
             }
             const recovered = this.reconnectFailures > 0;
+            // A new event stream is a new, uninitialised session: replay the host's
+            // handshake before anything else is let through. Until that has worked
+            // the reconnect has not: counted as done on the stream alone, a replay
+            // the server refused (it was still starting) left every later request
+            // posted to a session nobody had initialised, and nothing ever tried
+            // again. So the stream is dropped and the attempt counts as failed —
+            // backoff, and the next request pulls a new one forward.
+            if (this.initParams !== undefined && !(await this.reinitialize(recovered || afterExpiry, recovered))) {
+                if (this.dead)
+                    return false;
+                this.reconnectFailures += 1;
+                this.onSseStreamLost(this.generation, "re-initialise failed", true);
+                this.streamAbort?.abort();
+                this.scheduleReconnect();
+                return false;
+            }
             (recovered ? logLine : logDetail)("upstream.stream_reconnected", {
                 server: this.label,
                 failedAttempts: this.reconnectFailures,
             });
             this.reconnectFailures = 0;
-            // A new event stream is a new, uninitialised session: replay the host's
-            // handshake before anything else is let through.
-            if (this.initParams !== undefined)
-                await this.reinitialize(recovered || afterExpiry);
             return true;
         })();
         this.connecting = attempt;

package/dist/upstream/stdio-client.d.ts

@@ -22,6 +22,7 @@
  * {@link StdioUpstreamClient.shutdown} closes stdin first (the MCP-spec way to
  * ask a server to exit), waits briefly, and only then kills the whole tree.
  */
+import { type ChildProcessWithoutNullStreams } from "node:child_process";
 import { type JsonRpcMessage } from "../jsonrpc/types.js";
 import { BaseUpstreamClient } from "./client.js";
 export interface StdioUpstreamOptions {
@@ -80,6 +81,12 @@ export declare function whichSync(command: string, env?: NodeJS.ProcessEnv): str
  * On POSIX this is the identity. On Windows a batch file is wrapped in `cmd.exe`.
  */
 export declare function resolveCommand(command: string, args: string[], env?: NodeJS.ProcessEnv): ResolvedCommand;
+/**
+ * Kill `child` and everything it started. On Windows that takes `taskkill /T`
+ * (a plain kill terminates one process: `cmd.exe`, not the server behind it);
+ * elsewhere SIGTERM, then SIGKILL. Bounded; never throws.
+ */
+export declare function killTree(child: ChildProcessWithoutNullStreams): Promise<void>;
 export declare class StdioUpstreamClient extends BaseUpstreamClient {
     readonly ready: Promise<void>;
     private child?;

package/dist/upstream/stdio-client.js

@@ -161,7 +161,7 @@ function waitForExit(child, ms) {
  * (a plain kill terminates one process: `cmd.exe`, not the server behind it);
  * elsewhere SIGTERM, then SIGKILL. Bounded; never throws.
  */
-async function killTree(child) {
+export async function killTree(child) {
     const pid = child.pid;
     if (pid === undefined)
         return;

package/dist/util/atomic-write.d.ts

@@ -19,11 +19,19 @@
  *   - a symlinked target (dotfile managers do this to ~/.claude.json) must keep
  *     being a symlink, so the rename goes to the link's real target.
  *
- * The existing file's mode is kept; `mode` applies to a new file.
+ * The existing file's mode is kept; `mode` applies to a new file, and to an
+ * existing one too with `replaceMode`.
  */
 export interface AtomicWriteOptions {
     /** Mode for a file that does not exist yet. An existing file keeps its own. */
     mode?: number;
+    /**
+     * `mode` for an existing file as well: a file a credential goes in. Kept,
+     * the old file's mode went to the new one, and when the old file was not
+     * ours to chmod first (root's 0644, after `sudo claude`), the token went
+     * into a file that is ours and readable by every account.
+     */
+    replaceMode?: boolean;
 }
 export declare function writeFileAtomic(path: string, data: string | Uint8Array, opts?: AtomicWriteOptions): void;
 //# sourceMappingURL=atomic-write.d.ts.map

package/dist/util/atomic-write.js

@@ -19,7 +19,8 @@
  *   - a symlinked target (dotfile managers do this to ~/.claude.json) must keep
  *     being a symlink, so the rename goes to the link's real target.
  *
- * The existing file's mode is kept; `mode` applies to a new file.
+ * The existing file's mode is kept; `mode` applies to a new file, and to an
+ * existing one too with `replaceMode`.
  */
 import { chmodSync, lstatSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { randomBytes } from "node:crypto";
@@ -42,11 +43,13 @@ function resolveTarget(path) {
 export function writeFileAtomic(path, data, opts = {}) {
     const target = resolveTarget(path);
     let mode = opts.mode;
-    try {
-        mode = statSync(target).mode & 0o777;
-    }
-    catch {
-        /* new file */
+    if (!(opts.replaceMode && mode !== undefined)) {
+        try {
+            mode = statSync(target).mode & 0o777;
+        }
+        catch {
+            /* new file */
+        }
     }
     const tmp = join(dirname(target), `.${basename(target)}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
     try {

package/dist/util/service-health.d.ts

@@ -35,6 +35,13 @@ export declare const MAX_COOLDOWN_MS = 60000;
  * and never answers, holding a socket and a chain slot the whole time.
  */
 export declare const DEFAULT_SERVICE_TIMEOUT_MS = 10000;
+/**
+ * The longest delay a Node timer takes. Given more, `setTimeout` warns and
+ * waits 1 ms instead — so `BIR_SERVICE_TIMEOUT_MS=3000000000`, set to switch
+ * the timeout off, ended every request at once. Every delay that comes from
+ * the environment or from a caller is held to this.
+ */
+export declare const MAX_TIMER_MS = 2147483647;
 export declare function serviceTimeoutMs(): number;
 export interface HealthSnapshot {
     /** False while a cool-down is running: hot paths do not wait. */

package/dist/util/service-health.js

@@ -36,9 +36,16 @@ export const MAX_COOLDOWN_MS = 60_000;
  * and never answers, holding a socket and a chain slot the whole time.
  */
 export const DEFAULT_SERVICE_TIMEOUT_MS = 10_000;
+/**
+ * The longest delay a Node timer takes. Given more, `setTimeout` warns and
+ * waits 1 ms instead — so `BIR_SERVICE_TIMEOUT_MS=3000000000`, set to switch
+ * the timeout off, ended every request at once. Every delay that comes from
+ * the environment or from a caller is held to this.
+ */
+export const MAX_TIMER_MS = 2_147_483_647;
 export function serviceTimeoutMs() {
     const n = Number(process.env.BIR_SERVICE_TIMEOUT_MS);
-    return Number.isFinite(n) && n > 0 ? n : DEFAULT_SERVICE_TIMEOUT_MS;
+    return Number.isFinite(n) && n > 0 ? Math.min(n, MAX_TIMER_MS) : DEFAULT_SERVICE_TIMEOUT_MS;
 }
 export class ServiceHealth {
     failures = 0;
@@ -170,7 +177,7 @@ export async function awaitWithin(pending, budgetMs, what, health = serviceHealt
         const winner = await Promise.race([
             pending,
             new Promise((resolve) => {
-                timer = setTimeout(() => resolve(timedOut), budgetMs);
+                timer = setTimeout(() => resolve(timedOut), Math.min(budgetMs, MAX_TIMER_MS));
                 timer.unref?.();
             }),
         ]);
@@ -197,7 +204,7 @@ export async function awaitWithin(pending, budgetMs, what, health = serviceHealt
  */
 export function timeoutSignal(ms = serviceTimeoutMs(), parent) {
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(new DOMException(`timed out after ${ms} ms`, "TimeoutError")), ms);
+    const timer = setTimeout(() => controller.abort(new DOMException(`timed out after ${ms} ms`, "TimeoutError")), Math.min(ms, MAX_TIMER_MS));
     timer.unref?.();
     if (parent) {
         if (parent.aborted) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basein/runner",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "A recording MCP proxy: sits between any MCP client and its MCP servers, executes each call on the client's behalf, and records the run as a reusable BaseIn scenario.",
   "type": "module",
   "license": "MIT",

package/production.md

@@ -523,7 +523,7 @@ Over 2-minute runs with one turn every 8 s (92 hooks):
 
 - **Backlog.** The backlog is bounded: 500 sends or 32 MiB, oldest steps dropped first. A queued send still facing a cool-down after 60 s is dropped unsent, not sent into the outage.
 - **Flush.** A flush waits at most 2 s (`BIR_FLUSH_TIMEOUT_MS`), and not at all while the service is cooling down.
-- **Retries.** A retry happens once, only after 429, 503, or a connection error that proves nothing reached the service. A 409 on the retry counts as "already landed". There is no retry after 502, 504 or a mid-request reset, until the service confirms it deduplicates ids (§10). What a 429 costs is in §3.3. The service's new build answers a report whose write failed with `503 report_not_booked`, so this one retry sends the report once more (built, not deployed yet).
+- **Retries.** A retry happens once, only after 429, 503, or a connection error that proves nothing reached the service. A 409 on the retry counts as "already landed". There is no retry after 502, 504 or a mid-request reset, until the service confirms it deduplicates ids (§10). What a 429 costs is in §3.3. The service's new build answers a report whose write failed with `503 report_not_booked`, so this one retry sends the report once more (built, not deployed yet). Three sends are different, because the service takes a second copy of each without harm: a run's finish and a patch (an update that keeps what it has), and an execution report that carries its ticket (a second copy answers `200 duplicate`). From 0.3.26 each of these goes back to the head of its lane when it fails with no answer or an unhealthy one (502, 504, a reset), up to 3 sends in all, and it is exempt from the 60 s give-up. Before, a run whose finish was lost never ended (never embedded, matched or calculated), and a turn whose report was lost was never booked. Any other 4xx stays final.
 
 **Size caps on uploads.**
 
@@ -1174,7 +1174,7 @@ Defaults were checked in `src/`.
 - **Two sessions in one project.** Direct replays for a session whose own proxy has not yet bound hand over instead of running.
 - **Revive gaps.** `bir-scenario` does not revive in its first 12 s; those first hooks are left to the SessionStart hook. A session with no wrapped server and no `bir` server is not revived until `/clear` or a new session. The revive window was not measured with real Claude Code.
 - **Direct-run worst case.** The worst case by budget is 120 s: 8 s of derivation, 100 s of plan, and 12 s of slack. It is reached only if every logic body hits its limit, and sits at Claude Code's 2-minute MCP auto-background. Setting `BIR_REPLAY_BUDGET_MS=120000` (the old default) makes it 140 s.
-- **Retries are conservative.** A send lost to a 502, 504 or mid-request reset is not retried until the service deduplicates ids.
+- **Retries are conservative.** A step or run create lost to a 502, 504 or mid-request reset is not retried until the service deduplicates ids. (A finish, a patch and a ticketed report are sent up to 3 times from 0.3.26: the service takes a second copy of each without harm, §6.5. The service now answers a repeated run or step id with 409.)
 - **Healthy-service prompt cost.** With an instant local service the prompt hook is about 6 ms slower than 0.2.12 (about 17 vs 11 ms median); the cause was not isolated. Under 503 or slow answers the recorder also keeps more idle keep-alive sockets. Both are small, but visible in measurements.
 - **A host other than Claude Code is not checked end to end.** What §3.2 describes ran on a bench only: a real LangChain agent against the real recorder, with a stand-in service and a fake model (`examples/langchain-proof/`). A real model, the real service and the production server have not been tried. The service's part is built and not deployed, and the Python package is not on PyPI. What that means for a LangChain application today is in `langChainGuide.md`, part 5.
 - **An interrupted or lossy Claude Code run is not marked.** Only a run of another host is finished with an `error` or with the `incomplete` mark today. A Claude Code run that was interrupted or lost steps is finished as before.