@basein/runner 0.3.6 → 0.3.8

package/README.md

@@ -303,9 +303,14 @@ does a plain `bir install` where replay was never set up. `bir install --replay`
 never turns back on a `bir replay off` of yours. The switches are kept per
 project in `~/.baseinstrunner/installed.json`, so a recorder the hook starts — with Claude
 Code's environment, not your terminal's — keeps them. A recorder reads them when
-it starts: `bir up --restart` applies a change. `BIR_REPLAY`,
-`BIR_REPLAY_ALLOW_SERVERS` and `BIR_MIN_STEER_SIMILARITY` in the environment
-still override them, and `bir doctor` says which source is in effect.
+it starts: `bir up --restart` applies a change. `BIR_REPLAY` and
+`BIR_REPLAY_ALLOW_SERVERS` in the environment still override them, and
+`bir doctor` says which source is in effect.
+
+Every match is used. When the service matches a prompt to a recording with a
+ready scenario, bir runs the scenario; there is no second, stricter score on
+this side. (Up to 0.3.6 bir declined a match under 0.92, and
+`BIR_MIN_STEER_SIMILARITY` set that bar; it is ignored now.)
 
 Two switches, not one, because of what replay is: **a scenario is a pre-approved
 list of tool calls with computed arguments.** A steered step is answered
@@ -314,15 +319,19 @@ prompt you would have seen — only a call that plausibly is the step, though (t
 same command, the same file, the same kind of arguments); any other call runs as
 written and is asked about as usual. A *directly executed* step never reaches the
 permission system at all — it is dispatched to a `bir-proxy` and called on a
-connection that is already open — and `run_scenario`, the call that starts the
+connection that is already open, or, for Claude Code's own `Read`, `Glob`,
+`Grep`, `Edit`, `Write` and `Bash`, run by the recorder itself in the project
+folder — and `run_scenario`, the call that starts the
 run, is answered `allow` while the recorder has announced the plan. In plan mode
 nothing is announced and nothing is approved. Set `BIR_REPLAY_ALLOW_SERVERS` to
 the servers you are content to have called unattended (it also covers a steered
-plan's recovery), and read [the guide's §5.1](docs/calculatedReplayGuide.md)
+plan's recovery), `BIR_BUILTIN_TOOLS` and `BIR_BASH_ALLOW` to the built-ins and
+commands, and read [the guide's §5.1](docs/calculatedReplayGuide.md)
 before enabling it anywhere that matters.
 
-What it buys: on a scenario whose every step is a wrapped MCP tool, the whole
-sequence runs through connections the proxies already hold — **zero model tokens**
+What it buys: on a scenario whose every step is a wrapped MCP tool or one of
+those built-ins, the whole sequence runs through connections the proxies already
+hold, or on the recorder itself — **zero model tokens**
 — and the model's only job is one tool call that reads the results. Such a plan
 is announced only while a `bir` server has told the recorder it is connected,
 and runs only through `run_scenario`: if the model calls anything else first,
@@ -433,9 +442,8 @@ what to do when they register, so there is one switch and no second copy of it:
 |---|---|
 | `BIR_REPLAY` | `0` turns replay off and any other value on, over the project's stored switch (`bir replay on` / `off`; a first plain `bir install` stores off). Nothing below matters while it is off. |
 | `BIR_REPLAY_ALLOW_SERVERS` | Server keys bir may call unattended: **direct** execution, and a steered plan's recovery. Unset means the list `bir replay allow` stored for the project, else every wrapped server; narrowing it is the recommendation. |
-| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default `Read,Glob,Grep` (read-only). Add `Edit,Write,Bash` only deliberately: a runner-side step never reaches Claude Code's permission prompts. `none` turns it off, and a built-in step hands the turn back as before. |
-| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner, even when `BIR_BUILTIN_TOOLS` lists it. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
-| `BIR_MIN_STEER_SIMILARITY` | Minimum match similarity to replay (default `0.92`, above the service's own `0.9` detection threshold). |
+| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default all six: `Read,Glob,Grep,Edit,Write,Bash` (up to 0.3.7 only the read-only `Read,Glob,Grep`). A runner-side step never reaches Claude Code's permission prompts, so leave off the list any tool you want the model to call itself. `none` turns it off, and built-in steps are steered in the session. |
+| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run. Unset means any command (`*`); a list such as `git,npm test` narrows it; `none` allows no command, and `Bash` steps are then steered in the session. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
 | `BIR_DERIVE_API_KEY` | **Optional.** Working out what a new request is about — which fleet, which file, which date — is done for you by the service on its own key, as long as you are signed in. Set this (an Anthropic key) only to keep that reading on your machine, on your key. Signed out *and* unset, a scenario whose values change between requests is declined rather than replayed on stale ones. |
 | `ANTHROPIC_API_KEY` | Not used by the background recorder, which has Claude Code's environment and would bill your own key — unless `BIR_USE_ANTHROPIC_API_KEY=1`. A `bir-hooks` run by hand in a terminal uses that terminal's key. |
 | `BIR_DERIVE_MODEL` | Derivation model, when you set a key of your own (default `claude-haiku-4-5-20251001`). |

package/dist/bin/bir-hooks.d.ts

@@ -64,16 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
- *   BIR_MIN_STEER_SIMILARITY  minimum match similarity to replay (default 0.92)
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/bir-hooks.js

@@ -64,16 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
- *   BIR_MIN_STEER_SIMILARITY  minimum match similarity to replay (default 0.92)
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/bir.js

@@ -3292,8 +3292,7 @@ async function doctor(args) {
     // reading a log file.
     const replay = health?.replay;
     if (replay?.enabled) {
-        out(`Replay            : ON  servers=${replay.allowServers?.join(",") || "(all wrapped)"}  ` +
-            `minSimilarity=${replay.minSimilarity ?? "?"}` +
+        out(`Replay            : ON  servers=${replay.allowServers?.join(",") || "(all wrapped)"}` +
             (replay.source ? `  source=${replay.source}` : ""));
         // An older control server sends only `deriveKey`; read it as the two states
         // it could describe then.
@@ -3527,8 +3526,7 @@ function replayPolicyCommand(args) {
                 ? "off (not asked for at install: --no-replay, `bir uninstall --replay`, or no --replay) — `bir replay on` turns it on"
                 : "off"}`);
         out(`  direct servers ${policy?.allowServers?.length ? policy.allowServers.join(", ") : "(all wrapped)"}`);
-        out(`  minSimilarity  ${policy?.minSimilarity ?? 0.92}`);
-        const overrides = ["BIR_REPLAY", "BIR_REPLAY_ALLOW_SERVERS", "BIR_MIN_STEER_SIMILARITY"].filter((k) => process.env[k] !== undefined);
+        const overrides = ["BIR_REPLAY", "BIR_REPLAY_ALLOW_SERVERS"].filter((k) => process.env[k] !== undefined);
         if (overrides.length) {
             out(`  (set in this shell's environment, which a recorder started from it would prefer: ${overrides.join(", ")})`);
         }

package/dist/bin/investigate.js

@@ -17,6 +17,7 @@
  * declined and what mode armed; the service knows the baseline, the ledger and
  * whether a run ever became a recording. Both lists are printed, worst first.
  */
+import { EXECUTABLE_BUILTINS } from "../replay/builtins.js";
 import { ReadClock, jsonText, readWithin, serviceProblem, underMcp, unreachable } from "./service-read.js";
 const num = (v) => {
     if (v === undefined || v === null || v === "")
@@ -170,9 +171,11 @@ export const DECLINES = {
         cause: "the matched recording had no ready scenario at that moment.",
         fix: "wait for the calculation, or start one with `bir scenario calc <runId>`, then run the prompt again.",
     },
+    // Written only by runners up to 0.3.6, which re-scored a match against a
+    // bar of their own; kept so their log lines still read.
     similarity: {
-        cause: "the prompt was a hit on the recording but below the steering threshold (BIR_MIN_STEER_SIMILARITY, default 0.92).",
-        fix: "phrase the prompt closer to the recorded one, or lower BIR_MIN_STEER_SIMILARITY.",
+        cause: "an older runner used a scenario only when the prompt scored 0.92 or more, above the service's own bar for a match (0.9, or a checked match under it).",
+        fix: "update the runner (`npm install -g @basein/runner`) and restart it (`bir up --restart`): every match is used now.",
     },
     coverage: {
         cause: "no step of the scenario could run anywhere: its tools are neither wrapped MCP servers registered in this session nor built-ins.",
@@ -265,12 +268,25 @@ export function localFindings(turn) {
             .filter((t) => Boolean(t));
         if (turn.plan.mode === "steer" && live.length > 0) {
             const lowSaving = savedPct(turn) != null && savedPct(turn) < LOW_SAVING_PCT;
+            const names = [...new Set(live)];
+            // One of the runner's own built-ins steered only because it was off the
+            // list (or the turn ran on a runner older than 0.3.8); anything else can
+            // run directly only behind a wrapped MCP server.
+            const offList = names.filter((n) => EXECUTABLE_BUILTINS.has(n));
+            const elsewhere = names.filter((n) => !EXECUTABLE_BUILTINS.has(n));
+            const fixes = [];
+            if (offList.length > 0) {
+                fixes.push(`The runner runs ${offList.join(", ")} itself when ${offList.length === 1 ? "it is" : "they are"} on \`BIR_BUILTIN_TOOLS\` (unset means all six, from runner 0.3.8) and, for Bash, \`BIR_BASH_ALLOW\` is not \`none\`: fix those where the recorder starts, then \`bir up --restart\`.`);
+            }
+            if (elsewhere.length > 0) {
+                fixes.push(`Put the data ${elsewhere.join(", ")} ${elsewhere.length === 1 ? "reaches" : "reach"} behind an MCP server, wrap it (\`bir install --server <name>\`), and record the prompt again so its steps are MCP calls.`);
+            }
             out.push({
                 code: "steer_mode",
                 severity: lowSaving ? "warn" : "info",
-                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${[...new Set(live)].join(", ")}).`,
-                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool.",
-                fix: "Put the data those tools reach behind an MCP server, wrap it (`bir install --server <name>`), and record the prompt again so its steps are MCP calls.",
+                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${names.join(", ")}).`,
+                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool or a built-in the runner runs itself (Read, Glob, Grep, Edit, Write, Bash).",
+                fix: fixes.join(" "),
                 evidence: { coverage, tools },
             });
         }
@@ -278,8 +294,8 @@ export function localFindings(turn) {
             out.push({
                 code: "direct_mode",
                 severity: "info",
-                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies, no model in the loop.`,
-                cause: "Every step is a wrapped MCP tool this session has a proxy for.",
+                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies and the runner, no model in the loop.`,
+                cause: "Every step is a wrapped MCP tool this session has a proxy for, or a built-in the runner runs itself.",
                 fix: "",
             });
         }
@@ -330,7 +346,7 @@ export function localFindings(turn) {
                 title: `Saved ${pct(p)}: ${usd(r.savedUsd ?? 0)} of a ${usd((r.savedUsd ?? 0) + cost)} baseline.`,
                 cause: `The live session cost ${usd(r.session)} of that baseline${turn.plan?.mode === "steer" ? " — steer mode pays for the whole turn." : "."}`,
                 fix: turn.plan?.mode === "steer"
-                    ? "Direct mode is the fix: wrap the servers so every step is an MCP call (see steer_mode)."
+                    ? "Direct mode is the fix (see steer_mode for what kept this plan out of it)."
                     : "Compare the baseline with a few unsteered runs (BIR_REPLAY=0); a single cheap source run makes any replay look poor.",
                 evidence: { ...r, costUsd: cost, savedPct: p },
             });

package/dist/config/generate.d.ts

@@ -412,8 +412,6 @@ export interface ReplayPolicy {
     disabledBy?: "install";
     /** Server keys eligible for direct execution. Absent means every wrapped one. */
     allowServers?: string[];
-    /** `BIR_MIN_STEER_SIMILARITY`'s stored twin. */
-    minSimilarity?: number;
 }
 /** What `bir install` decided for one project directory. */
 export interface ProjectRecord {

package/dist/control/recorder-main.d.ts

@@ -52,7 +52,7 @@ export declare function derivationKey(daemon?: boolean): {
     apiKey?: string;
     source?: string;
 };
-/** Where the three replay switches came from, for `/health` and `bir doctor`. */
+/** Where the two replay switches came from, for `/health` and `bir doctor`. */
 export type ReplaySource = "env" | "sidecar" | "default";
 /** What a recorder still serves (K4, `ControlServer.activity()`). */
 export interface RecorderActivity {

package/dist/control/recorder-main.js

@@ -155,11 +155,9 @@ export function derivationKey(daemon = process.env[DAEMON_ENV] === "1") {
 /**
  * Assemble the replay configuration (docs/calculatedReplay.md §5.3 of the guide).
  *
- * The steer threshold defaults **above** the service's own detection threshold
- * (0.9). Detection decides "do not record this again", which is cheap — the worst
- * case is a lost recording. Steering decides "do not think about this again",
- * which is a much stronger claim, and a 0.90-similar prompt usually covers only
- * part of the live task.
+ * There is no steer threshold: a match the service hands out is steered
+ * (controller.ts, gate 4). A recorder started with `BIR_MIN_STEER_SIMILARITY`
+ * or `BIR_MIN_SEGMENT_STEER_SIMILARITY` set ignores them.
  */
 function buildReplayOptions(keeper, policy, key) {
     // The environment still wins — an operator at a terminal is the most
@@ -168,8 +166,7 @@ function buildReplayOptions(keeper, policy, key) {
     // switches the project stored instead of forgetting them (generate.ts).
     const envReplay = process.env.BIR_REPLAY;
     const envAllow = process.env.BIR_REPLAY_ALLOW_SERVERS;
-    const envMin = Number(process.env.BIR_MIN_STEER_SIMILARITY);
-    const fromEnv = envReplay !== undefined || envAllow !== undefined || Number.isFinite(envMin);
+    const fromEnv = envReplay !== undefined || envAllow !== undefined;
     const source = fromEnv ? "env" : policy ? "sidecar" : "default";
     const enabled = envReplay !== undefined ? envReplay !== "0" : policy?.enabled !== false;
     const allowServers = envAllow !== undefined
@@ -177,16 +174,14 @@ function buildReplayOptions(keeper, policy, key) {
         : policy?.allowServers
             ? parseAllowList(policy.allowServers.join(","))
             : undefined;
-    const minSimilarity = Number.isFinite(envMin) ? envMin : (policy?.minSimilarity ?? 0.92);
     // Which built-ins the runner may execute itself (replay/builtins.ts):
-    // read-only by default, `BIR_BUILTIN_TOOLS` to change, `BIR_BASH_ALLOW`
-    // before a `Bash` step may run at all. Environment-only knobs, like
-    // `BIR_REPLAY_RECORDED_OUTPUTS`.
+    // all six by default, `BIR_BUILTIN_TOOLS` to narrow them, `BIR_BASH_ALLOW`
+    // to narrow the commands a `Bash` step may run. Environment-only knobs,
+    // like `BIR_REPLAY_RECORDED_OUTPUTS`.
     const builtinTools = parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
     const bashAllow = parseBashAllow(process.env.BIR_BASH_ALLOW);
     const opts = {
         enabled,
-        minSimilarity,
         allowServers,
         builtinTools,
         bashAllow,
@@ -222,10 +217,6 @@ function buildReplayOptions(keeper, policy, key) {
         // Observe-only until an operator has read the logs and turned it on
         // (segmented.md R-OUT-10, R-LIFE-7). Arming is never the way to find out.
         segmentArm: process.env.BIR_SEGMENT_ARM === "1",
-        minSegmentSimilarity: (() => {
-            const n = Number(process.env.BIR_MIN_SEGMENT_STEER_SIMILARITY);
-            return Number.isFinite(n) ? n : 0.95;
-        })(),
         // Both read live, never captured (C5). The recorder signs in after it
         // listens, refreshes the token as the session outlives it, and may sign
         // in or out while it runs; replay reads whatever holds *now*. The old
@@ -244,12 +235,11 @@ function buildReplayOptions(keeper, policy, key) {
         // and nothing else: an ordinary wrapped call keeps its permission prompt
         // (see the correlation line under `control.listening`).
         logLine("replay.enabled", {
-            minSimilarity: opts.minSimilarity,
             allowServers: allowServers ? [...allowServers].join(",") : "(all wrapped)",
             // Which built-ins may run on the runner itself, and whether Bash may at
             // all — loud for the same reason as the rest of this line.
             builtins: builtinTools.size > 0 ? [...builtinTools].join(",") : "(none)",
-            bashAllow: builtinTools.has("Bash") ? (bashAllow ? bashAllow.join(",") : "(unset — Bash never runs here)") : undefined,
+            bashAllow: builtinTools.has("Bash") ? (bashAllow.length > 0 ? bashAllow.join(",") : "(none — Bash steps are steered)") : undefined,
             // Who reads what this turn acts on (segmented.md R-PARAM-5). Named at
             // startup because the third state is a replay that silently never runs.
             derive: key.source ??

package/dist/control/server.js

@@ -31,7 +31,7 @@ import { BIR_CALL_ID, fingerprint, newCallId, parseQualifiedName, qualifyToolNam
 import { StepIndexAllocator } from "./ordering.js";
 import { pidAlive } from "./discovery.js";
 import { pinCompatible } from "./pin-guard.js";
-import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, usageSince, } from "./transcript.js";
+import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, thinkingForToolUse, usageSince, } from "./transcript.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
 import { redact } from "../record/redact.js";
 import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateStrings } from "../record/truncate.js";
@@ -404,7 +404,7 @@ export class ControlServer {
         this.token = opts.token ?? randomBytes(32).toString("hex");
         for (const name of opts.wrappedServers ?? [])
             this.wrapped.add(name);
-        this.replay = new ReplayController(opts.replay ?? { enabled: false, minSimilarity: 1 });
+        this.replay = new ReplayController(opts.replay ?? { enabled: false });
         this.deriveRecentResults = opts.deriveRecentResults ?? 5;
         this.intentSources = opts.intentSources ?? new Set(["text", "thinking", "tool"]);
         this.timings = { ...DEFAULT_SESSION_TIMINGS, ...(opts.sessionTimings ?? {}) };
@@ -579,7 +579,6 @@ export class ControlServer {
             replay: {
                 enabled: this.replay.enabled,
                 source: this.opts.replaySource ?? null,
-                minSimilarity: this.opts.replay?.minSimilarity ?? null,
                 allowServers: this.opts.replay?.allowServers ? [...this.opts.replay.allowServers] : null,
                 deriveKey: Boolean(this.opts.replay?.apiKey ?? process.env.ANTHROPIC_API_KEY),
                 // Who reads the turn for its parameters (segmented.md R-PARAM-5). The
@@ -2347,15 +2346,18 @@ export class ControlServer {
         const agentId = payload.agent_id ?? session.agentId;
         // The real intent, read from every line sharing this message's id
         // (segmented.md R-INTENT-3). `context` stays the *written* text only, with
-        // its agent prefix: thinking is embedded but never stored as text
-        // (R-INTENT-2), so it rides separately in `intent`.
+        // its agent prefix, so thinking rides separately in `intent`.
         const intent = intentForToolUse(session.transcriptPath, toolUseId, this.intentSources);
         const reasoning = intent?.source === "text" ? intent.text : "";
         // The prefix rides on whether there is a subagent, not on whether it said
         // anything: a subagent's steps must be tellable apart even when it narrated
         // nothing. What it never carries is thinking (R-INTENT-2).
         const context = agentId ? `[agent ${agentId}] ${reasoning}`.trim() : reasoning;
-        const thinkingIntent = intent?.source === "thinking" ? { text: intent.text, source: "thinking" } : undefined;
+        // Sent whether or not there was written text: the service keeps it for the
+        // recording page (R-INTENT-2, amended 2026-09-29), and still embeds the
+        // written text first. The probe below reads `intent`, unchanged.
+        const thinking = thinkingForToolUse(session.transcriptPath, toolUseId, this.intentSources);
+        const thinkingIntent = thinking ? { text: thinking, source: "thinking" } : undefined;
         // ── replay steering (docs/calculatedReplay.md §7) ────────────────────────
         // Runs before anything else, because two of its four answers end the call.
         // Not in plan mode (nothing is approved on the user's behalf there), not

package/dist/control/transcript.d.ts

@@ -78,6 +78,15 @@ export interface ToolUseIntent {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export declare function intentForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): ToolUseIntent | undefined;
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export declare function thinkingForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): string | undefined;
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export declare function contextForToolUse(transcriptPath: string | undefined, toolUseId: string): string;
 /** The last assistant text in the transcript — the turn's final answer. */

package/dist/control/transcript.js

@@ -92,8 +92,9 @@ const MAX_INDEXES = 16;
 const MAX_MESSAGES = 128;
 /**
  * Characters of one message's text, and separately of its thinking, kept.
- * Text becomes a step's `context`; thinking is only embedded, and the intent
- * probe sends 4,000 characters of either.
+ * Text becomes a step's `context`; thinking goes with the step as its
+ * `intent`, capped again at 8 KB on the way out, and the intent probe sends
+ * 4,000 characters of either.
  */
 const MAX_MESSAGE_CHARS = 16 * 1024;
 /** `tool_use_id`s remembered, newest last. */
@@ -443,11 +444,7 @@ export function recentToolResults(transcriptPath, n = 5, maxBytes = 2048) {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
-    if (!transcriptPath || !toolUseId)
-        return undefined;
-    const idx = indexFor(transcriptPath);
-    const holder = idx?.toolUses.get(toolUseId);
-    const message = holder ? idx?.messages.get(holder.message) : undefined;
+    const message = messageFor(transcriptPath, toolUseId);
     if (!message)
         return undefined;
     if (sources.has("text")) {
@@ -462,6 +459,28 @@ export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["
     }
     return undefined;
 }
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export function thinkingForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
+    if (!sources.has("thinking"))
+        return undefined;
+    const thinking = messageFor(transcriptPath, toolUseId)?.thinkings.join("\n").trim();
+    return thinking || undefined;
+}
+/** The message that emitted `toolUseId`: its text and thinking, gathered across its lines. */
+function messageFor(transcriptPath, toolUseId) {
+    if (!transcriptPath || !toolUseId)
+        return undefined;
+    const idx = indexFor(transcriptPath);
+    const holder = idx?.toolUses.get(toolUseId);
+    return holder ? idx?.messages.get(holder.message) : undefined;
+}
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export function contextForToolUse(transcriptPath, toolUseId) {
     if (!transcriptPath || !toolUseId)

package/dist/record/remote-recorder.d.ts

@@ -62,7 +62,7 @@ export declare const TEXT_CAPS: {
     readonly answer: number;
     /** A step's written reasoning. */
     readonly context: number;
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     readonly intent: number;
     /** A tool's error text when it is not JSON. */
     readonly toolError: number;

package/dist/record/remote-recorder.js

@@ -66,7 +66,7 @@ export const TEXT_CAPS = {
     answer: 64 * 1024,
     /** A step's written reasoning. */
     context: 8 * 1024,
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     intent: 8 * 1024,
     /** A tool's error text when it is not JSON. */
     toolError: 8 * 1024,

package/dist/replay/builtins.d.ts

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -36,14 +39,15 @@
  * best effort and may drift from a future host's, the same caveat the
  * hook-view threading fallback already carries ("shapes may differ").
  */
+/** The built-ins {@link runBuiltin} actually implements. */
+export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
  */
 export declare const DEFAULT_BUILTIN_TOOLS: readonly string[];
-/** The built-ins {@link runBuiltin} actually implements. */
-export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * Parse `BIR_BUILTIN_TOOLS`. Unset means {@link DEFAULT_BUILTIN_TOOLS}; set,
  * it is the whole list — `none` (or an empty value) turns built-ins off
@@ -54,10 +58,11 @@ export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 export declare function parseBuiltinTools(value: string | undefined): ReadonlySet<string>;
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
-export declare function parseBashAllow(value: string | undefined): readonly string[] | undefined;
+export declare function parseBashAllow(value: string | undefined): readonly string[];
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
  * mid-word must end the command's word too: `git` allows `git status` and
@@ -92,7 +97,7 @@ export interface BuiltinContext {
     cwd: string;
     /** The step's clock, the same budget an MCP dispatch would get. */
     timeoutMs?: number;
-    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). */
+    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). Absent or empty, no command runs. */
     bashAllow?: readonly string[];
     /**
      * Where this plan's *previous* `Bash` step left its shell — the host's own

package/dist/replay/builtins.js

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -42,12 +45,6 @@ import { existsSync } from "node:fs";
 import { readdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 // ── configuration ────────────────────────────────────────────────────────────
-/**
- * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
- */
-export const DEFAULT_BUILTIN_TOOLS = ["Read", "Glob", "Grep"];
 /** The built-ins {@link runBuiltin} actually implements. */
 export const EXECUTABLE_BUILTINS = new Set([
     "Read",
@@ -57,6 +54,13 @@ export const EXECUTABLE_BUILTINS = new Set([
     "Write",
     "Bash",
 ]);
+/**
+ * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
+ */
+export const DEFAULT_BUILTIN_TOOLS = [...EXECUTABLE_BUILTINS];
 /** `read` → `Read`: the vocabulary is small enough to forgive casing. */
 const CANONICAL_BUILTIN = new Map([...EXECUTABLE_BUILTINS].map((name) => [name.toLowerCase(), name]));
 /**
@@ -78,15 +82,17 @@ export function parseBuiltinTools(value) {
 }
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
 export function parseBashAllow(value) {
-    const prefixes = (value ?? "")
+    if (value === undefined)
+        return ["*"];
+    return value
         .split(",")
         .map((s) => s.trim())
-        .filter(Boolean);
-    return prefixes.length > 0 ? prefixes : undefined;
+        .filter((s) => s.length > 0 && !["none", "off", "0"].includes(s.toLowerCase()));
 }
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
@@ -485,13 +491,24 @@ async function runBash(input, ctx) {
     if (typeof command !== "string" || command.trim() === "") {
         throw new BuiltinNotRunnable("command is required");
     }
-    if (!ctx.bashAllow) {
-        throw new BuiltinNotRunnable("BIR_BASH_ALLOW is not set, so bir runs no Bash command unattended");
+    if (!ctx.bashAllow?.length) {
+        throw new BuiltinNotRunnable("BIR_BASH_ALLOW allows no command, so bir runs no Bash command unattended");
     }
     if (!bashAllowed(command, ctx.bashAllow)) {
         throw new BuiltinNotRunnable("the command does not match BIR_BASH_ALLOW, so bir does not run it unattended");
     }
+    // What the host would run differently stays the session's, never started
+    // here: a command it leaves in the background (there is no shell here to
+    // leave it in, so it would be stopped with the step), and one that asks for
+    // more time than this step has. Cut off part-way, an `npm i -g` or a
+    // migration can leave things half done, which is worse than a hand-over.
+    if (input.run_in_background === true) {
+        throw new BuiltinNotRunnable("the command runs in the background, which only the session can do");
+    }
     const timeoutMs = ctx.timeoutMs ?? 120_000;
+    if (typeof input.timeout === "number" && input.timeout > timeoutMs) {
+        throw new BuiltinNotRunnable(`the command asks for up to ${Math.ceil(input.timeout / 1000)} s and this step has ${Math.floor(timeoutMs / 1000)} s, so the session runs it`);
+    }
     // The host's Bash semantics, which the recorded chain was written against:
     // the working directory carries over from the plan's previous Bash step,
     // variables and functions do not (a fresh `-l` shell each call).

package/dist/replay/controller.d.ts

@@ -180,15 +180,6 @@ export declare const RUN_NO_PLAN = "no_plan";
 export interface ReplayOptions {
     /** On unless `BIR_REPLAY=0`. Everything here is inert when false. */
     enabled: boolean;
-    /** Minimum similarity to steer — deliberately above the service's detection threshold. */
-    minSimilarity: number;
-    /**
-     * Minimum similarity to steer a **segment** (`BIR_MIN_SEGMENT_STEER_SIMILARITY`,
-     * segmented.md R-OUT-11). The same number as the server's clear band, so a
-     * clear hand-out is always accepted and no score falls between "clear" and
-     * "accepted".
-     */
-    minSegmentSimilarity?: number;
     /**
      * `BIR_SEGMENT_ARM`. Off means observe-only: the runner asks for no segment
      * and arms none, and only logs what would have armed (R-OUT-10).
@@ -200,17 +191,17 @@ export interface ReplayOptions {
      * `BIR_BUILTIN_TOOLS` — the built-ins the runner may execute itself, from
      * the session's own project directory (replay/builtins.ts), or stand in
      * for with a recorded output under `BIR_REPLAY_RECORDED_OUTPUTS=1`.
-     * Omitted, the environment decides; the default is the read-only set
-     * (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` run only when listed
-     * explicitly — and `Bash` additionally only for commands matching
-     * {@link ReplayOptions.bashAllow}.
+     * Omitted, the environment decides; the default is all six (`Read`,
+     * `Glob`, `Grep`, `Edit`, `Write`, `Bash`), and `Bash` runs only the
+     * commands {@link ReplayOptions.bashAllow} allows.
      */
     builtinTools?: ReadonlySet<string>;
     /**
      * `BIR_BASH_ALLOW` — command prefixes a runner-side `Bash` step may run
-     * (`*` for all). Undefined means `Bash` never executes here, even when
-     * allow-listed: runner-side execution bypasses the host's permission
-     * prompts, so the shell needs its own explicit opt-in.
+     * (`*` for all). Omitted, the environment decides; the default is `*`.
+     * Empty allows no command, and then `Bash` counts as off
+     * {@link ReplayOptions.builtinTools}: its steps are steered in the session,
+     * rather than armed `direct` and stopped at the first one.
      */
     bashAllow?: readonly string[];
     budgets?: Partial<ReplayBudgets>;
@@ -439,7 +430,7 @@ export interface ReplayState {
  * Why a match did not arm. One code per gate of the ladder, so the caller can
  * act on a decline without parsing the sentence that explains it.
  */
-export type DeclineCode = "replay_disabled" | "not_ready" | "flatten_failed" | "similarity" | "known_bad_first_step" | "nondeterministic_first_step" | "unusable_first_step" | "coverage" | "missing_target" | "no_derive_key";
+export type DeclineCode = "replay_disabled" | "not_ready" | "flatten_failed" | "known_bad_first_step" | "nondeterministic_first_step" | "unusable_first_step" | "coverage" | "missing_target" | "no_derive_key";
 /** What `PreToolUse` should do about this call. */
 export type PreToolAction = 
 /** Pin the arguments and let the real tool run. */
@@ -484,7 +475,7 @@ export declare class ReplayController {
     /** See {@link ReplayOptions.builtinTools}. */
     private readonly builtinTools;
     /** See {@link ReplayOptions.bashAllow}. */
-    private readonly bashAllow?;
+    private readonly bashAllow;
     /** Calls waiting for a plan's pins to change (see `awaitPins`). */
     private readonly pinWaiters;
     /**

package/dist/replay/controller.js

@@ -250,8 +250,14 @@ export class ReplayController {
         this.intentMatch = { ...DEFAULT_INTENT_MATCH, ...(opts.intentMatch ?? {}) };
         this.recordedFallback =
             opts.recordedFallback ?? process.env.BIR_REPLAY_RECORDED_OUTPUTS === "1";
-        this.builtinTools = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
         this.bashAllow = opts.bashAllow ?? parseBashAllow(process.env.BIR_BASH_ALLOW);
+        const builtins = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
+        // A `Bash` that may run no command is not reachable here. Left on the
+        // list, a chain of Bash steps would arm `direct` and stop at its first.
+        this.builtinTools =
+            this.bashAllow.length > 0 || !builtins.has("Bash")
+                ? builtins
+                : new Set([...builtins].filter((name) => name !== "Bash"));
     }
     /**
      * Whether a handed-out segment may actually arm (segmented.md R-OUT-10).
@@ -333,14 +339,7 @@ export class ReplayController {
             verified: match.verified,
             sharedWith: [],
         };
-        // A segment is judged against its own gate, and a `same` verdict stands in
-        // for the score (segmented.md R-OUT-11): the question was asked *because*
-        // the score sat below the threshold, so a numeric gate would decline every
-        // verified hand-out.
         const isSegment = state.kind === "segment";
-        const threshold = isSegment
-            ? (this.opts.minSegmentSimilarity ?? 0.95)
-            : this.opts.minSimilarity;
         const decline = (why, code) => {
             state.declined = code;
             logLine("replay.decision", {
@@ -349,7 +348,6 @@ export class ReplayController {
                 run: match.runId,
                 scenario: match.scenarioId ?? undefined,
                 similarity: match.similarity.toFixed(3),
-                threshold,
                 kind: state.kind,
                 key: state.key,
                 verified: state.verified?.verdict,
@@ -371,18 +369,14 @@ export class ReplayController {
         if (!match.scenarioId || !isReadyScenario(scenario)) {
             return decline(match.scenarioId ? "scenario is not ready" : "no scenario for the matched run", "not_ready");
         }
-        // Gate 4 — similarity. Detection decides "don't record this again"; steering
-        // decides "don't think about this again", which is a much stronger claim and
-        // deserves a stronger threshold.
-        //
-        // For a segment, a `same` verdict from the live question stands in for the
-        // score (R-OUT-11). Only `same` ever reaches a runner with a ticket, so it
-        // is the only verdict this sees.
-        const scoreOk = match.similarity >= threshold;
-        const verifiedOk = isSegment && match.verified?.verdict === "same";
-        if (!scoreOk && !verifiedOk) {
-            return decline("similarity below threshold", "similarity");
-        }
+        // Gate 4 — similarity — is gone. A hand-out is the service's decision that
+        // this scenario does what the prompt asks: its match threshold, the
+        // same-request question under it, the intent pass, a segment's clear band
+        // or `same` verdict. Scoring it again here declined matches the service
+        // had made (a checked 0.85, a task line at 0.91), so every match now
+        // steers. What a plan cannot do — a step that keeps failing, a tool
+        // nobody wrapped, a target the prompt never named — the gates below
+        // still stop.
         // Flatten the chain before the remaining gates, so every one of them judges
         // the steps that will *really* run — the caller's own and, in order, those
         // of every segment it calls (segmented.md R-CALL-29, R-CALL-30).
@@ -2079,10 +2073,10 @@ export class ReplayController {
                 // An allow-listed built-in runs *here*, against the session's own
                 // project directory (replay/builtins.ts). Everything else about it —
                 // no session cwd (`bir replay`, an older server), off the list, no
-                // runner-side implementation, a path that leaves the project, `Bash`
-                // without `BIR_BASH_ALLOW` — stays the old contract: `not_run`, so
-                // the session can do the step itself or its recorded output can
-                // stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
+                // runner-side implementation, a path that leaves the project, a `Bash`
+                // command `BIR_BASH_ALLOW` does not allow — stays the old contract:
+                // `not_run`, so the session can do the step itself or its recorded
+                // output can stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
                 if (this.builtinTools.has(name) && state.sessionCwd) {
                     return this.executeBuiltin(name, input, state, opts.deadline);
                 }

package/dist/replay/coverage.d.ts

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/dist/replay/coverage.js

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/docs/calculatedReplay.md

@@ -45,7 +45,7 @@ this design has a ladder whose cheapest rung is free — and the more of a stack
 |---|---|---|
 | Runs MCP tools itself | No (`replay.md` §12: *"rrepeat never executes tools — not even MCP"*) | **Yes**, on the connection it already owns |
 | Divergence fallback | A second Agent SDK session — the dominant cost | Direct `tools/call` through the proxies — **$0** |
-| Reaches built-ins (`Bash`, `Read`) | Only by steering the live session | Read-only ones (`Read`, `Glob`, `Grep`) run on the runner itself, jailed to the project (`BIR_BUILTIN_TOOLS`); `Edit`/`Write`/`Bash` opt-in, else steered |
+| Reaches built-ins (`Bash`, `Read`) | Only by steering the live session | `Read`, `Glob`, `Grep`, `Edit`, `Write` and `Bash` run on the runner itself, jailed to the project (`BIR_BUILTIN_TOOLS`, `BIR_BASH_ALLOW`); any other built-in is steered |
 | Needs `@anthropic-ai/*` at runtime | Yes | No (§16.3) |
 
 ---
@@ -193,7 +193,7 @@ Every gate that declines logs **one** `replay.decision` line carrying the reason
 | 1 | **A match arrived** | `getMatch()` resolved `null`, or the budget expired (§10) | (no report — nothing matched) |
 | 2 | **Replay enabled** | `BIR_REPLAY === "0"`, or, with it unset, the project's stored switch is off (`bir replay off`, or a `bir install` without `--replay`) | `not_steered` |
 | 3 | **Scenario ready** | `scenario == null`, `state !== "ready"`, or `steps.length === 0` | `not_steered` |
-| 4 | **Similarity** | `similarity < BIR_MIN_STEER_SIMILARITY` (default **0.92**) | `not_steered` |
+| 4 | ~~**Similarity**~~ | Retired: a match is the decision to use the scenario (below) | — |
 | 5 | **Tool coverage** | No step is executable anywhere (§5 → `mode: "none"`) | `not_steered` |
 
 Past the table, a plan can still be refused before the model hears of it, each refusal with its own
@@ -205,12 +205,16 @@ after the prompt was answered is retired unannounced (`match_late`, `arm_unannou
 plan is declined when no running `bir-scenario` has said it serves `run_scenario`
 (`no_delivery_tool`, §6.3). In plan mode (`permission_mode: "plan"`) nothing is announced at all.
 
-Gate 4 deserves its own note. The server's own detection threshold is 0.9, and it uses it to decide
-*"do not record this again"* — a cheap claim: the worst case is a lost recording. Steering makes a
-much stronger claim: *"do not think about this again."* A prompt that is 0.90-similar usually covers
-only part of the live task, and steering it produces a confident, thin, wrong answer. So the steer
-threshold sits **above** the detection threshold by default, and `BIR_MIN_STEER_SIMILARITY` is the
-single knob an operator turns after watching `replay.decision` lines for a week.
+Gate 4 is retired. Up to 0.3.6 it declined a match under `BIR_MIN_STEER_SIMILARITY` (0.92),
+above the server's 0.9, on the argument that the server only decided *"do not record this again"*
+while steering claims *"do not think about this again."* The server's match stopped being detection
+alone: it hands a scenario over only when it may run, with a ticket, and it decides the match with
+more than one score — a same-request question under its threshold, and a second pass on the
+prompt's task line. Re-scoring that on this side declined matches the server had made (a checked
+0.85, a task line at 0.91). **A match is the decision to use the scenario**, so every hand-out
+steers; what a plan cannot do — a parked first step, a tool nothing reaches, a target the prompt
+never named — the gates after it still stop. `BIR_MIN_STEER_SIMILARITY` and
+`BIR_MIN_SEGMENT_STEER_SIMILARITY` are ignored.
 
 `not_steered` as the floor is not a failure code. It is the **control group**: the prompt matched,
 the agent ran the task the ordinary way, and the cost of doing so is a fresh measurement of what this
@@ -248,21 +252,26 @@ export function modeFor(steps: SerializedScenarioStep[], wrapped: ReadonlySet<st
 | — | `none` | nowhere | declines at gate 5 |
 
 `live` covers three genuinely different cases and treats them identically, correctly: a built-in
-off the `BIR_BUILTIN_TOOLS` allow-list (by default everything but `Read`, `Glob`, `Grep` — so
-`Bash`, `Edit`, `Write`, `Task`, `WebFetch`), an MCP server the user chose not to wrap, and
+off the `BIR_BUILTIN_TOOLS` allow-list (by default everything but the six the runner implements —
+so `Task`, `WebFetch`; up to 0.3.7 also `Bash`, `Edit`, `Write`), an MCP server the user chose not to wrap, and
 `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config file, and therefore can never
 be wrapped (v1 design §1). None of them can be reached except through the session.
 
 A built-in **on** the allow-list runs on the runner, in the session's own project directory and
 confined to it — a path that resolves outside the project, symlinks included, is refused and the
-step is `not_run`, the clean hand-over. `Bash` needs a second opt-in on top (`BIR_BASH_ALLOW`,
-command prefixes), because a runner-side step never reaches the host's permission prompts. The
+step is `not_run`, the clean hand-over. `Bash` has a second switch on top (`BIR_BASH_ALLOW`,
+command prefixes; unset means any command, `none` keeps `Bash` in the session), because a
+runner-side step never reaches the host's permission prompts. The
 results mimic the hook's view of each tool, which is what the recorder stored for built-in steps
 and what their `toolOutputLogic` was authored against; they pass through the same
 `serializeCapped(redact(…))` as every recorded payload. Bash keeps the host's own semantics a
 recorded chain was written against: each call is a fresh `-l` shell (variables and functions do
 not persist), while the **working directory carries over** from the plan's previous Bash step —
-`cd sub` then `cat file` replays as it ran.
+`cd sub` then `cat file` replays as it ran. Two Bash calls the host runs differently are never
+started on the runner, and are `not_run` instead: one with `run_in_background` (there is no shell
+here to leave it in), and one whose own `timeout` is longer than the step's clock
+(`BIR_STEP_TIMEOUT_MS`, clipped to what the plan has left) — cut off part-way, an `npm i -g` or a
+migration can leave things half done.
 
 A **mixed** scenario in `steer` mode still gets direct execution for its wrapped steps once it
 diverges (§8), so coverage is not all-or-nothing at the divergence boundary — only at the arm-time
@@ -1486,7 +1495,7 @@ plans when it is replayed. The operator's walk-through is
 source run's *recorded* outputs — no real tools, no side effects, one Haiku call. Without `--dry`,
 `bir replay` runs the same plan through the same executor against the live proxies. `bir doctor`
 gains a `replay` block: on/off, the effective `BIR_REPLAY_ALLOW_SERVERS` allowlist,
-`BIR_MIN_STEER_SIMILARITY`, and who derives — this machine, the service, or nobody, which is the
+and who derives — this machine, the service, or nobody, which is the
 state in which a scenario with a target never runs (§13.2, mitigation 3).
 
 ---
@@ -1627,7 +1636,7 @@ changes the corpus, the threshold and every stored vector. §20 question 1.
    and argument objects the bodies rely on today.
 4. **Should a declined match still arm a *dry* plan?** Deriving parameters and computing the first
    step's input without executing anything would make `bir doctor` able to say *"this scenario would
-   have run these three calls"* — excellent for tuning `BIR_MIN_STEER_SIMILARITY`, at the price of a
+   have run these three calls"* — excellent for fixing the plan behind a decline, at the price of a
    Haiku call on turns that replay nothing.
 5. **Should `scenario_steps` carry `recorded_output`?** §8.1 works around its absence with one lazy
    `GET /recordings/runs/:runId`. A column would make it a field read, would let a scenario outlive

package/docs/calculatedReplayGuide.md

@@ -234,7 +234,10 @@ When replay arms:
   when it plausibly *is* the step — the same command, the same file, an argument in common (design
   §7) — and never in plan mode.
 - **Direct steps are not visible to the permission system at all.** They are dispatched straight to a
-  `bir-proxy`, which calls the upstream on a connection it already holds. Claude Code never sees them.
+  `bir-proxy`, which calls the upstream on a connection it already holds — or, for Claude Code's own
+  `Read`, `Glob`, `Grep`, `Edit`, `Write` and `Bash`, run by the recorder itself in the project
+  folder, any `Bash` command included (`BIR_BUILTIN_TOOLS`, `BIR_BASH_ALLOW`; up to 0.3.7 only the
+  first three). Claude Code never sees them.
   The `run_scenario` call that starts them is answered `allow` too, while the runner has announced a
   direct plan; your own deny or ask rules for it still apply.
 
@@ -243,7 +246,9 @@ That is what makes replay fast, and it is the whole risk. Two things follow:
 1. Only enable it in a project whose scenarios you have dry-replayed and read (§3.1).
 2. Run `bir replay allow <servers>` (§5.3). An allowlist of the servers you are comfortable having
    called unattended is cheap insurance, and it is the difference between "replay reads a dashboard"
-   and "replay can do anything any wrapped server can do".
+   and "replay can do anything any wrapped server can do". The same goes for built-ins:
+   `BIR_BUILTIN_TOOLS=Read,Glob,Grep` keeps writes and commands with the model, and
+   `BIR_BASH_ALLOW=git,npm test` (for example) limits the commands the recorder runs itself.
 
 Nothing else is approved on your behalf. Outside a matched scenario's own steps, a wrapped MCP call
 keeps its permission prompt, as it would without the runner (`bir doctor` says so in a note);
@@ -300,7 +305,7 @@ bir doctor
 ```
 
 ```
-Replay            : ON  servers=chrome-devtools,fleet-api  minSimilarity=0.92  source=sidecar
+Replay            : ON  servers=chrome-devtools,fleet-api  source=sidecar
                     derive=the service (no key needed here)
 Wrapped in config : chrome-devtools, fleet-api
 Registered proxies: chrome-devtools, fleet-api
@@ -324,7 +329,7 @@ uses, with the account it is signed in as. The two normally agree.
 
 ### 5.3 Environment
 
-The first three switches are stored per project, and that is where to set them:
+The first two switches are stored per project, and that is where to set them:
 
 ```bash
 bir replay allow chrome-devtools,fleet-api   # the servers bir may call by itself; `allow all` clears it
@@ -344,7 +349,6 @@ so there is exactly one switch and it cannot get out of step with itself.
 |---|---|---|
 | `BIR_REPLAY` | *(the stored switch)* | `0` disables replay and any other value turns it on, whatever `bir replay on` or `off` or the install stored. Unset, the stored switch decides: on after `bir setup` or `bir install --replay`, off after a plain `bir install`. Nothing below matters while replay is off |
 | `BIR_REPLAY_ALLOW_SERVERS` | *(the stored list, else all wrapped)* | Comma-separated server keys bir may call by itself: **direct** execution and divergence recovery. Overrides `bir replay allow` |
-| `BIR_MIN_STEER_SIMILARITY` | `0.92` | Below this a match is detected but not replayed (§8) |
 | `BIR_DERIVE_API_KEY` | *(unset)* | **Not required.** Derivation — reading what this request acts on — is done by the service on its key for a signed-in runner. Set this to keep the reading on this machine instead: the prompt then never leaves it, and it is one round trip faster. Signed out *and* unset, only a scenario with nothing to work out replays. A recorder running in the background (started by the SessionStart hook, `bir up` or `bir setup`) ignores `ANTHROPIC_API_KEY` (usually Claude Code's own, and billed) unless `BIR_USE_ANTHROPIC_API_KEY=1`; a `bir-hooks` you run in a terminal uses it |
 | `BIR_DERIVE_MODEL` | `claude-haiku-4-5-20251001` | The derivation model, when this machine does the reading |
 | `BIR_MATCH_BUDGET_MS` | `3000` | How long the prompt hook waits for a match before giving up. After a match slower than `BIR_MATCH_SLOW_MS` (`2000`), prompts stop waiting for one for 5 minutes, doubling up to 30 while the service stays slow |
@@ -355,8 +359,8 @@ so there is exactly one switch and it cannot get out of step with itself.
 | `BIR_STEP_TIMEOUT_MS` | `60000` | Per-step ceiling for one direct `tools/call`, clipped to what the plan has left |
 | `BIR_LOGIC_TIMEOUT_MS` | `1000` | How long one scenario logic body may run before it is stopped. At most 10 000 |
 | `BIR_REPLAY_RECORDED_OUTPUTS` | *(unset)* | `1` lets a step that could not be sent (a built-in off `BIR_BUILTIN_TOOLS`, no proxy, a server off the allowlist) stand on its recorded output instead of stopping the plan. Never for a timeout or an upstream error |
-| `BIR_BUILTIN_TOOLS` | `Read,Glob,Grep` | Built-ins the runner executes itself during a replay, in the session's own project directory and confined to it. A chain whose only non-MCP steps are on this list arms `direct`. Add `Edit,Write,Bash` only deliberately — a runner-side step never reaches the host's permission prompts. `none` restores the old behaviour: every built-in hands the turn back |
-| `BIR_BASH_ALLOW` | *(unset)* | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner, even when `BIR_BUILTIN_TOOLS` lists it. A plan's Bash steps share a working directory, exactly as the host's own Bash tool does — variables and functions do not persist, also as the host's |
+| `BIR_BUILTIN_TOOLS` | `Read,Glob,Grep,Edit,Write,Bash` | Built-ins the runner executes itself during a replay, in the session's own project directory and confined to it. A chain whose only non-MCP steps are on this list arms `direct`. A runner-side step never reaches the host's permission prompts, so leave off any tool you want the model to call itself; `Read,Glob,Grep` is the read-only set (the default up to 0.3.7). `none`: every built-in step is steered in the session |
+| `BIR_BASH_ALLOW` | *(unset: any command)* | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset means any command; `none` means no command, and `Bash` steps are steered in the session. A plan's Bash steps share a working directory, exactly as the host's own Bash tool does — variables and functions do not persist, also as the host's. A call with `run_in_background`, or with its own `timeout` longer than the step's clock (`BIR_STEP_TIMEOUT_MS`), is never started on the runner: the plan hands over in front of it |
 | `BIR_INTENT_ARM` | *(unset)* | `1` lets a match found mid-turn arm a plan in the calling tool's place, which means waiting for it (`BIR_INTENT_ARM_BUDGET_MS`, 500); `0` never waits; unset follows `BIR_SEGMENT_ARM` |
 | `BIR_VERBOSE` | *(unset)* | `1` adds per-step `replay.*` detail lines |
 
@@ -515,8 +519,8 @@ a turn cut short says nothing about what the task costs.
 
 `not_steered` is not an error, and it is not wasted. A saving is `baseline − actual`, and the baseline
 is *what this task costs when the agent does it*. Every declined match is a fresh measurement of
-exactly that. A deployment that never declines has no baseline to measure against — which is a good
-reason to leave `BIR_MIN_STEER_SIMILARITY` where it is rather than driving it to zero.
+exactly that. A deployment that seldom declines measures its baseline mostly from the recording
+itself; `bir replay off` for a few runs of the prompt, then `bir replay on`, gives it more.
 
 An **unredeemed** ticket books nothing at all. Silence loses a saving; it never invents one.
 
@@ -524,25 +528,22 @@ An **unredeemed** ticket books nothing at all. Silence loses a saving; it never
 
 ## 8. Tuning
 
-Only one knob matters in practice.
+There is no threshold on this side. **Every match steers**: a match is the service's decision that
+the scenario does what the prompt asks, and bir does not score it again. (Up to 0.3.6 it did:
+`BIR_MIN_STEER_SIMILARITY`, default 0.92, declined matches the service had made. It is ignored now.)
 
-**`BIR_MIN_STEER_SIMILARITY` (default 0.92).** The server detects matches at 0.9 and uses that to
-decide *"don't record this again"* — cheap: the worst case is a lost recording. Steering makes a much
-stronger claim, *"don't think about this again"*, and a 0.90-similar prompt usually covers only part
-of the live task. Steering it produces a confident, thin, wrong answer.
+Whether a prompt matches is decided by the service, in three steps. A prompt at 0.9 or more against
+a recording matches (`SIMILARITY_THRESHOLD`). From 0.7 (`SIMILARITY_CHECK_FLOOR`) up to that, a quick
+model check asks whether the two prompts are the same request, values included, and only a yes
+matches. A prompt that missed both is matched once more on its task line (`PROMPT_INTENT_THRESHOLD`,
+0.9) — the way the same task with a different value finds its scenario.
 
-Tune it from evidence, not taste. Run for a week and read the declines:
-
-```bash
-grep 'replay.decision' audit.log | grep 'why="similarity below threshold"'
-```
-
-- Prompts you *would* have wanted replayed, sitting at 0.90–0.92 → lower it, in steps of 0.01.
-- Replays that answered the wrong question → raise it, and re-read the scenario's `intent`.
-
-If a specific pair of prompts *should* match and does not, the fix is usually upstream of the
-threshold: the two prompts genuinely mean different things to the embedding model. Re-record with a
-first prompt that states the task plainly.
+- A replay that answered the wrong question → switch that recording off in the console (its
+  scenario then never runs), or `bir replay off` in the project, and re-read the scenario's
+  `intent`. On a service you run yourself, raise `SIMILARITY_THRESHOLD` or `SIMILARITY_CHECK_FLOOR`.
+- A prompt you *would* have wanted replayed that did not match → the fix is usually upstream of any
+  threshold: the two prompts genuinely mean different things to the embedding model. Re-record with
+  a first prompt that states the task plainly.
 
 ---
 
@@ -557,7 +558,7 @@ first prompt that states the task plainly.
 | `replay.vetoed … the model's first call was …, not run_scenario` | A direct plan, and the model reached for another tool first — usually because it has no `run_scenario` | As for `no_delivery_tool`. Nothing ran; the model did the task |
 | `replay.pin_declined` on most steered turns | The model's calls to the expected tool are not the step — another command, another file — so nothing is pinned; if it then moves on, `replay.pin_abandoned` retires the plan | Harmless for those calls, which ran as the model wrote them. Persistent declines on one step usually mean its arguments cannot be shown in the directive (they depend on an earlier step's output, or the command runs to several lines), and the model writes its own |
 | `why="no step is executable"` | None of the scenario's tools is a wrapped MCP server and none is a built-in reachable in this session | Wrap the servers the scenario uses (`bir install --server …`) and recalculate |
-| `plan.armed mode=steer` where you expected `direct` | At least one step is a built-in off `BIR_BUILTIN_TOOLS` (default `Read,Glob,Grep` — so usually `Edit`, `Write` or `Bash`), an unwrapped MCP server, or `claude-in-chrome` | `bir status` shows what is wrapped; the `plan.armed` line's `coverage=` names the `live` step. Widen `BIR_BUILTIN_TOOLS` (and `BIR_BASH_ALLOW`) only deliberately. `claude-in-chrome` is `scope: "dynamic"` and can never be wrapped |
+| `plan.armed mode=steer` where you expected `direct` | At least one step is a built-in off `BIR_BUILTIN_TOOLS` (by default one the runner does not implement, such as `WebFetch` or `Task`; a `Bash` step too when `BIR_BASH_ALLOW=none`), an unwrapped MCP server, or `claude-in-chrome`. Before 0.3.8 the default list was `Read,Glob,Grep`, so `Edit`, `Write` and `Bash` steered too | `bir status` shows what is wrapped; the `plan.armed` line's `coverage=` names the `live` step. `claude-in-chrome` is `scope: "dynamic"` and can never be wrapped |
 | Model ignores the directive and diverges every turn | Steering is advisory — the model chooses; `bir` only pins arguments | Expected occasionally. Persistent divergence usually means the scenario's tools do not fit the live task; check `intent` |
 | A `replay.thread` line with no `emitted=` (under `BIR_VERBOSE=1`) | `toolOutputLogic` derived nothing — usually the output shape changed since recording | Dry-replay (§3.1). If the dry run emits and the live run does not, the tool's output shape has drifted; recalculate |
 | `replay.thread_fallback` on a wrapped step | The proxy did not report within the grace window | Check that proxy is alive (`bir doctor`). Repeats mean a slow or dying upstream |

package/docs/installRun.md

@@ -571,8 +571,8 @@ Fleet switches on `bir setup`: `--allow-servers a,b` stores the servers replay
 may call unattended for this project; `bir replay allow|on|off|status` changes
 it later. Both live in the project record (§4.3), so a recorder the hook starts
 — with Claude Code's environment, not the operator's terminal — keeps them;
-`BIR_REPLAY`, `BIR_REPLAY_ALLOW_SERVERS` and `BIR_MIN_STEER_SIMILARITY` in the
-recorder's environment still override, and `bir doctor` says which source is in
+`BIR_REPLAY` and `BIR_REPLAY_ALLOW_SERVERS` in the recorder's environment still
+override, and `bir doctor` says which source is in
 effect. `--no-replay` adds no scenario server (one an earlier setup added stays
 until `bir uninstall --replay`) and stores replay off (`bir replay on` turns it
 on); `--no-daemon` wires everything and starts

package/docs/t-bench.md

@@ -357,9 +357,8 @@ Per arm, per domain: reward (mean), pass^k across trials, `$`/episode and `$`/tu
 `--output-format json`'s `total_cost_usd`, wall-clock per episode, and turn count.
 
 Per replayed turn, from the audit log and the execution ledger: outcome
-(`steered_full` / `diverged` / `fell_back` / `not_steered` / `failed`), match similarity against
-`BIR_MIN_STEER_SIMILARITY` (default 0.92), direct vs steered mode, `deriveCostUsd` against
-`sessionCostUsd`, and the per-step verdicts.
+(`steered_full` / `diverged` / `fell_back` / `not_steered` / `failed`), match similarity, direct
+vs steered mode, `deriveCostUsd` against `sessionCostUsd`, and the per-step verdicts.
 
 Two τ-specific splits worth reporting that MCPMark cannot give us:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basein/runner",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "A recording MCP proxy: sits between any MCP client and its MCP servers, executes each call on the client's behalf, and records the run as a reusable BaseIn scenario.",
   "type": "module",
   "license": "MIT",

package/production.md

@@ -847,7 +847,7 @@ Truncation is always marked with the original size.
 | `matchGate` | `{holding, holdMs, until}`: whether prompts have stopped waiting on the match because the service is slow |
 | `correlation` | `auto`, `allow` or `ask`, or `fingerprint` when correlation is off: who approves wrapped calls |
 | `deliveryTool`, `scenarioServers[]` | whether a live `bir-scenario` has said hello (`{pid, tools, off, version, ageMs}`). An empty list means no direct plan is announced. |
-| `replay` | `{enabled, source, minSimilarity, allowServers, deriveKey, deriveVia, pollingProxies}`. `deriveVia` is `service`, `key` or `samples`; `samples` means no scenario with a target can run. |
+| `replay` | `{enabled, source, allowServers, deriveKey, deriveVia, pollingProxies}`. `deriveVia` is `service`, `key` or `samples`; `samples` means no scenario with a target can run. |
 | `registeredProxies[]`, `wrappedServers` | proxies that registered (`serverName`, `pid`, `cwd`, `version`) and the wrapped server names |
 | `hooksVersion`, `pid`, `cwd`, `url` | the recorder's version and identity |
 | `segmentArm` | whether service-found sub-tasks may run mid-task (default: observe only) |
@@ -981,7 +981,6 @@ Defaults were checked in `src/`.
 | `BIR_DERIVE_MODEL` | recorder | `claude-haiku-4-5-20251001` | Model for derivation on this machine. |
 | `BIR_REPLAY` | recorder | on, or the project's stored switch | `0` turns replay off. Any other value forces it on over the stored switch. |
 | `BIR_REPLAY_ALLOW_SERVERS` | recorder | all wrapped servers | Servers that direct runs and divergence recovery may call unattended (comma-separated). |
-| `BIR_MIN_STEER_SIMILARITY` | recorder | 0.92 | Minimum match similarity to replay. |
 | `BIR_MATCH_BUDGET_MS` | recorder | 3000 | Longest a prompt waits for the match. |
 | `BIR_MATCH_SLOW_MS` | recorder | 2000 | A match slower than this, or one that timed out, stops prompts waiting for 5 min, doubling to 30 min. |
 | `BIR_DERIVE_BUDGET_MS` | recorder | 8000 | Derivation wait for `/scenario/run`. Hooks use the smaller of this and `BIR_HOOK_DERIVE_BUDGET_MS`. |
@@ -992,8 +991,8 @@ Defaults were checked in `src/`.
 | `BIR_STEP_TIMEOUT_MS` | recorder | 60000 | One direct `tools/call`. |
 | `BIR_LOGIC_TIMEOUT_MS` | recorder | 1000 (capped at 10000) | Synchronous time limit for one scenario logic body. |
 | `BIR_REPLAY_RECORDED_OUTPUTS` | recorder | unset | `1`: a step that could not be sent may use its recorded output, labelled as such. |
-| `BIR_BUILTIN_TOOLS` | recorder | `Read,Glob,Grep` | Built-ins the runner executes itself during a replay, in the session's project directory and confined to it. Add `Edit,Write,Bash` deliberately — runner-side steps bypass the host's permission prompts. `none` turns it off. |
-| `BIR_BASH_ALLOW` | recorder | unset | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner even when listed. A plan's Bash steps share a working directory, as the host's do; variables do not persist, also as the host's. |
+| `BIR_BUILTIN_TOOLS` | recorder | `Read,Glob,Grep,Edit,Write,Bash` | Built-ins the runner executes itself during a replay, in the session's project directory and confined to it (up to 0.3.7 the default was `Read,Glob,Grep`). Runner-side steps bypass the host's permission prompts; leave a tool off to have the model call it. `none` turns it off. |
+| `BIR_BASH_ALLOW` | recorder | unset (any command) | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset means any command; `none` means no command, and `Bash` steps are steered. A plan's Bash steps share a working directory, as the host's do; variables do not persist, also as the host's. |
 | `BIR_DERIVE_RECENT_RESULTS` | recorder | 5 | How many of this prompt's tool results derivation may read (`0`: none). Never for plans with a command sink. |
 | `BIR_INTENT_MATCH` | recorder | on | `0` turns mid-turn intent probes off. |
 | `BIR_INTENT_MATCH_BUDGET_MS` | recorder | 4000 | One probe's own ceiling. It is not a hook wait. |
@@ -1003,7 +1002,6 @@ Defaults were checked in `src/`.
 | `BIR_INTENT_ARM` | recorder | unset (follows `BIR_SEGMENT_ARM`) | `1`: a probe may arm a plan in its own PreToolUse, and that hook waits for it. `0`: never. |
 | `BIR_INTENT_ARM_BUDGET_MS` | recorder | 500 | How long that PreToolUse waits for the probe. |
 | `BIR_SEGMENT_ARM` | recorder | unset (observe only) | `1`: recurring sub-tasks the service found may run mid-task. |
-| `BIR_MIN_SEGMENT_STEER_SIMILARITY` | recorder | 0.95 | Minimum similarity to steer a segment. |
 | `BIR_CONTROL_URL` | proxy, scenario | written into wrapped entries | The project's control server. Together with `BIR_CONTROL_TOKEN` it is the SDK channel and wins over discovery. |
 | `BIR_CONTROL_TOKEN` | proxy, scenario | unset | Bearer token for the SDK channel. |
 | `BIR_PROXY_STAY_UP` | proxy | unset | `1`: keep answering errors after the upstream dies (0.2.12). |