@basein/runner 0.3.7 → 0.3.8

package/README.md

@@ -319,15 +319,19 @@ prompt you would have seen — only a call that plausibly is the step, though (t
 same command, the same file, the same kind of arguments); any other call runs as
 written and is asked about as usual. A *directly executed* step never reaches the
 permission system at all — it is dispatched to a `bir-proxy` and called on a
-connection that is already open — and `run_scenario`, the call that starts the
+connection that is already open, or, for Claude Code's own `Read`, `Glob`,
+`Grep`, `Edit`, `Write` and `Bash`, run by the recorder itself in the project
+folder — and `run_scenario`, the call that starts the
 run, is answered `allow` while the recorder has announced the plan. In plan mode
 nothing is announced and nothing is approved. Set `BIR_REPLAY_ALLOW_SERVERS` to
 the servers you are content to have called unattended (it also covers a steered
-plan's recovery), and read [the guide's §5.1](docs/calculatedReplayGuide.md)
+plan's recovery), `BIR_BUILTIN_TOOLS` and `BIR_BASH_ALLOW` to the built-ins and
+commands, and read [the guide's §5.1](docs/calculatedReplayGuide.md)
 before enabling it anywhere that matters.
 
-What it buys: on a scenario whose every step is a wrapped MCP tool, the whole
-sequence runs through connections the proxies already hold — **zero model tokens**
+What it buys: on a scenario whose every step is a wrapped MCP tool or one of
+those built-ins, the whole sequence runs through connections the proxies already
+hold, or on the recorder itself — **zero model tokens**
 — and the model's only job is one tool call that reads the results. Such a plan
 is announced only while a `bir` server has told the recorder it is connected,
 and runs only through `run_scenario`: if the model calls anything else first,
@@ -438,8 +442,8 @@ what to do when they register, so there is one switch and no second copy of it:
 |---|---|
 | `BIR_REPLAY` | `0` turns replay off and any other value on, over the project's stored switch (`bir replay on` / `off`; a first plain `bir install` stores off). Nothing below matters while it is off. |
 | `BIR_REPLAY_ALLOW_SERVERS` | Server keys bir may call unattended: **direct** execution, and a steered plan's recovery. Unset means the list `bir replay allow` stored for the project, else every wrapped server; narrowing it is the recommendation. |
-| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default `Read,Glob,Grep` (read-only). Add `Edit,Write,Bash` only deliberately: a runner-side step never reaches Claude Code's permission prompts. `none` turns it off, and a built-in step hands the turn back as before. |
-| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner, even when `BIR_BUILTIN_TOOLS` lists it. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
+| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default all six: `Read,Glob,Grep,Edit,Write,Bash` (up to 0.3.7 only the read-only `Read,Glob,Grep`). A runner-side step never reaches Claude Code's permission prompts, so leave off the list any tool you want the model to call itself. `none` turns it off, and built-in steps are steered in the session. |
+| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run. Unset means any command (`*`); a list such as `git,npm test` narrows it; `none` allows no command, and `Bash` steps are then steered in the session. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
 | `BIR_DERIVE_API_KEY` | **Optional.** Working out what a new request is about — which fleet, which file, which date — is done for you by the service on its own key, as long as you are signed in. Set this (an Anthropic key) only to keep that reading on your machine, on your key. Signed out *and* unset, a scenario whose values change between requests is declined rather than replayed on stale ones. |
 | `ANTHROPIC_API_KEY` | Not used by the background recorder, which has Claude Code's environment and would bill your own key — unless `BIR_USE_ANTHROPIC_API_KEY=1`. A `bir-hooks` run by hand in a terminal uses that terminal's key. |
 | `BIR_DERIVE_MODEL` | Derivation model, when you set a key of your own (default `claude-haiku-4-5-20251001`). |

package/dist/bin/bir-hooks.d.ts

@@ -64,15 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/bir-hooks.js

@@ -64,15 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/investigate.js

@@ -17,6 +17,7 @@
  * declined and what mode armed; the service knows the baseline, the ledger and
  * whether a run ever became a recording. Both lists are printed, worst first.
  */
+import { EXECUTABLE_BUILTINS } from "../replay/builtins.js";
 import { ReadClock, jsonText, readWithin, serviceProblem, underMcp, unreachable } from "./service-read.js";
 const num = (v) => {
     if (v === undefined || v === null || v === "")
@@ -267,12 +268,25 @@ export function localFindings(turn) {
             .filter((t) => Boolean(t));
         if (turn.plan.mode === "steer" && live.length > 0) {
             const lowSaving = savedPct(turn) != null && savedPct(turn) < LOW_SAVING_PCT;
+            const names = [...new Set(live)];
+            // One of the runner's own built-ins steered only because it was off the
+            // list (or the turn ran on a runner older than 0.3.8); anything else can
+            // run directly only behind a wrapped MCP server.
+            const offList = names.filter((n) => EXECUTABLE_BUILTINS.has(n));
+            const elsewhere = names.filter((n) => !EXECUTABLE_BUILTINS.has(n));
+            const fixes = [];
+            if (offList.length > 0) {
+                fixes.push(`The runner runs ${offList.join(", ")} itself when ${offList.length === 1 ? "it is" : "they are"} on \`BIR_BUILTIN_TOOLS\` (unset means all six, from runner 0.3.8) and, for Bash, \`BIR_BASH_ALLOW\` is not \`none\`: fix those where the recorder starts, then \`bir up --restart\`.`);
+            }
+            if (elsewhere.length > 0) {
+                fixes.push(`Put the data ${elsewhere.join(", ")} ${elsewhere.length === 1 ? "reaches" : "reach"} behind an MCP server, wrap it (\`bir install --server <name>\`), and record the prompt again so its steps are MCP calls.`);
+            }
             out.push({
                 code: "steer_mode",
                 severity: lowSaving ? "warn" : "info",
-                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${[...new Set(live)].join(", ")}).`,
-                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool.",
-                fix: "Put the data those tools reach behind an MCP server, wrap it (`bir install --server <name>`), and record the prompt again so its steps are MCP calls.",
+                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${names.join(", ")}).`,
+                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool or a built-in the runner runs itself (Read, Glob, Grep, Edit, Write, Bash).",
+                fix: fixes.join(" "),
                 evidence: { coverage, tools },
             });
         }
@@ -280,8 +294,8 @@ export function localFindings(turn) {
             out.push({
                 code: "direct_mode",
                 severity: "info",
-                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies, no model in the loop.`,
-                cause: "Every step is a wrapped MCP tool this session has a proxy for.",
+                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies and the runner, no model in the loop.`,
+                cause: "Every step is a wrapped MCP tool this session has a proxy for, or a built-in the runner runs itself.",
                 fix: "",
             });
         }
@@ -332,7 +346,7 @@ export function localFindings(turn) {
                 title: `Saved ${pct(p)}: ${usd(r.savedUsd ?? 0)} of a ${usd((r.savedUsd ?? 0) + cost)} baseline.`,
                 cause: `The live session cost ${usd(r.session)} of that baseline${turn.plan?.mode === "steer" ? " — steer mode pays for the whole turn." : "."}`,
                 fix: turn.plan?.mode === "steer"
-                    ? "Direct mode is the fix: wrap the servers so every step is an MCP call (see steer_mode)."
+                    ? "Direct mode is the fix (see steer_mode for what kept this plan out of it)."
                     : "Compare the baseline with a few unsteered runs (BIR_REPLAY=0); a single cheap source run makes any replay look poor.",
                 evidence: { ...r, costUsd: cost, savedPct: p },
             });

package/dist/control/recorder-main.js

@@ -175,9 +175,9 @@ function buildReplayOptions(keeper, policy, key) {
             ? parseAllowList(policy.allowServers.join(","))
             : undefined;
     // Which built-ins the runner may execute itself (replay/builtins.ts):
-    // read-only by default, `BIR_BUILTIN_TOOLS` to change, `BIR_BASH_ALLOW`
-    // before a `Bash` step may run at all. Environment-only knobs, like
-    // `BIR_REPLAY_RECORDED_OUTPUTS`.
+    // all six by default, `BIR_BUILTIN_TOOLS` to narrow them, `BIR_BASH_ALLOW`
+    // to narrow the commands a `Bash` step may run. Environment-only knobs,
+    // like `BIR_REPLAY_RECORDED_OUTPUTS`.
     const builtinTools = parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
     const bashAllow = parseBashAllow(process.env.BIR_BASH_ALLOW);
     const opts = {
@@ -239,7 +239,7 @@ function buildReplayOptions(keeper, policy, key) {
             // Which built-ins may run on the runner itself, and whether Bash may at
             // all — loud for the same reason as the rest of this line.
             builtins: builtinTools.size > 0 ? [...builtinTools].join(",") : "(none)",
-            bashAllow: builtinTools.has("Bash") ? (bashAllow ? bashAllow.join(",") : "(unset — Bash never runs here)") : undefined,
+            bashAllow: builtinTools.has("Bash") ? (bashAllow.length > 0 ? bashAllow.join(",") : "(none — Bash steps are steered)") : undefined,
             // Who reads what this turn acts on (segmented.md R-PARAM-5). Named at
             // startup because the third state is a replay that silently never runs.
             derive: key.source ??

package/dist/control/server.js

@@ -31,7 +31,7 @@ import { BIR_CALL_ID, fingerprint, newCallId, parseQualifiedName, qualifyToolNam
 import { StepIndexAllocator } from "./ordering.js";
 import { pidAlive } from "./discovery.js";
 import { pinCompatible } from "./pin-guard.js";
-import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, usageSince, } from "./transcript.js";
+import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, thinkingForToolUse, usageSince, } from "./transcript.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
 import { redact } from "../record/redact.js";
 import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateStrings } from "../record/truncate.js";
@@ -2346,15 +2346,18 @@ export class ControlServer {
         const agentId = payload.agent_id ?? session.agentId;
         // The real intent, read from every line sharing this message's id
         // (segmented.md R-INTENT-3). `context` stays the *written* text only, with
-        // its agent prefix: thinking is embedded but never stored as text
-        // (R-INTENT-2), so it rides separately in `intent`.
+        // its agent prefix, so thinking rides separately in `intent`.
         const intent = intentForToolUse(session.transcriptPath, toolUseId, this.intentSources);
         const reasoning = intent?.source === "text" ? intent.text : "";
         // The prefix rides on whether there is a subagent, not on whether it said
         // anything: a subagent's steps must be tellable apart even when it narrated
         // nothing. What it never carries is thinking (R-INTENT-2).
         const context = agentId ? `[agent ${agentId}] ${reasoning}`.trim() : reasoning;
-        const thinkingIntent = intent?.source === "thinking" ? { text: intent.text, source: "thinking" } : undefined;
+        // Sent whether or not there was written text: the service keeps it for the
+        // recording page (R-INTENT-2, amended 2026-09-29), and still embeds the
+        // written text first. The probe below reads `intent`, unchanged.
+        const thinking = thinkingForToolUse(session.transcriptPath, toolUseId, this.intentSources);
+        const thinkingIntent = thinking ? { text: thinking, source: "thinking" } : undefined;
         // ── replay steering (docs/calculatedReplay.md §7) ────────────────────────
         // Runs before anything else, because two of its four answers end the call.
         // Not in plan mode (nothing is approved on the user's behalf there), not

package/dist/control/transcript.d.ts

@@ -78,6 +78,15 @@ export interface ToolUseIntent {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export declare function intentForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): ToolUseIntent | undefined;
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export declare function thinkingForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): string | undefined;
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export declare function contextForToolUse(transcriptPath: string | undefined, toolUseId: string): string;
 /** The last assistant text in the transcript — the turn's final answer. */

package/dist/control/transcript.js

@@ -92,8 +92,9 @@ const MAX_INDEXES = 16;
 const MAX_MESSAGES = 128;
 /**
  * Characters of one message's text, and separately of its thinking, kept.
- * Text becomes a step's `context`; thinking is only embedded, and the intent
- * probe sends 4,000 characters of either.
+ * Text becomes a step's `context`; thinking goes with the step as its
+ * `intent`, capped again at 8 KB on the way out, and the intent probe sends
+ * 4,000 characters of either.
  */
 const MAX_MESSAGE_CHARS = 16 * 1024;
 /** `tool_use_id`s remembered, newest last. */
@@ -443,11 +444,7 @@ export function recentToolResults(transcriptPath, n = 5, maxBytes = 2048) {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
-    if (!transcriptPath || !toolUseId)
-        return undefined;
-    const idx = indexFor(transcriptPath);
-    const holder = idx?.toolUses.get(toolUseId);
-    const message = holder ? idx?.messages.get(holder.message) : undefined;
+    const message = messageFor(transcriptPath, toolUseId);
     if (!message)
         return undefined;
     if (sources.has("text")) {
@@ -462,6 +459,28 @@ export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["
     }
     return undefined;
 }
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export function thinkingForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
+    if (!sources.has("thinking"))
+        return undefined;
+    const thinking = messageFor(transcriptPath, toolUseId)?.thinkings.join("\n").trim();
+    return thinking || undefined;
+}
+/** The message that emitted `toolUseId`: its text and thinking, gathered across its lines. */
+function messageFor(transcriptPath, toolUseId) {
+    if (!transcriptPath || !toolUseId)
+        return undefined;
+    const idx = indexFor(transcriptPath);
+    const holder = idx?.toolUses.get(toolUseId);
+    return holder ? idx?.messages.get(holder.message) : undefined;
+}
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export function contextForToolUse(transcriptPath, toolUseId) {
     if (!transcriptPath || !toolUseId)

package/dist/record/remote-recorder.d.ts

@@ -62,7 +62,7 @@ export declare const TEXT_CAPS: {
     readonly answer: number;
     /** A step's written reasoning. */
     readonly context: number;
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     readonly intent: number;
     /** A tool's error text when it is not JSON. */
     readonly toolError: number;

package/dist/record/remote-recorder.js

@@ -66,7 +66,7 @@ export const TEXT_CAPS = {
     answer: 64 * 1024,
     /** A step's written reasoning. */
     context: 8 * 1024,
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     intent: 8 * 1024,
     /** A tool's error text when it is not JSON. */
     toolError: 8 * 1024,

package/dist/replay/builtins.d.ts

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -36,14 +39,15 @@
  * best effort and may drift from a future host's, the same caveat the
  * hook-view threading fallback already carries ("shapes may differ").
  */
+/** The built-ins {@link runBuiltin} actually implements. */
+export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
  */
 export declare const DEFAULT_BUILTIN_TOOLS: readonly string[];
-/** The built-ins {@link runBuiltin} actually implements. */
-export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * Parse `BIR_BUILTIN_TOOLS`. Unset means {@link DEFAULT_BUILTIN_TOOLS}; set,
  * it is the whole list — `none` (or an empty value) turns built-ins off
@@ -54,10 +58,11 @@ export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 export declare function parseBuiltinTools(value: string | undefined): ReadonlySet<string>;
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
-export declare function parseBashAllow(value: string | undefined): readonly string[] | undefined;
+export declare function parseBashAllow(value: string | undefined): readonly string[];
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
  * mid-word must end the command's word too: `git` allows `git status` and
@@ -92,7 +97,7 @@ export interface BuiltinContext {
     cwd: string;
     /** The step's clock, the same budget an MCP dispatch would get. */
     timeoutMs?: number;
-    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). */
+    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). Absent or empty, no command runs. */
     bashAllow?: readonly string[];
     /**
      * Where this plan's *previous* `Bash` step left its shell — the host's own

package/dist/replay/builtins.js

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -42,12 +45,6 @@ import { existsSync } from "node:fs";
 import { readdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 // ── configuration ────────────────────────────────────────────────────────────
-/**
- * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
- */
-export const DEFAULT_BUILTIN_TOOLS = ["Read", "Glob", "Grep"];
 /** The built-ins {@link runBuiltin} actually implements. */
 export const EXECUTABLE_BUILTINS = new Set([
     "Read",
@@ -57,6 +54,13 @@ export const EXECUTABLE_BUILTINS = new Set([
     "Write",
     "Bash",
 ]);
+/**
+ * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
+ */
+export const DEFAULT_BUILTIN_TOOLS = [...EXECUTABLE_BUILTINS];
 /** `read` → `Read`: the vocabulary is small enough to forgive casing. */
 const CANONICAL_BUILTIN = new Map([...EXECUTABLE_BUILTINS].map((name) => [name.toLowerCase(), name]));
 /**
@@ -78,15 +82,17 @@ export function parseBuiltinTools(value) {
 }
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
 export function parseBashAllow(value) {
-    const prefixes = (value ?? "")
+    if (value === undefined)
+        return ["*"];
+    return value
         .split(",")
         .map((s) => s.trim())
-        .filter(Boolean);
-    return prefixes.length > 0 ? prefixes : undefined;
+        .filter((s) => s.length > 0 && !["none", "off", "0"].includes(s.toLowerCase()));
 }
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
@@ -485,13 +491,24 @@ async function runBash(input, ctx) {
     if (typeof command !== "string" || command.trim() === "") {
         throw new BuiltinNotRunnable("command is required");
     }
-    if (!ctx.bashAllow) {
-        throw new BuiltinNotRunnable("BIR_BASH_ALLOW is not set, so bir runs no Bash command unattended");
+    if (!ctx.bashAllow?.length) {
+        throw new BuiltinNotRunnable("BIR_BASH_ALLOW allows no command, so bir runs no Bash command unattended");
     }
     if (!bashAllowed(command, ctx.bashAllow)) {
         throw new BuiltinNotRunnable("the command does not match BIR_BASH_ALLOW, so bir does not run it unattended");
     }
+    // What the host would run differently stays the session's, never started
+    // here: a command it leaves in the background (there is no shell here to
+    // leave it in, so it would be stopped with the step), and one that asks for
+    // more time than this step has. Cut off part-way, an `npm i -g` or a
+    // migration can leave things half done, which is worse than a hand-over.
+    if (input.run_in_background === true) {
+        throw new BuiltinNotRunnable("the command runs in the background, which only the session can do");
+    }
     const timeoutMs = ctx.timeoutMs ?? 120_000;
+    if (typeof input.timeout === "number" && input.timeout > timeoutMs) {
+        throw new BuiltinNotRunnable(`the command asks for up to ${Math.ceil(input.timeout / 1000)} s and this step has ${Math.floor(timeoutMs / 1000)} s, so the session runs it`);
+    }
     // The host's Bash semantics, which the recorded chain was written against:
     // the working directory carries over from the plan's previous Bash step,
     // variables and functions do not (a fresh `-l` shell each call).

package/dist/replay/controller.d.ts

@@ -191,17 +191,17 @@ export interface ReplayOptions {
      * `BIR_BUILTIN_TOOLS` — the built-ins the runner may execute itself, from
      * the session's own project directory (replay/builtins.ts), or stand in
      * for with a recorded output under `BIR_REPLAY_RECORDED_OUTPUTS=1`.
-     * Omitted, the environment decides; the default is the read-only set
-     * (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` run only when listed
-     * explicitly — and `Bash` additionally only for commands matching
-     * {@link ReplayOptions.bashAllow}.
+     * Omitted, the environment decides; the default is all six (`Read`,
+     * `Glob`, `Grep`, `Edit`, `Write`, `Bash`), and `Bash` runs only the
+     * commands {@link ReplayOptions.bashAllow} allows.
      */
     builtinTools?: ReadonlySet<string>;
     /**
      * `BIR_BASH_ALLOW` — command prefixes a runner-side `Bash` step may run
-     * (`*` for all). Undefined means `Bash` never executes here, even when
-     * allow-listed: runner-side execution bypasses the host's permission
-     * prompts, so the shell needs its own explicit opt-in.
+     * (`*` for all). Omitted, the environment decides; the default is `*`.
+     * Empty allows no command, and then `Bash` counts as off
+     * {@link ReplayOptions.builtinTools}: its steps are steered in the session,
+     * rather than armed `direct` and stopped at the first one.
      */
     bashAllow?: readonly string[];
     budgets?: Partial<ReplayBudgets>;
@@ -475,7 +475,7 @@ export declare class ReplayController {
     /** See {@link ReplayOptions.builtinTools}. */
     private readonly builtinTools;
     /** See {@link ReplayOptions.bashAllow}. */
-    private readonly bashAllow?;
+    private readonly bashAllow;
     /** Calls waiting for a plan's pins to change (see `awaitPins`). */
     private readonly pinWaiters;
     /**

package/dist/replay/controller.js

@@ -250,8 +250,14 @@ export class ReplayController {
         this.intentMatch = { ...DEFAULT_INTENT_MATCH, ...(opts.intentMatch ?? {}) };
         this.recordedFallback =
             opts.recordedFallback ?? process.env.BIR_REPLAY_RECORDED_OUTPUTS === "1";
-        this.builtinTools = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
         this.bashAllow = opts.bashAllow ?? parseBashAllow(process.env.BIR_BASH_ALLOW);
+        const builtins = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
+        // A `Bash` that may run no command is not reachable here. Left on the
+        // list, a chain of Bash steps would arm `direct` and stop at its first.
+        this.builtinTools =
+            this.bashAllow.length > 0 || !builtins.has("Bash")
+                ? builtins
+                : new Set([...builtins].filter((name) => name !== "Bash"));
     }
     /**
      * Whether a handed-out segment may actually arm (segmented.md R-OUT-10).
@@ -2067,10 +2073,10 @@ export class ReplayController {
                 // An allow-listed built-in runs *here*, against the session's own
                 // project directory (replay/builtins.ts). Everything else about it —
                 // no session cwd (`bir replay`, an older server), off the list, no
-                // runner-side implementation, a path that leaves the project, `Bash`
-                // without `BIR_BASH_ALLOW` — stays the old contract: `not_run`, so
-                // the session can do the step itself or its recorded output can
-                // stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
+                // runner-side implementation, a path that leaves the project, a `Bash`
+                // command `BIR_BASH_ALLOW` does not allow — stays the old contract:
+                // `not_run`, so the session can do the step itself or its recorded
+                // output can stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
                 if (this.builtinTools.has(name) && state.sessionCwd) {
                     return this.executeBuiltin(name, input, state, opts.deadline);
                 }

package/dist/replay/coverage.d.ts

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/dist/replay/coverage.js

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/docs/calculatedReplay.md

@@ -45,7 +45,7 @@ this design has a ladder whose cheapest rung is free — and the more of a stack
 |---|---|---|
 | Runs MCP tools itself | No (`replay.md` §12: *"rrepeat never executes tools — not even MCP"*) | **Yes**, on the connection it already owns |
 | Divergence fallback | A second Agent SDK session — the dominant cost | Direct `tools/call` through the proxies — **$0** |
-| Reaches built-ins (`Bash`, `Read`) | Only by steering the live session | Read-only ones (`Read`, `Glob`, `Grep`) run on the runner itself, jailed to the project (`BIR_BUILTIN_TOOLS`); `Edit`/`Write`/`Bash` opt-in, else steered |
+| Reaches built-ins (`Bash`, `Read`) | Only by steering the live session | `Read`, `Glob`, `Grep`, `Edit`, `Write` and `Bash` run on the runner itself, jailed to the project (`BIR_BUILTIN_TOOLS`, `BIR_BASH_ALLOW`); any other built-in is steered |
 | Needs `@anthropic-ai/*` at runtime | Yes | No (§16.3) |
 
 ---
@@ -252,21 +252,26 @@ export function modeFor(steps: SerializedScenarioStep[], wrapped: ReadonlySet<st
 | — | `none` | nowhere | declines at gate 5 |
 
 `live` covers three genuinely different cases and treats them identically, correctly: a built-in
-off the `BIR_BUILTIN_TOOLS` allow-list (by default everything but `Read`, `Glob`, `Grep` — so
-`Bash`, `Edit`, `Write`, `Task`, `WebFetch`), an MCP server the user chose not to wrap, and
+off the `BIR_BUILTIN_TOOLS` allow-list (by default everything but the six the runner implements —
+so `Task`, `WebFetch`; up to 0.3.7 also `Bash`, `Edit`, `Write`), an MCP server the user chose not to wrap, and
 `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config file, and therefore can never
 be wrapped (v1 design §1). None of them can be reached except through the session.
 
 A built-in **on** the allow-list runs on the runner, in the session's own project directory and
 confined to it — a path that resolves outside the project, symlinks included, is refused and the
-step is `not_run`, the clean hand-over. `Bash` needs a second opt-in on top (`BIR_BASH_ALLOW`,
-command prefixes), because a runner-side step never reaches the host's permission prompts. The
+step is `not_run`, the clean hand-over. `Bash` has a second switch on top (`BIR_BASH_ALLOW`,
+command prefixes; unset means any command, `none` keeps `Bash` in the session), because a
+runner-side step never reaches the host's permission prompts. The
 results mimic the hook's view of each tool, which is what the recorder stored for built-in steps
 and what their `toolOutputLogic` was authored against; they pass through the same
 `serializeCapped(redact(…))` as every recorded payload. Bash keeps the host's own semantics a
 recorded chain was written against: each call is a fresh `-l` shell (variables and functions do
 not persist), while the **working directory carries over** from the plan's previous Bash step —
-`cd sub` then `cat file` replays as it ran.
+`cd sub` then `cat file` replays as it ran. Two Bash calls the host runs differently are never
+started on the runner, and are `not_run` instead: one with `run_in_background` (there is no shell
+here to leave it in), and one whose own `timeout` is longer than the step's clock
+(`BIR_STEP_TIMEOUT_MS`, clipped to what the plan has left) — cut off part-way, an `npm i -g` or a
+migration can leave things half done.
 
 A **mixed** scenario in `steer` mode still gets direct execution for its wrapped steps once it
 diverges (§8), so coverage is not all-or-nothing at the divergence boundary — only at the arm-time

package/docs/calculatedReplayGuide.md

@@ -234,7 +234,10 @@ When replay arms:
   when it plausibly *is* the step — the same command, the same file, an argument in common (design
   §7) — and never in plan mode.
 - **Direct steps are not visible to the permission system at all.** They are dispatched straight to a
-  `bir-proxy`, which calls the upstream on a connection it already holds. Claude Code never sees them.
+  `bir-proxy`, which calls the upstream on a connection it already holds — or, for Claude Code's own
+  `Read`, `Glob`, `Grep`, `Edit`, `Write` and `Bash`, run by the recorder itself in the project
+  folder, any `Bash` command included (`BIR_BUILTIN_TOOLS`, `BIR_BASH_ALLOW`; up to 0.3.7 only the
+  first three). Claude Code never sees them.
   The `run_scenario` call that starts them is answered `allow` too, while the runner has announced a
   direct plan; your own deny or ask rules for it still apply.
 
@@ -243,7 +246,9 @@ That is what makes replay fast, and it is the whole risk. Two things follow:
 1. Only enable it in a project whose scenarios you have dry-replayed and read (§3.1).
 2. Run `bir replay allow <servers>` (§5.3). An allowlist of the servers you are comfortable having
    called unattended is cheap insurance, and it is the difference between "replay reads a dashboard"
-   and "replay can do anything any wrapped server can do".
+   and "replay can do anything any wrapped server can do". The same goes for built-ins:
+   `BIR_BUILTIN_TOOLS=Read,Glob,Grep` keeps writes and commands with the model, and
+   `BIR_BASH_ALLOW=git,npm test` (for example) limits the commands the recorder runs itself.
 
 Nothing else is approved on your behalf. Outside a matched scenario's own steps, a wrapped MCP call
 keeps its permission prompt, as it would without the runner (`bir doctor` says so in a note);
@@ -354,8 +359,8 @@ so there is exactly one switch and it cannot get out of step with itself.
 | `BIR_STEP_TIMEOUT_MS` | `60000` | Per-step ceiling for one direct `tools/call`, clipped to what the plan has left |
 | `BIR_LOGIC_TIMEOUT_MS` | `1000` | How long one scenario logic body may run before it is stopped. At most 10 000 |
 | `BIR_REPLAY_RECORDED_OUTPUTS` | *(unset)* | `1` lets a step that could not be sent (a built-in off `BIR_BUILTIN_TOOLS`, no proxy, a server off the allowlist) stand on its recorded output instead of stopping the plan. Never for a timeout or an upstream error |
-| `BIR_BUILTIN_TOOLS` | `Read,Glob,Grep` | Built-ins the runner executes itself during a replay, in the session's own project directory and confined to it. A chain whose only non-MCP steps are on this list arms `direct`. Add `Edit,Write,Bash` only deliberately — a runner-side step never reaches the host's permission prompts. `none` restores the old behaviour: every built-in hands the turn back |
-| `BIR_BASH_ALLOW` | *(unset)* | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner, even when `BIR_BUILTIN_TOOLS` lists it. A plan's Bash steps share a working directory, exactly as the host's own Bash tool does — variables and functions do not persist, also as the host's |
+| `BIR_BUILTIN_TOOLS` | `Read,Glob,Grep,Edit,Write,Bash` | Built-ins the runner executes itself during a replay, in the session's own project directory and confined to it. A chain whose only non-MCP steps are on this list arms `direct`. A runner-side step never reaches the host's permission prompts, so leave off any tool you want the model to call itself; `Read,Glob,Grep` is the read-only set (the default up to 0.3.7). `none`: every built-in step is steered in the session |
+| `BIR_BASH_ALLOW` | *(unset: any command)* | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset means any command; `none` means no command, and `Bash` steps are steered in the session. A plan's Bash steps share a working directory, exactly as the host's own Bash tool does — variables and functions do not persist, also as the host's. A call with `run_in_background`, or with its own `timeout` longer than the step's clock (`BIR_STEP_TIMEOUT_MS`), is never started on the runner: the plan hands over in front of it |
 | `BIR_INTENT_ARM` | *(unset)* | `1` lets a match found mid-turn arm a plan in the calling tool's place, which means waiting for it (`BIR_INTENT_ARM_BUDGET_MS`, 500); `0` never waits; unset follows `BIR_SEGMENT_ARM` |
 | `BIR_VERBOSE` | *(unset)* | `1` adds per-step `replay.*` detail lines |
 
@@ -553,7 +558,7 @@ matches. A prompt that missed both is matched once more on its task line (`PROMP
 | `replay.vetoed … the model's first call was …, not run_scenario` | A direct plan, and the model reached for another tool first — usually because it has no `run_scenario` | As for `no_delivery_tool`. Nothing ran; the model did the task |
 | `replay.pin_declined` on most steered turns | The model's calls to the expected tool are not the step — another command, another file — so nothing is pinned; if it then moves on, `replay.pin_abandoned` retires the plan | Harmless for those calls, which ran as the model wrote them. Persistent declines on one step usually mean its arguments cannot be shown in the directive (they depend on an earlier step's output, or the command runs to several lines), and the model writes its own |
 | `why="no step is executable"` | None of the scenario's tools is a wrapped MCP server and none is a built-in reachable in this session | Wrap the servers the scenario uses (`bir install --server …`) and recalculate |
-| `plan.armed mode=steer` where you expected `direct` | At least one step is a built-in off `BIR_BUILTIN_TOOLS` (default `Read,Glob,Grep` — so usually `Edit`, `Write` or `Bash`), an unwrapped MCP server, or `claude-in-chrome` | `bir status` shows what is wrapped; the `plan.armed` line's `coverage=` names the `live` step. Widen `BIR_BUILTIN_TOOLS` (and `BIR_BASH_ALLOW`) only deliberately. `claude-in-chrome` is `scope: "dynamic"` and can never be wrapped |
+| `plan.armed mode=steer` where you expected `direct` | At least one step is a built-in off `BIR_BUILTIN_TOOLS` (by default one the runner does not implement, such as `WebFetch` or `Task`; a `Bash` step too when `BIR_BASH_ALLOW=none`), an unwrapped MCP server, or `claude-in-chrome`. Before 0.3.8 the default list was `Read,Glob,Grep`, so `Edit`, `Write` and `Bash` steered too | `bir status` shows what is wrapped; the `plan.armed` line's `coverage=` names the `live` step. `claude-in-chrome` is `scope: "dynamic"` and can never be wrapped |
 | Model ignores the directive and diverges every turn | Steering is advisory — the model chooses; `bir` only pins arguments | Expected occasionally. Persistent divergence usually means the scenario's tools do not fit the live task; check `intent` |
 | A `replay.thread` line with no `emitted=` (under `BIR_VERBOSE=1`) | `toolOutputLogic` derived nothing — usually the output shape changed since recording | Dry-replay (§3.1). If the dry run emits and the live run does not, the tool's output shape has drifted; recalculate |
 | `replay.thread_fallback` on a wrapped step | The proxy did not report within the grace window | Check that proxy is alive (`bir doctor`). Repeats mean a slow or dying upstream |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basein/runner",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "A recording MCP proxy: sits between any MCP client and its MCP servers, executes each call on the client's behalf, and records the run as a reusable BaseIn scenario.",
   "type": "module",
   "license": "MIT",

package/production.md

@@ -991,8 +991,8 @@ Defaults were checked in `src/`.
 | `BIR_STEP_TIMEOUT_MS` | recorder | 60000 | One direct `tools/call`. |
 | `BIR_LOGIC_TIMEOUT_MS` | recorder | 1000 (capped at 10000) | Synchronous time limit for one scenario logic body. |
 | `BIR_REPLAY_RECORDED_OUTPUTS` | recorder | unset | `1`: a step that could not be sent may use its recorded output, labelled as such. |
-| `BIR_BUILTIN_TOOLS` | recorder | `Read,Glob,Grep` | Built-ins the runner executes itself during a replay, in the session's project directory and confined to it. Add `Edit,Write,Bash` deliberately — runner-side steps bypass the host's permission prompts. `none` turns it off. |
-| `BIR_BASH_ALLOW` | recorder | unset | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner even when listed. A plan's Bash steps share a working directory, as the host's do; variables do not persist, also as the host's. |
+| `BIR_BUILTIN_TOOLS` | recorder | `Read,Glob,Grep,Edit,Write,Bash` | Built-ins the runner executes itself during a replay, in the session's project directory and confined to it (up to 0.3.7 the default was `Read,Glob,Grep`). Runner-side steps bypass the host's permission prompts; leave a tool off to have the model call it. `none` turns it off. |
+| `BIR_BASH_ALLOW` | recorder | unset (any command) | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset means any command; `none` means no command, and `Bash` steps are steered. A plan's Bash steps share a working directory, as the host's do; variables do not persist, also as the host's. |
 | `BIR_DERIVE_RECENT_RESULTS` | recorder | 5 | How many of this prompt's tool results derivation may read (`0`: none). Never for plans with a command sink. |
 | `BIR_INTENT_MATCH` | recorder | on | `0` turns mid-turn intent probes off. |
 | `BIR_INTENT_MATCH_BUDGET_MS` | recorder | 4000 | One probe's own ceiling. It is not a hook wait. |