@basein/runner 0.3.7 → 0.3.9

package/README.md

@@ -319,15 +319,19 @@ prompt you would have seen — only a call that plausibly is the step, though (t
 same command, the same file, the same kind of arguments); any other call runs as
 written and is asked about as usual. A *directly executed* step never reaches the
 permission system at all — it is dispatched to a `bir-proxy` and called on a
-connection that is already open — and `run_scenario`, the call that starts the
+connection that is already open, or, for Claude Code's own `Read`, `Glob`,
+`Grep`, `Edit`, `Write` and `Bash`, run by the recorder itself in the project
+folder — and `run_scenario`, the call that starts the
 run, is answered `allow` while the recorder has announced the plan. In plan mode
 nothing is announced and nothing is approved. Set `BIR_REPLAY_ALLOW_SERVERS` to
 the servers you are content to have called unattended (it also covers a steered
-plan's recovery), and read [the guide's §5.1](docs/calculatedReplayGuide.md)
+plan's recovery), `BIR_BUILTIN_TOOLS` and `BIR_BASH_ALLOW` to the built-ins and
+commands, and read [the guide's §5.1](docs/calculatedReplayGuide.md)
 before enabling it anywhere that matters.
 
-What it buys: on a scenario whose every step is a wrapped MCP tool, the whole
-sequence runs through connections the proxies already hold — **zero model tokens**
+What it buys: on a scenario whose every step is a wrapped MCP tool or one of
+those built-ins, the whole sequence runs through connections the proxies already
+hold, or on the recorder itself — **zero model tokens**
 — and the model's only job is one tool call that reads the results. Such a plan
 is announced only while a `bir` server has told the recorder it is connected,
 and runs only through `run_scenario`: if the model calls anything else first,
@@ -438,8 +442,8 @@ what to do when they register, so there is one switch and no second copy of it:
 |---|---|
 | `BIR_REPLAY` | `0` turns replay off and any other value on, over the project's stored switch (`bir replay on` / `off`; a first plain `bir install` stores off). Nothing below matters while it is off. |
 | `BIR_REPLAY_ALLOW_SERVERS` | Server keys bir may call unattended: **direct** execution, and a steered plan's recovery. Unset means the list `bir replay allow` stored for the project, else every wrapped server; narrowing it is the recommendation. |
-| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default `Read,Glob,Grep` (read-only). Add `Edit,Write,Bash` only deliberately: a runner-side step never reaches Claude Code's permission prompts. `none` turns it off, and a built-in step hands the turn back as before. |
-| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run (`*` for all). Unset, `Bash` never executes on the runner, even when `BIR_BUILTIN_TOOLS` lists it. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
+| `BIR_BUILTIN_TOOLS` | Built-in tools bir may execute itself during a replay — in the session's own project directory, and confined to it. Default all six: `Read,Glob,Grep,Edit,Write,Bash` (up to 0.3.7 only the read-only `Read,Glob,Grep`). A runner-side step never reaches Claude Code's permission prompts, so leave off the list any tool you want the model to call itself. `none` turns it off, and built-in steps are steered in the session. |
+| `BIR_BASH_ALLOW` | Command prefixes a runner-side `Bash` step may run. Unset means any command (`*`); a list such as `git,npm test` narrows it; `none` allows no command, and `Bash` steps are then steered in the session. A plan's Bash steps share a working directory, as Claude Code's do (variables and functions do not persist, also as in Claude Code). |
 | `BIR_DERIVE_API_KEY` | **Optional.** Working out what a new request is about — which fleet, which file, which date — is done for you by the service on its own key, as long as you are signed in. Set this (an Anthropic key) only to keep that reading on your machine, on your key. Signed out *and* unset, a scenario whose values change between requests is declined rather than replayed on stale ones. |
 | `ANTHROPIC_API_KEY` | Not used by the background recorder, which has Claude Code's environment and would bill your own key — unless `BIR_USE_ANTHROPIC_API_KEY=1`. A `bir-hooks` run by hand in a terminal uses that terminal's key. |
 | `BIR_DERIVE_MODEL` | Derivation model, when you set a key of your own (default `claude-haiku-4-5-20251001`). |

package/dist/bin/bir-hooks.d.ts

@@ -64,15 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/bir-hooks.js

@@ -64,15 +64,15 @@
  *   BIR_BUILTIN_TOOLS         comma-separated built-ins the runner may execute
  *                             itself during a replay, in the session's own
  *                             project directory and confined to it
- *                             (replay/builtins.ts). Default Read,Glob,Grep —
- *                             the read-only set. Add Edit,Write,Bash only
- *                             deliberately: a runner-side step never reaches
- *                             the host's permission prompts. `none` turns
- *                             built-ins off, and then a built-in step hands
- *                             the turn back, as before
+ *                             (replay/builtins.ts). Default all six:
+ *                             Read,Glob,Grep,Edit,Write,Bash. A runner-side
+ *                             step never reaches the host's permission
+ *                             prompts; Read,Glob,Grep is the read-only set
+ *                             (the default up to 0.3.7). `none` turns
+ *                             built-ins off, and their steps are steered
  *   BIR_BASH_ALLOW            command prefixes a runner-side Bash step may run
- *                             (`*` for all). Unset, Bash never executes on the
- *                             runner even when BIR_BUILTIN_TOOLS lists it
+ *                             (`*` for all). Unset means `*`; `none` means no
+ *                             command, and Bash steps are steered
  *   BIR_DERIVE_API_KEY        OPTIONAL. Derivation — reading what this turn acts
  *                             on — is done by the service for a signed-in
  *                             runner. Set this (an Anthropic key) only to keep

package/dist/bin/investigate.js

@@ -17,6 +17,7 @@
  * declined and what mode armed; the service knows the baseline, the ledger and
  * whether a run ever became a recording. Both lists are printed, worst first.
  */
+import { EXECUTABLE_BUILTINS } from "../replay/builtins.js";
 import { ReadClock, jsonText, readWithin, serviceProblem, underMcp, unreachable } from "./service-read.js";
 const num = (v) => {
     if (v === undefined || v === null || v === "")
@@ -267,12 +268,25 @@ export function localFindings(turn) {
             .filter((t) => Boolean(t));
         if (turn.plan.mode === "steer" && live.length > 0) {
             const lowSaving = savedPct(turn) != null && savedPct(turn) < LOW_SAVING_PCT;
+            const names = [...new Set(live)];
+            // One of the runner's own built-ins steered only because it was off the
+            // list (or the turn ran on a runner older than 0.3.8); anything else can
+            // run directly only behind a wrapped MCP server.
+            const offList = names.filter((n) => EXECUTABLE_BUILTINS.has(n));
+            const elsewhere = names.filter((n) => !EXECUTABLE_BUILTINS.has(n));
+            const fixes = [];
+            if (offList.length > 0) {
+                fixes.push(`The runner runs ${offList.join(", ")} itself when ${offList.length === 1 ? "it is" : "they are"} on \`BIR_BUILTIN_TOOLS\` (unset means all six, from runner 0.3.8) and, for Bash, \`BIR_BASH_ALLOW\` is not \`none\`: fix those where the recorder starts, then \`bir up --restart\`.`);
+            }
+            if (elsewhere.length > 0) {
+                fixes.push(`Put the data ${elsewhere.join(", ")} ${elsewhere.length === 1 ? "reaches" : "reach"} behind an MCP server, wrap it (\`bir install --server <name>\`), and record the prompt again so its steps are MCP calls.`);
+            }
             out.push({
                 code: "steer_mode",
                 severity: lowSaving ? "warn" : "info",
-                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${[...new Set(live)].join(", ")}).`,
-                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool.",
-                fix: "Put the data those tools reach behind an MCP server, wrap it (`bir install --server <name>`), and record the prompt again so its steps are MCP calls.",
+                title: `The plan armed in steer mode: ${live.length} of ${coverage.length} steps are reachable only inside the session (${names.join(", ")}).`,
+                cause: "In steer mode the runner pins each call's inputs and auto-approves it, but the model still emits every tool call, reads every result and writes the answer — so the whole live turn is still paid for. Direct mode, where the model makes no tool call, needs every step to be a wrapped MCP server tool or a built-in the runner runs itself (Read, Glob, Grep, Edit, Write, Bash).",
+                fix: fixes.join(" "),
                 evidence: { coverage, tools },
             });
         }
@@ -280,8 +294,8 @@ export function localFindings(turn) {
             out.push({
                 code: "direct_mode",
                 severity: "info",
-                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies, no model in the loop.`,
-                cause: "Every step is a wrapped MCP tool this session has a proxy for.",
+                title: `The plan armed in direct mode: ${turn.plan.steps ?? coverage.length} steps ran on the proxies and the runner, no model in the loop.`,
+                cause: "Every step is a wrapped MCP tool this session has a proxy for, or a built-in the runner runs itself.",
                 fix: "",
             });
         }
@@ -332,7 +346,7 @@ export function localFindings(turn) {
                 title: `Saved ${pct(p)}: ${usd(r.savedUsd ?? 0)} of a ${usd((r.savedUsd ?? 0) + cost)} baseline.`,
                 cause: `The live session cost ${usd(r.session)} of that baseline${turn.plan?.mode === "steer" ? " — steer mode pays for the whole turn." : "."}`,
                 fix: turn.plan?.mode === "steer"
-                    ? "Direct mode is the fix: wrap the servers so every step is an MCP call (see steer_mode)."
+                    ? "Direct mode is the fix (see steer_mode for what kept this plan out of it)."
                     : "Compare the baseline with a few unsteered runs (BIR_REPLAY=0); a single cheap source run makes any replay look poor.",
                 evidence: { ...r, costUsd: cost, savedPct: p },
             });

package/dist/control/recorder-main.js

@@ -175,9 +175,9 @@ function buildReplayOptions(keeper, policy, key) {
             ? parseAllowList(policy.allowServers.join(","))
             : undefined;
     // Which built-ins the runner may execute itself (replay/builtins.ts):
-    // read-only by default, `BIR_BUILTIN_TOOLS` to change, `BIR_BASH_ALLOW`
-    // before a `Bash` step may run at all. Environment-only knobs, like
-    // `BIR_REPLAY_RECORDED_OUTPUTS`.
+    // all six by default, `BIR_BUILTIN_TOOLS` to narrow them, `BIR_BASH_ALLOW`
+    // to narrow the commands a `Bash` step may run. Environment-only knobs,
+    // like `BIR_REPLAY_RECORDED_OUTPUTS`.
     const builtinTools = parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
     const bashAllow = parseBashAllow(process.env.BIR_BASH_ALLOW);
     const opts = {
@@ -239,7 +239,7 @@ function buildReplayOptions(keeper, policy, key) {
             // Which built-ins may run on the runner itself, and whether Bash may at
             // all — loud for the same reason as the rest of this line.
             builtins: builtinTools.size > 0 ? [...builtinTools].join(",") : "(none)",
-            bashAllow: builtinTools.has("Bash") ? (bashAllow ? bashAllow.join(",") : "(unset — Bash never runs here)") : undefined,
+            bashAllow: builtinTools.has("Bash") ? (bashAllow.length > 0 ? bashAllow.join(",") : "(none — Bash steps are steered)") : undefined,
             // Who reads what this turn acts on (segmented.md R-PARAM-5). Named at
             // startup because the third state is a replay that silently never runs.
             derive: key.source ??

package/dist/control/server.js

@@ -31,7 +31,7 @@ import { BIR_CALL_ID, fingerprint, newCallId, parseQualifiedName, qualifyToolNam
 import { StepIndexAllocator } from "./ordering.js";
 import { pidAlive } from "./discovery.js";
 import { pinCompatible } from "./pin-guard.js";
-import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, usageSince, } from "./transcript.js";
+import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, thinkingForToolUse, usageSince, } from "./transcript.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
 import { redact } from "../record/redact.js";
 import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateStrings } from "../record/truncate.js";
@@ -2346,15 +2346,18 @@ export class ControlServer {
         const agentId = payload.agent_id ?? session.agentId;
         // The real intent, read from every line sharing this message's id
         // (segmented.md R-INTENT-3). `context` stays the *written* text only, with
-        // its agent prefix: thinking is embedded but never stored as text
-        // (R-INTENT-2), so it rides separately in `intent`.
+        // its agent prefix, so thinking rides separately in `intent`.
         const intent = intentForToolUse(session.transcriptPath, toolUseId, this.intentSources);
         const reasoning = intent?.source === "text" ? intent.text : "";
         // The prefix rides on whether there is a subagent, not on whether it said
         // anything: a subagent's steps must be tellable apart even when it narrated
         // nothing. What it never carries is thinking (R-INTENT-2).
         const context = agentId ? `[agent ${agentId}] ${reasoning}`.trim() : reasoning;
-        const thinkingIntent = intent?.source === "thinking" ? { text: intent.text, source: "thinking" } : undefined;
+        // Sent whether or not there was written text: the service keeps it for the
+        // recording page (R-INTENT-2, amended 2026-09-29), and still embeds the
+        // written text first. The probe below reads `intent`, unchanged.
+        const thinking = thinkingForToolUse(session.transcriptPath, toolUseId, this.intentSources);
+        const thinkingIntent = thinking ? { text: thinking, source: "thinking" } : undefined;
         // ── replay steering (docs/calculatedReplay.md §7) ────────────────────────
         // Runs before anything else, because two of its four answers end the call.
         // Not in plan mode (nothing is approved on the user's behalf there), not

package/dist/control/transcript.d.ts

@@ -78,6 +78,15 @@ export interface ToolUseIntent {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export declare function intentForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): ToolUseIntent | undefined;
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export declare function thinkingForToolUse(transcriptPath: string | undefined, toolUseId: string, sources?: ReadonlySet<IntentSource>): string | undefined;
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export declare function contextForToolUse(transcriptPath: string | undefined, toolUseId: string): string;
 /** The last assistant text in the transcript — the turn's final answer. */

package/dist/control/transcript.js

@@ -92,8 +92,9 @@ const MAX_INDEXES = 16;
 const MAX_MESSAGES = 128;
 /**
  * Characters of one message's text, and separately of its thinking, kept.
- * Text becomes a step's `context`; thinking is only embedded, and the intent
- * probe sends 4,000 characters of either.
+ * Text becomes a step's `context`; thinking goes with the step as its
+ * `intent`, capped again at 8 KB on the way out, and the intent probe sends
+ * 4,000 characters of either.
  */
 const MAX_MESSAGE_CHARS = 16 * 1024;
 /** `tool_use_id`s remembered, newest last. */
@@ -443,11 +444,7 @@ export function recentToolResults(transcriptPath, n = 5, maxBytes = 2048) {
  * next rung tried. It governs only what may be *sent*; it never stops a probe.
  */
 export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
-    if (!transcriptPath || !toolUseId)
-        return undefined;
-    const idx = indexFor(transcriptPath);
-    const holder = idx?.toolUses.get(toolUseId);
-    const message = holder ? idx?.messages.get(holder.message) : undefined;
+    const message = messageFor(transcriptPath, toolUseId);
     if (!message)
         return undefined;
     if (sources.has("text")) {
@@ -462,6 +459,28 @@ export function intentForToolUse(transcriptPath, toolUseId, sources = new Set(["
     }
     return undefined;
 }
+/**
+ * The thinking `toolUseId` was chosen in, whether or not the agent also wrote
+ * text. The service keeps it with the step so the recording page can show it
+ * (segmented.md R-INTENT-2, amended 2026-09-29); {@link intentForToolUse}
+ * returns thinking only in place of missing text, which is what matching wants.
+ *
+ * `sources` is `BIR_INTENT_SOURCES`: without `thinking` in it, none is sent.
+ */
+export function thinkingForToolUse(transcriptPath, toolUseId, sources = new Set(["text", "thinking", "tool"])) {
+    if (!sources.has("thinking"))
+        return undefined;
+    const thinking = messageFor(transcriptPath, toolUseId)?.thinkings.join("\n").trim();
+    return thinking || undefined;
+}
+/** The message that emitted `toolUseId`: its text and thinking, gathered across its lines. */
+function messageFor(transcriptPath, toolUseId) {
+    if (!transcriptPath || !toolUseId)
+        return undefined;
+    const idx = indexFor(transcriptPath);
+    const holder = idx?.toolUses.get(toolUseId);
+    return holder ? idx?.messages.get(holder.message) : undefined;
+}
 /** The assistant text that accompanied `toolUseId`, or "" when unavailable. */
 export function contextForToolUse(transcriptPath, toolUseId) {
     if (!transcriptPath || !toolUseId)

package/dist/record/remote-recorder.d.ts

@@ -62,13 +62,21 @@ export declare const TEXT_CAPS: {
     readonly answer: number;
     /** A step's written reasoning. */
     readonly context: number;
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     readonly intent: number;
     /** A tool's error text when it is not JSON. */
     readonly toolError: number;
     /** An execution report's error lines, rendered in a web page. */
     readonly reportError: number;
 };
+/**
+ * The most an execution report's request may weigh. The service reads this
+ * route with its 100 kB JSON parser — only `/recordings` has the larger one —
+ * and a report it refuses for its size loses the turn's cost with it. So the
+ * steps' tool payloads get what is left of this after everything else in the
+ * report: the costs, the prompt, the verdicts.
+ */
+export declare const REPORT_MAX_BYTES: number;
 /** Queued sends past which the oldest unsent step is dropped (`BIR_RECORDER_MAX_PENDING`). */
 export declare const DEFAULT_MAX_PENDING_SENDS = 500;
 /** Queued bytes past which the same happens (`BIR_RECORDER_MAX_PENDING_BYTES`). */

package/dist/record/remote-recorder.js

@@ -52,7 +52,7 @@ import { credentialsPath, describeBody, isAuthResponse, issuedFor, loadCredentia
 import { errText, logDetail, logEvery, logLine } from "../util/log.js";
 import { isUnhealthyStatus, serviceHealth, serviceTimeoutMs, timeoutSignal, } from "../util/service-health.js";
 import { redactJsonText, redactText } from "./redact.js";
-import { capJsonText, capText, DEFAULT_MAX_PAYLOAD_BYTES, preCut } from "./truncate.js";
+import { capJsonText, capText, DEFAULT_MAX_PAYLOAD_BYTES, preCut, REPORT_PAYLOAD_MAX_BYTES, } from "./truncate.js";
 /**
  * Caps for the free text this recorder sends, in UTF-8 bytes. Tool payloads
  * arrive capped at 64 KiB by their producers; text never passed through one,
@@ -66,13 +66,21 @@ export const TEXT_CAPS = {
     answer: 64 * 1024,
     /** A step's written reasoning. */
     context: 8 * 1024,
-    /** A step's thinking text, sent only to be embedded. */
+    /** A step's thinking text: embedded, and kept for the recording page. */
     intent: 8 * 1024,
     /** A tool's error text when it is not JSON. */
     toolError: 8 * 1024,
     /** An execution report's error lines, rendered in a web page. */
     reportError: 2 * 1024,
 };
+/**
+ * The most an execution report's request may weigh. The service reads this
+ * route with its 100 kB JSON parser — only `/recordings` has the larger one —
+ * and a report it refuses for its size loses the turn's cost with it. So the
+ * steps' tool payloads get what is left of this after everything else in the
+ * report: the costs, the prompt, the verdicts.
+ */
+export const REPORT_MAX_BYTES = 96 * 1024;
 /** Queued sends past which the oldest unsent step is dropped (`BIR_RECORDER_MAX_PENDING`). */
 export const DEFAULT_MAX_PENDING_SENDS = 500;
 /** Queued bytes past which the same happens (`BIR_RECORDER_MAX_PENDING_BYTES`). */
@@ -177,6 +185,61 @@ function sizeOf(...parts) {
         n += p?.text.length ?? 0;
     return n;
 }
+function pendStep(step) {
+    return {
+        step,
+        toolInput: pend(step.toolInput, REPORT_PAYLOAD_MAX_BYTES, true),
+        toolOutput: pend(step.toolOutput, REPORT_PAYLOAD_MAX_BYTES, true),
+    };
+}
+/**
+ * An execution report's request body: `fields`, and its steps as sent — each
+ * error and each tool payload capped and redacted, like every other field here.
+ *
+ * The payloads are what makes a report heavy, so they are added last and only
+ * while the whole body stays within {@link REPORT_MAX_BYTES}: the failed
+ * steps' first — theirs are the ones somebody will read — then every step's
+ * input, then the outputs, each in the order the steps ran. A payload that
+ * does not fit is left out; its step keeps its verdict, and the costs the
+ * report exists for are never what gives way.
+ */
+function reportBody(fields, steps) {
+    if (!steps)
+        return JSON.stringify(fields);
+    const sent = steps.map(({ step }) => ({
+        ...step,
+        error: typeof step.error === "string"
+            ? capText(step.error, TEXT_CAPS.reportError, redactText)
+            : step.error,
+        toolInput: undefined,
+        toolOutput: undefined,
+    }));
+    const bare = Buffer.byteLength(JSON.stringify({ ...fields, steps: sent }), "utf8");
+    let left = REPORT_MAX_BYTES - bare;
+    const add = (i, key) => {
+        if (sent[i][key] !== undefined)
+            return;
+        const text = out(steps[i][key]);
+        if (text === undefined)
+            return;
+        // The value as a JSON string, and `,"<key>":` in front of it.
+        const size = Buffer.byteLength(JSON.stringify(text), "utf8") + key.length + 4;
+        if (size > left)
+            return;
+        sent[i][key] = text;
+        left -= size;
+    };
+    const all = sent.map((_, i) => i);
+    for (const i of all.filter((n) => sent[n].status === "failed")) {
+        add(i, "toolInput");
+        add(i, "toolOutput");
+    }
+    for (const i of all)
+        add(i, "toolInput");
+    for (const i of all)
+        add(i, "toolOutput");
+    return JSON.stringify({ ...fields, steps: sent });
+}
 /** A tool error is JSON when a producer serialized it, and prose when it did not. */
 function pendError(text) {
     if (typeof text !== "string")
@@ -609,12 +672,21 @@ export class RemoteRecorder {
         const costUsd = report.deriveCostUsd + report.sessionCostUsd + report.fallbackCostUsd;
         const prompt = pend(report.prompt, TEXT_CAPS.prompt);
         const error = pend(report.error, TEXT_CAPS.reportError);
+        const steps = report.steps?.map(pendStep);
         this.enqueue({
             lane: EXECUTIONS,
             kind: "report",
-            bytes: sizeOf(prompt, error) + 1024,
+            bytes: sizeOf(prompt, error, ...(steps ?? []).flatMap((s) => [s.toolInput, s.toolOutput])) + 1024,
             send: async () => {
-                const body = await this.request("POST", `/scenarios/${report.scenarioId}/executions`, JSON.stringify({
+                const body = await this.request("POST", `/scenarios/${report.scenarioId}/executions`, 
+                // Per-step verdicts and the headline failure (errorshandling.md) ride
+                // beside the costs. All optional on the service side, so an older
+                // service ignores them rather than rejecting the report — and the
+                // costs still book. Errors are shown on a web page, so they are
+                // capped and redacted like any text; so is what each step sent and
+                // received, which the page shows under the verdict in place of the
+                // recording's sample (`reportBody`).
+                reportBody({
                     ticket: report.ticket,
                     outcome: report.outcome,
                     costUsd,
@@ -627,11 +699,6 @@ export class RemoteRecorder {
                     measured: report.measured,
                     pricingVersion: report.pricingVersion,
                     prompt: out(prompt),
-                    // Per-step verdicts and the headline failure (errorshandling.md). All
-                    // optional on the service side, so an older service ignores them rather
-                    // than rejecting the report — and the costs still book. Errors are
-                    // shown on a web page, so they are capped and redacted like any text.
-                    steps: report.steps?.map((s) => typeof s.error === "string" ? { ...s, error: capText(s.error, TEXT_CAPS.reportError, redactText) } : s),
                     error: out(error),
                     errorStage: report.errorStage,
                     errorStepIndex: report.errorStepIndex,
@@ -643,7 +710,7 @@ export class RemoteRecorder {
                     // Why nothing ran, when nothing ran. Additive: an older service drops
                     // the field and books the cost exactly as it always did.
                     declined: report.declined,
-                }), { retryTransient: Boolean(report.ticket) });
+                }, steps), { retryTransient: Boolean(report.ticket) });
                 const r = (body ?? {});
                 const failed = report.steps?.filter((s) => s.status === "failed").length ?? 0;
                 logLine("execution.reported", {

package/dist/record/truncate.d.ts

@@ -20,6 +20,17 @@
 export declare const DEFAULT_MAX_PAYLOAD_BYTES: number;
 /** 8 KiB per individual string leaf. */
 export declare const DEFAULT_MAX_STRING_BYTES: number;
+/**
+ * What one tool payload may take inside an execution report. A report carries
+ * every step of a replay in one small request, so a step's input or output
+ * gets far less there than the 64 KiB a recorded step has to itself.
+ *
+ * 3,800 bytes, not a round 4 KiB: the service keeps 4,000 characters of each,
+ * and a payload cut here still fits that with its marker. So the scenario's
+ * page shows this cut, which says how large the payload was, and never a
+ * second one made on top of it.
+ */
+export declare const REPORT_PAYLOAD_MAX_BYTES = 3800;
 export interface TruncateOptions {
     maxPayloadBytes?: number;
     maxStringBytes?: number;

package/dist/record/truncate.js

@@ -20,6 +20,17 @@
 export const DEFAULT_MAX_PAYLOAD_BYTES = 64 * 1024;
 /** 8 KiB per individual string leaf. */
 export const DEFAULT_MAX_STRING_BYTES = 8 * 1024;
+/**
+ * What one tool payload may take inside an execution report. A report carries
+ * every step of a replay in one small request, so a step's input or output
+ * gets far less there than the 64 KiB a recorded step has to itself.
+ *
+ * 3,800 bytes, not a round 4 KiB: the service keeps 4,000 characters of each,
+ * and a payload cut here still fits that with its marker. So the scenario's
+ * page shows this cut, which says how large the payload was, and never a
+ * second one made on top of it.
+ */
+export const REPORT_PAYLOAD_MAX_BYTES = 3_800;
 const utf8 = (s) => Buffer.byteLength(s, "utf8");
 /** The marker {@link truncateString} appends, so a second cut can report the first size. */
 const MARKER = /… \[truncated \d+ of (\d+) bytes\]$/;

package/dist/replay/builtins.d.ts

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -36,14 +39,15 @@
  * best effort and may drift from a future host's, the same caveat the
  * hook-view threading fallback already carries ("shapes may differ").
  */
+/** The built-ins {@link runBuiltin} actually implements. */
+export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
  */
 export declare const DEFAULT_BUILTIN_TOOLS: readonly string[];
-/** The built-ins {@link runBuiltin} actually implements. */
-export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 /**
  * Parse `BIR_BUILTIN_TOOLS`. Unset means {@link DEFAULT_BUILTIN_TOOLS}; set,
  * it is the whole list — `none` (or an empty value) turns built-ins off
@@ -54,10 +58,11 @@ export declare const EXECUTABLE_BUILTINS: ReadonlySet<string>;
 export declare function parseBuiltinTools(value: string | undefined): ReadonlySet<string>;
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
-export declare function parseBashAllow(value: string | undefined): readonly string[] | undefined;
+export declare function parseBashAllow(value: string | undefined): readonly string[];
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
  * mid-word must end the command's word too: `git` allows `git status` and
@@ -92,7 +97,7 @@ export interface BuiltinContext {
     cwd: string;
     /** The step's clock, the same budget an MCP dispatch would get. */
     timeoutMs?: number;
-    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). */
+    /** Parsed `BIR_BASH_ALLOW` ({@link parseBashAllow}). Absent or empty, no command runs. */
     bashAllow?: readonly string[];
     /**
      * Where this plan's *previous* `Bash` step left its shell — the host's own