@basein/runner 0.3.7 → 0.3.9

package/dist/replay/builtins.js

@@ -10,18 +10,21 @@
  *
  * THE RULES, because this bypasses the host's permission prompts entirely:
  *
- *   - **Default deny beyond read-only.** Which built-ins may run at all is
- *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
- *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
- *     explicit, per-environment opt-in — a recorded `rm` must never run
- *     because a prompt looked similar.
+ *   - **All six by default, each a switch.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}); unset, it is every one
+ *     this module implements (up to 0.3.7 it was the read-only set,
+ *     `Read,Glob,Grep`). The permission story is the one a steered step
+ *     already has — its pinned call is answered `allow` too. What running it
+ *     here changes is that no model sees the call before it runs, so an
+ *     operator who wants one in the loop takes the tool off the list.
  *   - **Path jail.** Every path is resolved against, and confined to, the
  *     session's project directory ({@link jailed}), symlinks included. The
  *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
  *     project (§5.1 of the change plan).
- *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
- *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
- *     never executes here, even when allow-listed.
+ *   - **Bash runs any command unless `BIR_BASH_ALLOW` narrows it.** Set, a
+ *     command must match one of its prefixes ({@link bashAllowed}); `none`
+ *     allows no command, and then `Bash` counts as off the list, so its steps
+ *     are steered in the session (controller.ts).
  *   - **Same failure contract as an MCP step.** A step that *cannot* run here
  *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
  *     it, or a recorded output may stand in under
@@ -42,12 +45,6 @@ import { existsSync } from "node:fs";
 import { readdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 // ── configuration ────────────────────────────────────────────────────────────
-/**
- * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
- * unset: the read-only set. Reading a file the session itself would read
- * without a prompt is the risk floor; anything that writes or runs is not.
- */
-export const DEFAULT_BUILTIN_TOOLS = ["Read", "Glob", "Grep"];
 /** The built-ins {@link runBuiltin} actually implements. */
 export const EXECUTABLE_BUILTINS = new Set([
     "Read",
@@ -57,6 +54,13 @@ export const EXECUTABLE_BUILTINS = new Set([
     "Write",
     "Bash",
 ]);
+/**
+ * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
+ * unset: every one it implements, so a chain of built-ins arms `direct` just
+ * as a chain of wrapped MCP calls does. Up to 0.3.7 this was the read-only
+ * set (`Read,Glob,Grep`).
+ */
+export const DEFAULT_BUILTIN_TOOLS = [...EXECUTABLE_BUILTINS];
 /** `read` → `Read`: the vocabulary is small enough to forgive casing. */
 const CANONICAL_BUILTIN = new Map([...EXECUTABLE_BUILTINS].map((name) => [name.toLowerCase(), name]));
 /**
@@ -78,15 +82,17 @@ export function parseBuiltinTools(value) {
 }
 /**
  * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
- * everything. Undefined (unset or blank) means `Bash` never executes on the
- * runner — the flag is the opt-in, exactly like the tool list itself.
+ * everything. Unset means everything, because `Bash` is on the default list.
+ * Set, it is the whole list, as `BIR_BUILTIN_TOOLS` is: `none` (or an empty
+ * value) allows no command.
  */
 export function parseBashAllow(value) {
-    const prefixes = (value ?? "")
+    if (value === undefined)
+        return ["*"];
+    return value
         .split(",")
         .map((s) => s.trim())
-        .filter(Boolean);
-    return prefixes.length > 0 ? prefixes : undefined;
+        .filter((s) => s.length > 0 && !["none", "off", "0"].includes(s.toLowerCase()));
 }
 /**
  * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
@@ -485,13 +491,24 @@ async function runBash(input, ctx) {
     if (typeof command !== "string" || command.trim() === "") {
         throw new BuiltinNotRunnable("command is required");
     }
-    if (!ctx.bashAllow) {
-        throw new BuiltinNotRunnable("BIR_BASH_ALLOW is not set, so bir runs no Bash command unattended");
+    if (!ctx.bashAllow?.length) {
+        throw new BuiltinNotRunnable("BIR_BASH_ALLOW allows no command, so bir runs no Bash command unattended");
     }
     if (!bashAllowed(command, ctx.bashAllow)) {
         throw new BuiltinNotRunnable("the command does not match BIR_BASH_ALLOW, so bir does not run it unattended");
     }
+    // What the host would run differently stays the session's, never started
+    // here: a command it leaves in the background (there is no shell here to
+    // leave it in, so it would be stopped with the step), and one that asks for
+    // more time than this step has. Cut off part-way, an `npm i -g` or a
+    // migration can leave things half done, which is worse than a hand-over.
+    if (input.run_in_background === true) {
+        throw new BuiltinNotRunnable("the command runs in the background, which only the session can do");
+    }
     const timeoutMs = ctx.timeoutMs ?? 120_000;
+    if (typeof input.timeout === "number" && input.timeout > timeoutMs) {
+        throw new BuiltinNotRunnable(`the command asks for up to ${Math.ceil(input.timeout / 1000)} s and this step has ${Math.floor(timeoutMs / 1000)} s, so the session runs it`);
+    }
     // The host's Bash semantics, which the recorded chain was written against:
     // the working directory carries over from the plan's previous Bash step,
     // variables and functions do not (a fresh `-l` shell each call).

package/dist/replay/controller.d.ts

@@ -191,17 +191,17 @@ export interface ReplayOptions {
      * `BIR_BUILTIN_TOOLS` — the built-ins the runner may execute itself, from
      * the session's own project directory (replay/builtins.ts), or stand in
      * for with a recorded output under `BIR_REPLAY_RECORDED_OUTPUTS=1`.
-     * Omitted, the environment decides; the default is the read-only set
-     * (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` run only when listed
-     * explicitly — and `Bash` additionally only for commands matching
-     * {@link ReplayOptions.bashAllow}.
+     * Omitted, the environment decides; the default is all six (`Read`,
+     * `Glob`, `Grep`, `Edit`, `Write`, `Bash`), and `Bash` runs only the
+     * commands {@link ReplayOptions.bashAllow} allows.
      */
     builtinTools?: ReadonlySet<string>;
     /**
      * `BIR_BASH_ALLOW` — command prefixes a runner-side `Bash` step may run
-     * (`*` for all). Undefined means `Bash` never executes here, even when
-     * allow-listed: runner-side execution bypasses the host's permission
-     * prompts, so the shell needs its own explicit opt-in.
+     * (`*` for all). Omitted, the environment decides; the default is `*`.
+     * Empty allows no command, and then `Bash` counts as off
+     * {@link ReplayOptions.builtinTools}: its steps are steered in the session,
+     * rather than armed `direct` and stopped at the first one.
      */
     bashAllow?: readonly string[];
     budgets?: Partial<ReplayBudgets>;
@@ -273,6 +273,12 @@ interface PinnedCall {
     toolName: string;
     /** When it was pinned — a steered step's duration is measured across hooks. */
     pinnedAt: number;
+    /**
+     * The arguments the pin gave the call, for the step's verdict: the plan
+     * never sees a steered call, so this is the only place they are known when
+     * its result lands.
+     */
+    input?: Record<string, unknown>;
     /**
      * When the host said the call finished (`PostToolUse`), if the control
      * server told us ({@link ReplayController.hostCompleted}). A wrapped step
@@ -475,7 +481,7 @@ export declare class ReplayController {
     /** See {@link ReplayOptions.builtinTools}. */
     private readonly builtinTools;
     /** See {@link ReplayOptions.bashAllow}. */
-    private readonly bashAllow?;
+    private readonly bashAllow;
     /** Calls waiting for a plan's pins to change (see `awaitPins`). */
     private readonly pinWaiters;
     /**
@@ -854,7 +860,14 @@ export declare class ReplayController {
      * never be told something the log does not also say.
      */
     private observeStep;
-    /** Upsert one step's verdict. Later news about a step replaces earlier news. */
+    /**
+     * Upsert one step's verdict. Later news about a step replaces earlier news.
+     *
+     * The verdict keeps what the step sent and what came back, when the caller
+     * has them. They are this run's, which the service can learn nowhere else:
+     * a matched turn is not recorded, so without them the scenario's page shows
+     * the recording's input and output beside this run's verdict.
+     */
     private recordStep;
     /** The step verdicts, in chain order, for the execution report. */
     private stepResultsOf;

package/dist/replay/controller.js

@@ -13,8 +13,8 @@
  */
 import { parseQualifiedName } from "../control/correlation.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
-import { redact } from "../record/redact.js";
-import { serializeCapped } from "../record/truncate.js";
+import { REDACT_SCAN_MAX_CHARS, redact, redactJsonText, redactText } from "../record/redact.js";
+import { capText, REPORT_PAYLOAD_MAX_BYTES, serializeCapped } from "../record/truncate.js";
 import { logDetail, logLine, errText } from "../util/log.js";
 import { serviceHealth, serviceTimeoutMs, timeoutSignal, } from "../util/service-health.js";
 import { bashCommandFor } from "./bash-channel.js";
@@ -250,8 +250,14 @@ export class ReplayController {
         this.intentMatch = { ...DEFAULT_INTENT_MATCH, ...(opts.intentMatch ?? {}) };
         this.recordedFallback =
             opts.recordedFallback ?? process.env.BIR_REPLAY_RECORDED_OUTPUTS === "1";
-        this.builtinTools = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
         this.bashAllow = opts.bashAllow ?? parseBashAllow(process.env.BIR_BASH_ALLOW);
+        const builtins = opts.builtinTools ?? parseBuiltinTools(process.env.BIR_BUILTIN_TOOLS);
+        // A `Bash` that may run no command is not reachable here. Left on the
+        // list, a chain of Bash steps would arm `direct` and stop at its first.
+        this.builtinTools =
+            this.bashAllow.length > 0 || !builtins.has("Bash")
+                ? builtins
+                : new Set([...builtins].filter((name) => name !== "Bash"));
     }
     /**
      * Whether a handed-out segment may actually arm (segmented.md R-OUT-10).
@@ -773,7 +779,13 @@ export class ReplayController {
             // The model does the task itself — told so in place of this call.
             const step = plan.currentStep();
             if (step && ready.blame) {
-                this.recordStep(state, { step, outcome: "failed", stage: ready.stage, error: ready.error });
+                this.recordStep(state, {
+                    step,
+                    entry: plan.currentEntry(),
+                    outcome: "failed",
+                    stage: ready.stage,
+                    error: ready.error,
+                });
             }
             this.handOver(state, {
                 kind: "step_failed",
@@ -823,6 +835,7 @@ export class ReplayController {
                     reach: this.reachFor(state, step),
                     toolName,
                     pinnedAt: Date.now(),
+                    input,
                 });
                 logDetail("replay.pin", { n: plan.currentStepIndex, tool: toolName });
                 return { kind: "pin", input, stepIndex: plan.currentStepIndex };
@@ -844,6 +857,7 @@ export class ReplayController {
                 if (step) {
                     this.recordStep(state, {
                         step,
+                        entry: plan.currentEntry(),
                         outcome: "failed",
                         stage: "tool_input_logic",
                         error: errText(err),
@@ -1037,6 +1051,10 @@ export class ReplayController {
         // reading it after the call would judge the *next* step, and reading it
         // before assumes no other pin ever moved it.
         const step = plan.allSteps()[pin.stepIndex];
+        // The entry it ran as, so its verdict is kept under the scenario that owns
+        // the step: a called segment numbers its steps from zero too, and without
+        // this its step 0 replaced the caller's (segmented.md R-CALL-13).
+        const entry = plan.allEntries()[pin.stepIndex];
         // The output threads into the step at the cursor. One pin at a time
         // (`preTool`) keeps that the pin's own step; if it ever is not, threading
         // would feed one step's output to another's logic, so the plan stops.
@@ -1051,6 +1069,9 @@ export class ReplayController {
                 `the plan's cursor is at step ${plan.currentStepIndex}, not the pinned step ${pin.stepIndex}`;
             const info = {
                 step,
+                entry,
+                input: pin.input,
+                output: answerOf(output),
                 outcome: "failed",
                 stage: "tool_call",
                 error,
@@ -1062,7 +1083,7 @@ export class ReplayController {
             this.handOver(state, {
                 kind: "step_failed",
                 step,
-                entry: plan.allEntries()[pin.stepIndex],
+                entry,
                 position: pin.stepIndex,
                 error,
                 delivery: "above",
@@ -1084,6 +1105,10 @@ export class ReplayController {
             if (step) {
                 this.recordStep(state, {
                     step,
+                    entry,
+                    input: pin.input,
+                    // What the logic threw on — the output is usually the explanation.
+                    output,
                     outcome: "failed",
                     stage: "tool_output_logic",
                     error: errText(err),
@@ -1119,6 +1144,9 @@ export class ReplayController {
         if (step && toolError) {
             const info = {
                 step,
+                entry,
+                input: pin.input,
+                output,
                 outcome: "failed",
                 stage: "tool_call",
                 error: toolError,
@@ -1140,6 +1168,9 @@ export class ReplayController {
         if (step) {
             this.recordStep(state, {
                 step,
+                entry,
+                input: pin.input,
+                output,
                 outcome: "executed",
                 ms: Date.now() - pin.pinnedAt,
             });
@@ -1204,13 +1235,23 @@ export class ReplayController {
                 ? `${failure.error} — it was sent, and may or may not have completed`
                 : failure.error
             : toolResultError(output);
+        const entry = plan.allEntries()[pin.stepIndex];
         if (error !== undefined) {
-            const info = { step, outcome: "failed", stage: "tool_call", error, ms };
+            const info = {
+                step,
+                entry,
+                input: pin.input,
+                output: answerOf(output),
+                outcome: "failed",
+                stage: "tool_call",
+                error,
+                ms,
+            };
             this.logStep(info);
             this.recordStep(state, info);
             return;
         }
-        this.recordStep(state, { step, outcome: "executed", ms });
+        this.recordStep(state, { step, entry, input: pin.input, output, outcome: "executed", ms });
         state.stepsPinned += 1;
         this.upgrade(state, "fell_back");
         logDetail("replay.thread_late", {
@@ -2067,10 +2108,10 @@ export class ReplayController {
                 // An allow-listed built-in runs *here*, against the session's own
                 // project directory (replay/builtins.ts). Everything else about it —
                 // no session cwd (`bir replay`, an older server), off the list, no
-                // runner-side implementation, a path that leaves the project, `Bash`
-                // without `BIR_BASH_ALLOW` — stays the old contract: `not_run`, so
-                // the session can do the step itself or its recorded output can
-                // stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
+                // runner-side implementation, a path that leaves the project, a `Bash`
+                // command `BIR_BASH_ALLOW` does not allow — stays the old contract:
+                // `not_run`, so the session can do the step itself or its recorded
+                // output can stand in (`BIR_REPLAY_RECORDED_OUTPUTS=1`).
                 if (this.builtinTools.has(name) && state.sessionCwd) {
                     return this.executeBuiltin(name, input, state, opts.deadline);
                 }
@@ -2302,7 +2343,14 @@ export class ReplayController {
             this.recordStep(state, info);
         };
     }
-    /** Upsert one step's verdict. Later news about a step replaces earlier news. */
+    /**
+     * Upsert one step's verdict. Later news about a step replaces earlier news.
+     *
+     * The verdict keeps what the step sent and what came back, when the caller
+     * has them. They are this run's, which the service can learn nowhere else:
+     * a matched turn is not recorded, so without them the scenario's page shows
+     * the recording's input and output beside this run's verdict.
+     */
     recordStep(state, info) {
         const status = info.outcome === "executed" ? "ok" : info.outcome;
         // Keyed by the *flat* position, not by the step's own index: two scenarios
@@ -2319,6 +2367,16 @@ export class ReplayController {
                 ? `${info.error.slice(0, MAX_STEP_ERROR_CHARS)}…`
                 : info.error
             : undefined;
+        // Payloads only for a step of the reported scenario's own chain. The
+        // console still files an execution's verdicts by step number alone
+        // (plan-services.md W1.9), and a called segment numbers its steps from
+        // zero as well: a called step's call would be shown under the caller's
+        // step of the same number — the very mix-up the payloads are there to end.
+        const own = !info.entry || info.entry.depth === 0;
+        // A step whose input logic threw never had an input: the `{}` the plan
+        // reports there is a placeholder, not a call with no arguments.
+        const sent = own && info.stage !== "tool_input_logic" ? info.input : undefined;
+        const received = own ? info.output : undefined;
         state.stepResults.set(key, {
             stepIndex: info.step.stepIndex,
             toolName: info.step.toolName ?? "",
@@ -2328,6 +2386,8 @@ export class ReplayController {
             stage: info.stage ?? (status === "skipped" ? "tool_call" : undefined),
             error,
             durationMs: info.ms,
+            toolInput: sent === undefined ? undefined : reportPayload(serializeCapped(redact(sent)), true),
+            toolOutput: received === undefined ? undefined : reportPayload(received),
             // The tool is gone from its server: the service repairs the plan without
             // waiting out the grace (plan-services.md D8, kind 2).
             toolMissing: info.toolMissing || undefined,
@@ -2501,6 +2561,37 @@ function pinFailure(pin, output, failed, how) {
                 : "the tool reported an error");
     return { error, reason };
 }
+/**
+ * What a call that did not thread answered with, if it answered anything.
+ * `null` is a proxy that lost the call (tool-error.ts, `isNoResult`), and `{}`
+ * is how a hook that carried no `tool_response` reaches here: neither is an
+ * output anybody received.
+ */
+function answerOf(output) {
+    return isNoResult(output) || output.trim() === "{}" ? undefined : output;
+}
+/**
+ * A step's input or output as its verdict carries it: redacted as a recorded
+ * step's is, and cut — visibly — to what a report has room for.
+ *
+ * Cut as text rather than kept as JSON: these are read on the scenario's page,
+ * never parsed, and the first kilobytes of the payload itself read better than
+ * a preview of it inside a second layer of escapes.
+ *
+ * `clean` says it was redacted a moment ago — the input, serialized by the
+ * caller. An output may not have been: the hook's view of a steered built-in
+ * is threaded as the host gave it. So an output is redacted here, and as JSON,
+ * where a secret is judged by its key as well as by its shape.
+ */
+function reportPayload(json, clean = false) {
+    if (clean)
+        return capText(json, REPORT_PAYLOAD_MAX_BYTES);
+    // Larger than any producer here makes: only what a report keeps is scanned.
+    if (json.length > REDACT_SCAN_MAX_CHARS) {
+        return capText(json, REPORT_PAYLOAD_MAX_BYTES, redactText);
+    }
+    return capText(redactJsonText(json), REPORT_PAYLOAD_MAX_BYTES);
+}
 /**
  * The index a hand-over reports, in the *caller's* chain (R-CALL-32).
  *

package/dist/replay/coverage.d.ts

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/dist/replay/coverage.js

@@ -8,14 +8,15 @@
  * only happen inside the live session.
  *
  * `live` covers three genuinely different cases and treats them identically,
- * correctly: a built-in (`Bash`, `Read`, `Edit`, …) outside the built-in
- * allow-list, an MCP server the user chose not to wrap, and `claude-in-chrome`
- * — which is `scope: "dynamic"`, appears in no config file, and therefore can
- * never be wrapped at all.
+ * correctly: a built-in outside the built-in allow-list (`WebFetch`, `Task`,
+ * or one the operator took off it), an MCP server the user chose not to wrap,
+ * and `claude-in-chrome` — which is `scope: "dynamic"`, appears in no config
+ * file, and therefore can never be wrapped at all.
  *
- * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, default `Read,Glob,
- * Grep`) is `direct`: the runner executes it itself (replay/builtins.ts), or —
- * under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves its recorded output. The
+ * A built-in *on* the allow-list (`BIR_BUILTIN_TOOLS`, by default all six the
+ * runner implements) is `direct`: the runner executes it itself
+ * (replay/builtins.ts), or — under `BIR_REPLAY_RECORDED_OUTPUTS=1` — serves
+ * its recorded output. The
  * callers that ask a *different* question, "will a proxy report this call"
  * (`ReplayController.reachFor`), deliberately pass no allow-list: a built-in
  * is never proxied, whoever executes it.

package/dist/replay/plan.d.ts

@@ -105,6 +105,12 @@ export interface StepInfo {
      */
     entry?: FlatEntry;
     input: Record<string, unknown>;
+    /**
+     * What the step's output logic was given: the tool's answer, or for
+     * `recorded` the source run's output that stood in for it. Absent when the
+     * call produced none — `skipped`, or a failure before the tool ran.
+     */
+    output?: string;
     outcome: "executed" | "recorded" | "skipped" | "failed";
     /** Which part of the step broke. Only set for `failed`. */
     stage?: ExecutionStage;

package/dist/replay/plan.js

@@ -215,8 +215,11 @@ function settingsOf(paramsObject, mapped) {
  * still abandons the whole bundle rather than shipping a half-computed one. All
  * this adds is that the failure is now *attributable* — "step 2's tool input
  * logic", rather than a stack trace the console cannot line up against a chain.
+ *
+ * `output` is what the body was given, for a stage that runs on one: a throw
+ * in the output logic is only readable next to the output it threw on.
  */
-function reportingStage(onStep, entry, stage, input, startedAt, fn) {
+function reportingStage(onStep, entry, stage, input, startedAt, fn, output) {
     try {
         return fn();
     }
@@ -225,6 +228,7 @@ function reportingStage(onStep, entry, stage, input, startedAt, fn) {
             step: entry.step,
             entry,
             input,
+            output,
             outcome: "failed",
             stage,
             error: err instanceof Error ? err.message : String(err),
@@ -817,6 +821,7 @@ export class ScenarioReplayPlan {
                         step,
                         entry,
                         input: computed,
+                        output: response,
                         outcome: "failed",
                         stage: "tool_call",
                         error: toolError,
@@ -845,7 +850,7 @@ export class ScenarioReplayPlan {
                         Object.assign(resp.get(entry.frame.id) ?? {}, derived);
                     }
                     this.leaveFrame(entry, resp);
-                });
+                }, response);
             }
             catch (err) {
                 if (!stopOnFailure)
@@ -872,6 +877,7 @@ export class ScenarioReplayPlan {
                     step,
                     entry,
                     input: computed,
+                    output: response,
                     outcome: error ? "failed" : "executed",
                     stage: error ? "tool_call" : undefined,
                     error,
@@ -977,6 +983,7 @@ export class ScenarioReplayPlan {
                         step,
                         entry,
                         input: computed,
+                        output: response,
                         outcome: "failed",
                         stage: "tool_call",
                         error: toolError,
@@ -997,7 +1004,7 @@ export class ScenarioReplayPlan {
             }
             let derivedKeys;
             try {
-                derivedKeys = reportingStage(onStep, entry, "tool_output_logic", computed, startedAt, () => this.applyOutput(response));
+                derivedKeys = reportingStage(onStep, entry, "tool_output_logic", computed, startedAt, () => this.applyOutput(response), response);
             }
             catch (err) {
                 if (!stopOnFailure)
@@ -1024,6 +1031,7 @@ export class ScenarioReplayPlan {
                     step,
                     entry,
                     input: computed,
+                    output: response,
                     outcome: error ? "failed" : "executed",
                     stage: error ? "tool_call" : undefined,
                     error,
@@ -1095,6 +1103,8 @@ export class ScenarioReplayPlan {
                 step,
                 entry,
                 input: computed,
+                // The stand-in is what the step's output logic runs on from here.
+                output: standIn,
                 outcome: standIn !== undefined ? "recorded" : "skipped",
                 error,
                 toolMissing: isMissingToolError(error) || undefined,

package/dist/replay/types.d.ts

@@ -249,6 +249,22 @@ export interface ExecutionStepResult {
     /** Message only — never a tool payload; this is rendered in a web page. */
     error?: string;
     durationMs?: number;
+    /**
+     * What the step sent its tool on this run: the arguments its input logic
+     * computed, serialized and redacted as a recorded step's are, and cut to
+     * what a report carries. Absent when the step broke before it had any.
+     *
+     * Without the two payloads the scenario's page can only put the recording's
+     * sample under this run's verdict and time — a call that was not made, and
+     * an answer that was not given, on a card that says "passed".
+     */
+    toolInput?: string;
+    /**
+     * What the step's output logic was given, on the same terms: the tool's
+     * answer, or for `recorded` the source run's output that stood in for it.
+     * Absent on a step that got none.
+     */
+    toolOutput?: string;
     /**
      * The step's tool no longer exists on its server, read from the error text
      * (plan-services.md D8, kind 2). The service then repairs the plan without