@basein/runner 0.3.9 → 0.3.11

package/dist/control/server.js

@@ -33,12 +33,12 @@ import { pidAlive } from "./discovery.js";
 import { pinCompatible } from "./pin-guard.js";
 import { contextForToolUse, intentForToolUse, markTranscriptUsage, recentToolResults, settledLastAssistantText, thinkingForToolUse, usageSince, } from "./transcript.js";
 import { isHousekeepingCall } from "../record/housekeeping.js";
-import { redact } from "../record/redact.js";
-import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateStrings } from "../record/truncate.js";
+import { redact, redactText } from "../record/redact.js";
+import { DEFAULT_MAX_STRING_BYTES, serializeCapped, truncateString, truncateStrings, } from "../record/truncate.js";
 import { StepQueue } from "../record/queue.js";
 import { NullRecorder, isIntentMatcher, isMatchAware, isRecorderHealthReporter, isRunCreationAware, isScenarioReporter, } from "../record/recorder.js";
 import { ReplayController, POLL_HOLD_MS, } from "../replay/controller.js";
-import { calculateCostUsd } from "../replay/pricing.js";
+import { calculateCostUsd, hasModelPricing } from "../replay/pricing.js";
 import { logDetail, logLine, logOnce, errText } from "../util/log.js";
 import { journal } from "../util/journal.js";
 import { packageVersion } from "../util/version.js";
@@ -64,7 +64,9 @@ const PROXY_REPORT_GRACE_MS = 1_500;
  */
 const HOOK_DEADLINE_MS = {
     "/session/start": 2_000,
-    "/session/prompt": 7_000,
+    // A second past {@link PROMPT_WAIT_MS}, and a second and a half inside the
+    // 10 s Claude Code gives the hook.
+    "/session/prompt": 8_500,
     "/tool/pre": 12_000,
     "/tool/post": 2_000,
     "/session/agent": 2_000,
@@ -79,10 +81,19 @@ const PREVIEW_RESERVE_MS = 500;
 /**
  * What `UserPromptSubmit` may spend on replay: the similar-prompt match plus
  * any derivation a matched scenario with a target needs before its directive
- * can go out (segmented.md R-PARAM-4). Below the route's 7 s deadline, so the
- * decision to steer is always taken here and never by the guard.
+ * can go out (segmented.md R-PARAM-4). Below the route's 8.5 s deadline, so
+ * the decision to steer is always taken here and never by the guard.
+ *
+ * LONGER THAN THE SERVICE MAY TAKE TO READ, ON PURPOSE. The service gives a
+ * reading 6 s (its RUNNER_DERIVE_TIMEOUT_MS) and answers either way, so with
+ * the match and the round trip an answer can be 6.5 s after the prompt. At
+ * 6 s this wait ended before that answer could arrive: on 2026-10-08 a
+ * reading that took 6.0 s armed its plan 0.3 s after the prompt had been
+ * answered, and a good 20-step plan was thrown away (`arm_timeout`) for a
+ * turn the agent then spent 39 s on. The wait is only ever this long while a
+ * matched plan's values are still being read.
  */
-const PROMPT_WAIT_MS = 6_000;
+const PROMPT_WAIT_MS = 7_500;
 /**
  * How long a `PreToolUse` waits for the intent probe when that probe may arm a
  * plan in the call's place (`BIR_INTENT_ARM_BUDGET_MS`). A clear match or a
@@ -257,6 +268,137 @@ function isOn(value) {
         return true;
     return typeof value === "string" && ["1", "true"].includes(value.trim().toLowerCase());
 }
+/** The longest text a host may name itself, its version, its adapter or its scope by. */
+const HOST_TEXT_MAX = 64;
+/**
+ * The host a payload names, or undefined when it names none: a `host` whose
+ * `app` is missing, empty or not a text is ignored, and the session is a
+ * Claude Code session as before. Only the four known keys are kept. `app`,
+ * `version` and `adapter` are cut to {@link HOST_TEXT_MAX}; a scope is never
+ * cut — see {@link badScope}.
+ */
+function hostOf(payload) {
+    const h = payload.host;
+    if (!h || typeof h !== "object")
+        return undefined;
+    const app = typeof h.app === "string" ? h.app.trim().toLowerCase().slice(0, HOST_TEXT_MAX) : "";
+    if (!app)
+        return undefined;
+    const host = { app };
+    if (typeof h.version === "string" && h.version)
+        host.version = h.version.slice(0, HOST_TEXT_MAX);
+    if (typeof h.adapter === "string" && h.adapter)
+        host.adapter = h.adapter.slice(0, HOST_TEXT_MAX);
+    if (typeof h.scope === "string" && h.scope)
+        host.scope = h.scope;
+    return host;
+}
+/**
+ * Whether a payload's host names a scope the recorder cannot keep as it is:
+ * there, but empty, longer than {@link HOST_TEXT_MAX} or not a text.
+ *
+ * Such a scope is never cut and never dropped. The scope is part of what
+ * keeps one tenant's plans away from another's: cut or dropped, the run
+ * would land in another scope's pool.
+ */
+function badScope(payload) {
+    const h = payload.host;
+    if (!h || typeof h !== "object" || !hostOf(payload))
+        return false;
+    if (h.scope === undefined)
+        return false;
+    return typeof h.scope !== "string" || h.scope.length === 0 || h.scope.length > HOST_TEXT_MAX;
+}
+/** Whether `session` said its host is not Claude Code. */
+function otherHost(session) {
+    return session?.host !== undefined && session.host.app !== "claude-code";
+}
+/**
+ * The `framework` text of a run in a session of another host — its `app`, or
+ * `app:scope` when it named a scope — and undefined for Claude Code, whose
+ * runs keep the recorder's own framework. Up to 129 characters.
+ */
+function frameworkOf(session) {
+    if (!otherHost(session))
+        return undefined;
+    const host = session.host;
+    return host.scope ? `${host.app}:${host.scope}` : host.app;
+}
+/** What a host may hand over of one text: a transcript index keeps no more of a message. */
+const HOST_TEXT_CHARS = 16 * 1024;
+/** Tool names a host may declare as sinks, or as held by its agent. */
+const HOST_NAMES_MAX = 4_096;
+/** Models one run's usage may name. */
+const HOST_USAGE_MAX = 32;
+/** A payload text as the recorder takes it: a non-empty string, cut to `max` characters. */
+function hostText(value, max = HOST_TEXT_CHARS) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    return text ? text.slice(0, max) : undefined;
+}
+/** A payload's list of tool names, or undefined when it is not a list. */
+function hostNames(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const names = [];
+    for (const item of value.slice(0, HOST_NAMES_MAX)) {
+        // A name alone, or `{ name }`, which is how an agent's tools are listed.
+        const name = typeof item === "string" ? item : item?.name;
+        if (typeof name === "string" && name)
+            names.push(name.slice(0, 200));
+    }
+    return names;
+}
+/** The sinks a host declared with its prompt. Always an object: see `HostSinks`. */
+function hostSinksOf(payload) {
+    const sinks = payload.sinks;
+    if (!sinks || typeof sinks !== "object")
+        return {};
+    return { command: hostNames(sinks.command) ?? [], write: hostNames(sinks.write) ?? [] };
+}
+/**
+ * A payload's `usage`, under the names the price table takes. The host sends
+ * Claude's own names, the ones a transcript line carries, and they are mapped
+ * here as the transcript's are folded: a missing count is 0. Undefined when
+ * the payload carries no usable list — which is "no usage", never zero.
+ */
+function hostUsageOf(payload) {
+    if (!Array.isArray(payload.usage))
+        return undefined;
+    const count = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0);
+    const out = [];
+    for (const item of payload.usage.slice(0, HOST_USAGE_MAX)) {
+        if (!item || typeof item !== "object")
+            continue;
+        const u = item;
+        out.push({
+            model: typeof u.model === "string" && u.model ? u.model.slice(0, 200) : "unknown",
+            inputTokens: count(u.input_tokens),
+            outputTokens: count(u.output_tokens),
+            cacheReadTokens: count(u.cache_read_input_tokens),
+            cacheCreationTokens: count(u.cache_creation_input_tokens),
+        });
+    }
+    return out;
+}
+/**
+ * Price a turn's token usage. Measured only when tokens were used and every
+ * model that used them has a price: a model outside the table costs "$0",
+ * and a zero called measured is booked as a saving nobody made.
+ */
+function priceUsage(usage) {
+    const usd = usage.reduce((sum, u) => sum + calculateCostUsd(u.model, u), 0);
+    const unpriced = [...new Set(usage.filter((u) => !hasModelPricing(u.model)).map((u) => u.model))];
+    return { usd, measured: usage.length > 0 && unpriced.length === 0, unpriced };
+}
+/**
+ * What `/health` answers as `hostFields`: how much of another host's protocol
+ * this recorder understands. An adapter reads it to know which fields it may
+ * rely on — with 1 it records; from 2 it may also ask for a plan and step
+ * through it, because the checks a replay in another host needs are here.
+ */
+export const HOST_FIELDS = 2;
 /** One MCP call, as seen from up to two sides. */
 /**
  * Field separator for the probe's dedupe hash (segmented.md R-HIT-5). A NUL,
@@ -327,6 +469,13 @@ export class ControlServer {
      * SessionStart.
      */
     offSessions = new Map();
+    /**
+     * Sessions of another host that named a scope the recorder cannot keep as
+     * it is (see {@link badScope}) → when last heard. Nothing of such a session
+     * is recorded or replayed: every hook of it is answered `{}`. Kept apart
+     * from {@link sessions}, so it never holds a run or takes a proxy's step.
+     */
+    refusedSessions = new Map();
     /**
      * Proxy ids that registered with *this* recorder (UPG-7). A poll from any
      * other id is a proxy from before this recorder started — a 0.2.12 proxy
@@ -421,6 +570,7 @@ export class ControlServer {
                 if (!this.lossy)
                     logLine("run.lossy", { why: "step queue overflowed", dropped });
                 this.lossy = true;
+                this.markOpenRunsLossy();
             },
             onError: (err) => logLine("control.step_failed", { error: errText(err) }),
         });
@@ -472,7 +622,7 @@ export class ControlServer {
         this.heldPolls.clear();
         for (const session of this.sessions.values()) {
             if (session.run && !session.run.finished) {
-                this.closeRun(session, { detach: false, flushMs: FLUSH_MS.close });
+                this.closeRun(session, { detach: false, flushMs: FLUSH_MS.close, reason: "recorder_closed" });
             }
         }
         // Bounded: a recorder being stopped must stop, and a service that is down
@@ -567,6 +717,9 @@ export class ControlServer {
             url: this.address?.url,
             wrappedServers: [...this.wrapped],
             hooksVersion: packageVersion(),
+            // How much of another host's protocol this recorder understands: what
+            // an adapter reads before it relies on a field (see HOST_FIELDS).
+            hostFields: HOST_FIELDS,
             registeredProxies: [...this.registrations].map(([serverName, r]) => ({
                 serverName,
                 pid: r.pid,
@@ -947,6 +1100,9 @@ export class ControlServer {
                         bytes: err.bytes,
                         why: "read and discarded, answered {} — this event is not recorded",
                     });
+                    // Whose event it was went unread with the body: every run open now
+                    // may be the one that lost it.
+                    this.markOpenRunsLossy();
                     answer({});
                     return;
                 }
@@ -964,6 +1120,12 @@ export class ControlServer {
                 answer({});
                 return;
             }
+            // A session of another host that named a scope the recorder cannot
+            // keep: nothing of it is recorded or replayed.
+            if (this.hostRefused(payload)) {
+                answer({});
+                return;
+            }
             const out = await this.dispatchHook(route, payload, (fn) => {
                 late = fn;
             });
@@ -1055,8 +1217,48 @@ export class ControlServer {
         }
         this.offSessions.set(sessionId, { at: Date.now() });
         const session = this.sessions.get(sessionId);
-        if (session?.run && !session.run.finished)
-            this.closeRun(session, { detach: true });
+        if (session?.run && !session.run.finished) {
+            this.closeRun(session, { detach: true, reason: "session_off" });
+        }
+    }
+    /**
+     * Whether this hook belongs to a session of another host whose scope the
+     * recorder cannot keep as it is (see {@link badScope}), and so is answered
+     * `{}` unprocessed — every hook of it, like a session that is off. One
+     * line says so, once for the session.
+     *
+     * A session that already has a host keeps it: a later payload cannot turn
+     * a run that is being recorded into one that is not.
+     */
+    hostRefused(payload) {
+        const sessionId = typeof payload.session_id === "string" ? payload.session_id : undefined;
+        if (sessionId && this.sessions.get(sessionId)?.host)
+            return false;
+        if (badScope(payload)) {
+            if (!sessionId || !this.refusedSessions.has(sessionId)) {
+                logLine("session.host_refused", {
+                    sess: sessionId,
+                    host: hostOf(payload)?.app,
+                    why: `its scope is empty, longer than ${HOST_TEXT_MAX} characters or not a text — a scope is never cut or dropped, ` +
+                        "because the run would land in another scope's plans; nothing of this session is recorded or replayed",
+                    fix: `give the adapter a scope of 1 to ${HOST_TEXT_MAX} characters, or none`,
+                });
+            }
+            if (sessionId)
+                this.refusedSessions.set(sessionId, Date.now());
+            return true;
+        }
+        if (!sessionId || !this.refusedSessions.has(sessionId))
+            return false;
+        this.refusedSessions.set(sessionId, Date.now());
+        return true;
+    }
+    /** Flag every run open right now as having lost steps (see `RunState.lossy`). */
+    markOpenRunsLossy() {
+        for (const session of this.sessions.values()) {
+            if (session.run && !session.run.finished)
+                session.run.lossy = true;
+        }
     }
     /** Whether `sessionId` is a session started with `BIR_OFF=1`. */
     isSessionOff(sessionId) {
@@ -1223,6 +1425,11 @@ export class ControlServer {
             session.transcriptPath = payload.transcript_path;
         if (payload.cwd)
             session.cwd = payload.cwd;
+        // The first host a session names is the one it keeps. Any route may carry
+        // it: a recorder that restarted in the middle of a run learns it from the
+        // run's next hook, and so opens no Claude Code run for it.
+        if (!session.host)
+            session.host = hostOf(payload);
         return session;
     }
     /**
@@ -1287,7 +1494,7 @@ export class ControlServer {
                     idleMin: Math.round((now - session.lastSeenAt) / 60_000),
                     why: "no hook for this session in a long time — the turn was interrupted and never resumed",
                 });
-                this.closeRun(session, { detach: false });
+                this.closeRun(session, { detach: false, reason: "idle" });
             }
             if (session.run && !session.run.finished)
                 continue;
@@ -1327,6 +1534,16 @@ export class ControlServer {
             if (now - hello.at > DELIVERY_HELLO_TTL_MS || !pidAlive(pid))
                 this.scenarioHellos.delete(pid);
         }
+        for (const [sessionId, at] of this.refusedSessions) {
+            if (now - at >= t.forgetMs)
+                this.refusedSessions.delete(sessionId);
+        }
+        if (this.refusedSessions.size > OFF_SESSIONS_MAX) {
+            const oldest = [...this.refusedSessions].sort((a, b) => a[1] - b[1]);
+            for (const [sessionId] of oldest.slice(0, this.refusedSessions.size - OFF_SESSIONS_MAX)) {
+                this.refusedSessions.delete(sessionId);
+            }
+        }
     }
     /** Drop a session and everything keyed on it. Its last run was sealed and drained already. */
     forgetSession(session) {
@@ -1339,15 +1556,23 @@ export class ControlServer {
         }
         logDetail("session.forgotten", { sess: session.sessionId });
     }
-    /** Open a run for `session`, or return the open one. */
-    ensureRun(session, input = "") {
+    /**
+     * Open a run for `session`, or return the open one.
+     *
+     * `asked` is what the prompt that opens the run asked for, in a session of
+     * another host: whether its adapter wants a plan (`HookPayload.replay`).
+     */
+    ensureRun(session, input = "", asked = {}) {
         if (session.run && !session.run.finished)
             return session.run;
         // The sealed run stays reachable for a moment: a report or a post that
         // arrives just after its turn ended is that turn's, not this one's.
         if (session.run)
             session.previous = session.run;
-        const runId = this.recorder.startRun(input, this.runMetadata(session));
+        // A run of another host says so in its `framework`: the service keeps a
+        // plan inside the host, and the scope, that recorded it.
+        const framework = frameworkOf(session);
+        const runId = this.recorder.startRun(input, this.runMetadata(session), framework ? { framework } : undefined);
         const run = {
             runId,
             input,
@@ -1364,9 +1589,20 @@ export class ControlServer {
             // Taken here, beside `startedAtMs`, so the cost window and the duration
             // window are the same window (docs/calculatedReplay.md §11.4).
             usageMark: markTranscriptUsage(session.transcriptPath),
+            // Written here and not by `onPrompt` after this returns: the match
+            // watched below asks at once whether replay is on for this run
+            // (`armFromMatch`), and a flag set afterwards would come too late —
+            // every run of another host would then only record.
+            hostReplay: asked.replay === true ? true : undefined,
         };
         session.run = run;
-        logLine("run.start", { run: runId, sess: session.sessionId, tier: "bound" });
+        logLine("run.start", {
+            run: runId,
+            sess: session.sessionId,
+            tier: "bound",
+            // Named only for another host: `bir investigate` reads it from here.
+            host: otherHost(session) ? session.host?.app : undefined,
+        });
         // Journal-only: the prompt is what `bir investigate` lists a turn by. Never
         // on stderr, and never more than a preview.
         if (input)
@@ -1379,8 +1615,10 @@ export class ControlServer {
     runMetadata(session) {
         return {
             recorder: "baseinstrunner",
+            // Which runner made the recording: the service keeps it with the run.
+            runnerVersion: packageVersion(),
             tier: "bound",
-            host: this.opts.host ?? { app: "claude-code" },
+            host: session.host ?? this.opts.host ?? { app: "claude-code" },
             wrappedServers: [...this.wrapped],
             // Known-at-start value. A run that turns lossy later says so on the audit
             // log; carrying it here too would need a metadata patch the service does
@@ -1441,8 +1679,11 @@ export class ControlServer {
      * one `replay.decision` line says why (docs/calculatedReplay.md §10).
      */
     async armFromMatch(session, run, pending, prompt, startedAt) {
-        if (!this.replay.enabled)
+        // Off for the recorder, or — in a session of another host — not asked
+        // for by this run's adapter: either way nothing can be announced.
+        if (!this.replay.enabled || this.recordsOnly(session, run)) {
             return this.noteDisabledMatch(session, run, pending, prompt);
+        }
         const promptWaitMs = this.promptWaitMs();
         const matchBudget = Math.min(this.replay.budgets.matchMs, promptWaitMs);
         if (Date.now() < this.matchGate.holdUntil) {
@@ -1513,9 +1754,7 @@ export class ControlServer {
         // Awaited: a scenario with a target derives before the directive goes
         // out, so a plan that cannot find its target is never delivered
         // (segmented.md R-PARAM-4). Inside the prompt's own budget.
-        const arming = this.armOrLog(run, this.replay.arm(match, prompt || run.input, this.wrapped, "prompt", {
-            recentResults: recentToolResults(session.transcriptPath, this.deriveRecentResults),
-        }));
+        const arming = this.armOrLog(run, this.replay.arm(match, prompt || run.input, this.wrapped, "prompt", { recentResults: this.recentResultsFor(session, "prompt") }, this.hostContext(session, run)));
         const remaining = Math.max(0, promptWaitMs - (Date.now() - startedAt));
         const state = await this.withinBudget(arming, remaining);
         if (state === undefined)
@@ -1540,12 +1779,12 @@ export class ControlServer {
                 });
             }
             if (state) {
-                this.shelve(session, run, state);
+                this.shelve(session, run, state, "arm_unannounced");
             }
             else {
                 void arming.then((late) => {
                     if (late)
-                        this.shelve(session, run, late);
+                        this.shelve(session, run, late, "arm_timeout");
                 });
             }
             return undefined;
@@ -1567,7 +1806,9 @@ export class ControlServer {
             await this.replay.settleForPreview(state, settleMs);
         // The argument preview runs logic; it spends what is left of the prompt's
         // own budget, never time on top of it (under 10 ms left, none is shown).
-        const previewMs = Math.max(0, promptWaitMs - (Date.now() - startedAt));
+        // None at all for another host: its adapter reads the plan as data, and
+        // no model reads this text.
+        const previewMs = otherHost(session) ? 0 : Math.max(0, promptWaitMs - (Date.now() - startedAt));
         const directive = state.plan ? this.replay.directiveFor(state, { previewMs }) : undefined;
         if (state.plan && !directive) {
             // A plan with nothing to announce is a plan the model is never told of.
@@ -1642,7 +1883,7 @@ export class ControlServer {
         if (!match || run.finished)
             return undefined;
         // Declined at its first gate, before derivation: no transcript is read for it.
-        const state = await this.armOrLog(run, this.replay.arm(match, prompt || run.input, this.wrapped, "prompt"));
+        const state = await this.armOrLog(run, this.replay.arm(match, prompt || run.input, this.wrapped, "prompt", {}, this.hostContext(session, run)));
         if (!state || run.finished || run.replays.includes(state))
             return undefined;
         if (state.plan) {
@@ -1830,6 +2071,55 @@ export class ControlServer {
             return undefined;
         });
     }
+    /**
+     * Whether `run` only records: a run of another host whose adapter did not
+     * ask for a plan with its prompt. Treated as a run with replay off in the
+     * three places that ask (`onPrompt`, `armFromMatch`, `tryIntentMatch`).
+     *
+     * An adapter that only records never sends `replay`. Without this the
+     * recorder would start a plan for every prompt that matches one, read the
+     * model's own calls against it, and book a replay nobody ran. A run another
+     * hook opened carries no flag either, and only records.
+     */
+    recordsOnly(session, run) {
+        return otherHost(session) && run.hostReplay !== true;
+    }
+    /**
+     * What {@link ReplayController.arm} is told of `session` when its host is
+     * not Claude Code, and undefined when it is.
+     */
+    hostContext(session, run) {
+        if (!otherHost(session))
+            return undefined;
+        return {
+            app: session.host.app,
+            sinks: session.hostSinks ?? {},
+            recordsOnly: this.recordsOnly(session, run) || undefined,
+        };
+    }
+    /**
+     * The earlier tool results the reading of new values may look at: this
+     * prompt's own, from the transcript — and so none for a plan that is
+     * started at the prompt (segmented.md R-PARAM-2a).
+     *
+     * `at` is where the plan is being started, and at the prompt a transcript
+     * has nothing to give. The prompt was only just submitted, so it has no
+     * results of its own; and the transcript does not hold it yet, so what the
+     * transcript calls "this prompt's results" are still the *previous*
+     * prompt's. They used to be sent as this task's, and they answered for it:
+     * a second prompt that named one person ran on the person the first
+     * prompt's results were full of.
+     *
+     * A session of another host has no transcript, and a plan starts there at
+     * the prompt only: none either. Its adapter used to hand the conversation's
+     * earlier results over with the prompt (`recent_results`) — the same
+     * mistake, made on purpose. An adapter that still sends them is not read.
+     */
+    recentResultsFor(session, at) {
+        if (at === "prompt" || otherHost(session))
+            return [];
+        return recentToolResults(session.transcriptPath, this.deriveRecentResults);
+    }
     /**
      * The prompt hook answered without a directive: retire any prompt-armed plan
      * of `run` that could still steer. `armFromMatch` arms one live only while
@@ -1849,7 +2139,7 @@ export class ControlServer {
                 scenario: state.scenarioId ?? undefined,
                 why: "the prompt was answered without this plan's directive — retired unannounced, so never run",
             });
-            this.shelve(session, run, state);
+            this.shelve(session, run, state, "arm_unannounced");
         }
     }
     /**
@@ -1857,14 +2147,20 @@ export class ControlServer {
      * told of it, so it must never steer or diverge a call: it is kept only as
      * what it now is — a matched turn the agent does itself, which still owes the
      * ledger its baseline sample (§11.1) — exactly like a declined match.
+     *
+     * `why` is the code the report carries when the plan was only late. Without
+     * it the service got a matched turn that was not steered and no reason, and
+     * its console could only say that the runner had given none. A plan a gate
+     * declined keeps the gate's own code.
      */
-    shelve(session, run, late) {
+    shelve(session, run, late, why) {
         if (late.plan && !late.retired) {
             logDetail("replay.shelved", {
                 run: run.runId,
                 scenario: late.scenarioId ?? undefined,
                 why: "armed without its directive reaching the model — retired, never steers",
             });
+            late.declined ??= why;
         }
         late.sessionId = session.sessionId;
         late.plan = undefined;
@@ -1889,11 +2185,30 @@ export class ControlServer {
      * routinely left half-open, which is what happened in practice.
      *
      * Idempotent: the second caller sees `finished` and does nothing.
+     *
+     * `reason` says why the run is closed. It decides something only in a
+     * session of another host (see {@link CloseReason}).
      */
-    sealRun(session) {
+    sealRun(session, reason = "stop") {
         const run = session.run;
         if (!run || run.finished)
             return;
+        const other = otherHost(session);
+        // A run of another host that is closed before its turn's work ended: it
+        // failed, went quiet, or its session ended under it. A LangChain run does
+        // not always end with a stop — nothing calls an end hook when it fails.
+        const early = other && reason !== "stop";
+        // Such a run's cost says nothing of what the task costs. Nor does that of
+        // a run closed — in any way — with its plan still live. That plan is
+        // handed over first, before the report is built, so the report says what
+        // happened: `fell_back` when a step ran, `failed` when none did, and not
+        // `not_steered`, as if no plan had started.
+        let cutShort = early;
+        if (other) {
+            const live = this.livePlan(run);
+            if (live && this.replay.hostHandOver(live, "closed"))
+                cutShort = true;
+        }
         run.finished = true;
         for (const correlation of run.correlations.values()) {
             if (correlation.fallback)
@@ -1917,20 +2232,39 @@ export class ControlServer {
         // A matched turn records nothing, but it still owes the ledger a number —
         // including when it declined to steer, which is a *baseline* sample and is
         // what every saving is measured against (docs/calculatedReplay.md §11).
-        this.reportExecution(session, run, durationMs, cost);
+        this.reportExecution(session, run, durationMs, cost, cutShort);
         // A fragment is recorded from the hand-over on (fallbk.md D7), so its cost
         // and duration are the model's own work, not the steps the scenario did.
+        // Another host hands over one number for the whole run, and it is the
+        // fragment's: the plan's own steps made no model call, so all of it was
+        // spent after the hand-over.
         const fragment = run.fragment?.state === "open" ? run.fragment : undefined;
-        const recordedCost = fragment ? this.costSince(session, fragment.usageMark) : cost;
+        const recordedCost = fragment && !other ? this.costSince(session, fragment.usageMark) : cost;
         const recordedMs = fragment?.startedAtMs ? Date.now() - fragment.startedAtMs : durationMs;
         if (run.recording) {
             const transcriptPath = session.transcriptPath;
+            // The answer is the host's when it handed one over, and the
+            // transcript's otherwise — never both. A run that ended early has none:
+            // whatever text there is, it is not the answer to the prompt.
+            const answerText = early
+                ? Promise.resolve("")
+                : run.hostAnswer !== undefined
+                    ? Promise.resolve(run.hostAnswer)
+                    : settledLastAssistantText(transcriptPath).catch(() => "");
+            // What the finish of another host's run says beside its answer and its
+            // cost: why it ended early, when it did, and whether it is whole. A
+            // run with either is never calculated and stops catching its prompt.
+            const closing = other
+                ? {
+                    error: early ? (run.hostFailed ?? `turn ended early: ${reason}`) : undefined,
+                    incomplete: { lossy: run.lossy === true },
+                }
+                : undefined;
             // Resolve the answer *outside* the queue: the wait below is up to two
             // seconds, and the queue is serial — blocking it here would delay the
             // first step of the user's next turn by that much. Kept on the run, so a
             // drain of this run waits for this seal and for nobody else's.
-            run.sealing = settledLastAssistantText(transcriptPath)
-                .catch(() => "")
+            run.sealing = answerText
                 .then((answer) => {
                 run.finishQueued = true;
                 this.queue.push(() => {
@@ -1949,6 +2283,7 @@ export class ControlServer {
                     this.recorder.finishRun(run.runId, answer || undefined, {
                         durationMs: recordedMs,
                         costUsd: recordedCost.measured ? recordedCost.usd : undefined,
+                        ...closing,
                     });
                 });
             });
@@ -1961,6 +2296,9 @@ export class ControlServer {
             measured: cost.measured,
             lossy: this.lossy,
             recorded: run.recording,
+            // Only for another host, and only when the run did not end with an
+            // ordinary stop.
+            ended: early ? reason : undefined,
         });
     }
     /**
@@ -1985,6 +2323,11 @@ export class ControlServer {
      * false` and zero rather than a number that is confidently wrong.
      */
     runCost(session, run) {
+        // Another host has no transcript: its numbers are the ones it handed
+        // over with its stop, and they are looked at before any watermark — a
+        // run of such a host never has one.
+        if (otherHost(session))
+            return this.hostCost(run);
         const measurable = run.usageMark !== undefined;
         if (!measurable) {
             logLine("run.unmeasured", {
@@ -1993,21 +2336,57 @@ export class ControlServer {
             });
             return { usd: 0, measured: false };
         }
-        return this.costSince(session, run.usageMark);
+        const cost = this.costSince(session, run.usageMark);
+        if (cost.unpriced?.length) {
+            logLine("run.unmeasured", {
+                run: run.runId,
+                why: "the runner has no price for a model of this turn — update the runner",
+                models: cost.unpriced.join(","),
+            });
+        }
+        return cost;
+    }
+    /**
+     * What a run of another host cost, from the tokens its adapter handed over
+     * with the stop. Measured only when at least one entry has tokens and every
+     * model in the list has a price; with no usage at all, not measured — and
+     * one `run.unmeasured` line says which.
+     */
+    hostCost(run) {
+        const usage = run.hostUsage;
+        if (!usage || usage.length === 0) {
+            logLine("run.unmeasured", { run: run.runId, why: "the host sent no usage" });
+            return { usd: 0, measured: false };
+        }
+        const cost = priceUsage(usage);
+        const used = usage.some((u) => u.inputTokens + u.outputTokens + u.cacheReadTokens + u.cacheCreationTokens > 0);
+        if (used && cost.measured)
+            return cost;
+        logLine("run.unmeasured", {
+            run: run.runId,
+            why: cost.unpriced?.length
+                ? "the runner has no price for a model of this run"
+                : "the host's usage holds no tokens — the run made no model call",
+            models: cost.unpriced?.length ? cost.unpriced.join(",") : undefined,
+        });
+        return { ...cost, measured: false };
     }
-    /** Transcript cost since `mark`; unmeasured (and zero) without one. */
+    /** Transcript cost since `mark`; unmeasured (and zero) without one, or with a model that has no price. */
     costSince(session, mark) {
         if (mark === undefined)
             return { usd: 0, measured: false };
-        const deltas = usageSince(session.transcriptPath, mark);
-        const usd = deltas.reduce((sum, u) => sum + calculateCostUsd(u.model, u), 0);
-        return { usd, measured: deltas.length > 0 };
+        return priceUsage(usageSince(session.transcriptPath, mark));
     }
-    reportExecution(session, run, durationMs, cost) {
+    reportExecution(session, run, durationMs, cost, 
+    /** The run was closed before its task ended for the caller (another host only). */
+    cutShort = false) {
         if (!isScenarioReporter(this.recorder))
             return;
         const states = run.replays.length > 0 ? run.replays : run.replay ? [run.replay] : [];
         const recorder = this.recorder;
+        // Another host hands over one number for the whole run. It cannot be
+        // split between two plans, so with more than one neither is measured.
+        const unsplit = otherHost(session) && states.length > 1;
         // One report per plan armed this turn (fallbk.md §Runner 4). Each is billed
         // for its own window of the transcript — from when it armed to when the next
         // one did — so the turn's tokens are split between them, never counted twice.
@@ -2039,11 +2418,12 @@ export class ControlServer {
                 sessionCostUsd: windowCost.usd,
                 // A direct run the user cancelled cut its turn short: its cost is no
                 // baseline, and no saving is measured against it.
-                measured: windowCost.measured && !this.cancelledPlans.has(state),
+                measured: windowCost.measured && !this.cancelledPlans.has(state) && !unsplit,
                 durationMs: Math.max(0, windowMs),
                 prompt: run.input || undefined,
                 siblings: states,
                 runId: run.runId,
+                cutShort: cutShort || undefined,
             });
             if (!report)
                 return;
@@ -2076,7 +2456,7 @@ export class ControlServer {
         const run = session.run;
         if (!run)
             return;
-        this.sealRun(session);
+        this.sealRun(session, opts.reason);
         if (opts.detach && session.run === run) {
             session.run = undefined;
             session.previous = run;
@@ -2145,7 +2525,7 @@ export class ControlServer {
             // → Stop is the only honest run boundary. The previous turn was
             // interrupted — Stop does not fire on Esc — so it is sealed here, and its
             // drain runs behind this prompt rather than in front of it.
-            this.closeRun(session, { detach: true });
+            this.closeRun(session, { detach: true, reason: "interrupted" });
         }
         else if (open && open.ordering.next === 0) {
             // A run was opened early by a proxy step (the host spawned MCP servers
@@ -2184,16 +2564,24 @@ export class ControlServer {
             });
             return {};
         }
-        const run = this.ensureRun(session, input);
+        const other = otherHost(session);
+        if (other) {
+            // What a host hands over with its prompt, kept before the run opens:
+            // the match watched from there may start a plan at once, and the places
+            // that do have no prompt payload in reach.
+            session.hostSinks = hostSinksOf(payload);
+        }
+        const run = this.ensureRun(session, input, { replay: other && payload.replay === true });
         run.promptSeen = true;
         run.input = input;
         session.prompts += 1;
         logDetail("session.prompt", { sess: session.sessionId, run: run.runId, chars: input.length });
         // With replay off there is nothing this hook could say, so it says nothing
         // at once: the match still stops recording on a hit (v1), in the
-        // background, and no prompt waits on the service for it.
+        // background, and no prompt waits on the service for it. The same for a
+        // run of another host whose adapter asked for no plan.
         const watch = this.watchForMatch(session, run, input);
-        if (!this.replay.enabled)
+        if (!this.replay.enabled || this.recordsOnly(session, run))
             return {};
         // Plan mode is the user asking to see a plan before anything runs. A
         // replay would run tools, auto-approved: nothing is announced, and a plan
@@ -2225,12 +2613,18 @@ export class ControlServer {
             this.retireUnannounced(session, run);
             return {};
         }
-        return {
+        const answer = {
             hookSpecificOutput: {
                 hookEventName: "UserPromptSubmit",
                 additionalContext: directive,
             },
         };
+        // Another host steps through the plan itself, so it is told the plan as
+        // data too: the directive is a text written for a model. At the top
+        // level, where `noPlan` and `declined` are — `forEvent` can drop
+        // `hookSpecificOutput` as a whole. A Claude Code session gets no new key.
+        const plan = other && run.replay ? this.replay.planData(run.replay) : undefined;
+        return plan ? { ...answer, plan } : answer;
     }
     /**
      * `PreToolUse`. Two shapes of answer:
@@ -2250,6 +2644,10 @@ export class ControlServer {
      */
     async onToolPre(payload, onLate) {
         const session = this.ensureSession(payload);
+        // A session of another host has a route of its own: its tools are the
+        // host's, and everything below reads a tool's name as Claude Code's.
+        if (otherHost(session))
+            return this.onHostToolPre(session, payload, onLate);
         const run = this.ensureRun(session);
         const toolName = payload.tool_name ?? "unknown";
         const toolUseId = payload.tool_use_id ?? "";
@@ -2605,6 +3003,238 @@ export class ControlServer {
         }
         return { stepIndex: pair.selected };
     }
+    /**
+     * `/tool/pre` in a session whose host is not Claude Code — a LangChain
+     * application, say (the service's integratioLangChane.md). Two kinds of
+     * request, told apart by `scripted`:
+     *
+     *  - **The adapter asks for the plan's next step** (`scripted: true`). It
+     *    is answering in the model's place and wants the step's arguments; the
+     *    host then runs its own tool with them. See {@link onScriptedPre}.
+     *  - **The model's own call.** Recorded, never pinned. See {@link onOwnPre}.
+     *
+     * ONLY A PROMPT OPENS A RUN for such a host. A hook that finds none open
+     * opens none and answers `{}`: the run failed and its adapter closed it,
+     * or the two-hour limit sealed it, or the recorder restarted under it. What
+     * arrives afterwards — the application going on from its checkpoint, a
+     * retry middleware trying the call again — must not become a second
+     * recording with an empty prompt.
+     */
+    async onHostToolPre(session, payload, onLate) {
+        const scripted = payload.scripted === true;
+        const toolName = hostText(payload.tool_name, 200) ?? "unknown";
+        const toolUseId = typeof payload.tool_use_id === "string" ? payload.tool_use_id : "";
+        const run = session.run && !session.run.finished ? session.run : undefined;
+        if (!run) {
+            logDetail("tool.pre.skipped", {
+                sess: session.sessionId,
+                tool: toolName,
+                why: "no open run — only a prompt opens one for this host",
+            });
+            // A request for a step is told so in words: an empty answer is also
+            // what a recorder that is slow, or switched off, gives.
+            return scripted ? { noPlan: true } : {};
+        }
+        // The runner's own `bir` server is housekeeping in every host.
+        if (isHousekeepingCall(toolName, payload.tool_input, true)) {
+            if (toolUseId)
+                (run.housekeepingUses ??= new Set()).add(toolUseId);
+            logDetail("tool.pre.skipped", { run: run.runId, tool: toolName, why: "host housekeeping" });
+            return {};
+        }
+        return scripted
+            ? this.onScriptedPre(run, toolName, toolUseId, payload, onLate)
+            : this.onOwnPre(session, run, toolName, toolUseId, payload);
+    }
+    /**
+     * The adapter of another host asks for the plan's next step. The answer
+     * either pins the call — `allow`, with the step's computed arguments — or
+     * carries no pin, which ends the plan for the adapter. It then says why:
+     *
+     *  - `noPlan`: the recorder holds no live plan for the run. It ran to its
+     *    end, was handed over, or the recorder restarted while the run waited
+     *    for a person. Nothing is recorded: no call follows this request.
+     *  - `declined`: the plan names a tool the agent does not hold.
+     *  - a refusal whose reason is the hand-over note, when the plan stopped
+     *    in this very request.
+     */
+    async onScriptedPre(run, toolName, toolUseId, payload, onLate) {
+        const live = this.livePlan(run);
+        if (!live)
+            return { noPlan: true };
+        // A call cannot be pinned without an id to join its result by.
+        if (!toolUseId)
+            return {};
+        // THE TOOLS THE AGENT HOLDS ride on the first request for a step: a host
+        // shows them only when its model is about to be called, never at the
+        // prompt. The recorder judges them, not the adapter — one that ended the
+        // plan by itself would leave a live plan here that nobody steps through.
+        const missing = this.missingHostTool(live, payload);
+        if (missing !== undefined &&
+            this.replay.declineArmed(live, "host_tool_missing", `the plan calls ${missing}, a tool the agent that asked does not hold — it cannot be finished there, so no step of it is started`)) {
+            return { declined: "host_tool_missing" };
+        }
+        let overran = false;
+        const answeredLate = new AbortController();
+        onLate?.(() => {
+            overran = true;
+            answeredLate.abort();
+            return {};
+        });
+        const action = await this.replay.preTool(live, toolName, toolUseId, {}, { signal: answeredLate.signal });
+        if (overran) {
+            // The deadline guard answered `{}` — no pin — and the adapter took the
+            // plan as ended. A pin decided now never reached it: the plan ends here
+            // too, and what it would have said waits for the model's next result.
+            live.pinned.delete(toolUseId);
+            if (action.kind === "deny")
+                run.handback = action.reason;
+            else
+                this.replay.hostHandOver(live, "late");
+            this.noteHandover(run);
+            return {};
+        }
+        // A hand-over inside `preTool` must still schedule the fragment.
+        this.noteHandover(run);
+        if (action.kind === "deny") {
+            return {
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "deny",
+                    permissionDecisionReason: action.reason,
+                },
+            };
+        }
+        // `passthrough`, `abort`: the plan ended while this request waited.
+        if (action.kind !== "pin")
+            return { noPlan: true };
+        // Recorded as any step the hook alone observes — in a recording, which a
+        // matched run is not — tagged with the plan that pinned it. The same id
+        // asked for twice is one step.
+        const known = run.builtIns.get(toolUseId);
+        const pair = known
+            ? { selected: known.stepIndex, response: known.responseIndex }
+            : run.ordering.allocatePair();
+        const pinnedBy = live.scenarioId ?? undefined;
+        if (!known) {
+            run.builtIns.set(toolUseId, { stepIndex: pair.selected, responseIndex: pair.response, toolName });
+            if (run.recording) {
+                const toolInput = serializeCapped(redact(action.input));
+                this.queue.push(() => {
+                    this.recorder.recordToolSelected(run.runId, pair.selected, {
+                        toolName,
+                        toolInput,
+                        metadata: pinnedBy ? { pinnedBy } : undefined,
+                    });
+                });
+            }
+        }
+        logDetail("tool.pre", { run: run.runId, tool: toolName, step: pair.selected, pinnedBy });
+        return {
+            stepIndex: pair.selected,
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "allow",
+                updatedInput: action.input,
+            },
+        };
+    }
+    /**
+     * The first tool the plan will call that the agent does not hold, or
+     * undefined when it holds them all — or did not say which it holds.
+     */
+    missingHostTool(state, payload) {
+        const held = hostNames(payload.tools);
+        const plan = held ? this.replay.planData(state) : undefined;
+        if (!held || !plan)
+            return undefined;
+        const names = new Set(held);
+        return plan.steps.find((step) => !names.has(step.toolName))?.toolName;
+    }
+    /**
+     * The model's own call, in a session of another host: any `/tool/pre`
+     * without `scripted`.
+     *
+     * NEVER PINNED, and never answered with a bundle. In Claude Code a call to
+     * the plan's next tool is pinned, because there the model is the one who
+     * makes the plan's calls. Here the adapter makes them, so a call the model
+     * made is the model's whatever tool it names: answered with the plan's
+     * arguments, the tool would run with arguments the model never wrote, and
+     * the model would read a result that does not belong to the call it sees.
+     *
+     * A plan that is still live is handed over. The call runs as the model
+     * wrote it — the note is not given in its place — and the note goes out
+     * with this call's `/tool/post`. The recording of the model's own work
+     * after the hand-over (the fragment) opens with this very call: opened one
+     * call later, the call that left the plan would be in no recording.
+     */
+    async onOwnPre(session, run, toolName, toolUseId, payload) {
+        const modelArgs = payload.tool_input ?? {};
+        // A tool that pauses itself passes its hook again when the run resumes:
+        // the same call announced twice is one step, not two.
+        const announced = toolUseId ? run.builtIns.get(toolUseId) : undefined;
+        if (announced) {
+            logDetail("tool.pre.repeated", { run: run.runId, tool: toolName, step: announced.stepIndex });
+            return { stepIndex: announced.stepIndex };
+        }
+        const live = this.livePlan(run);
+        if (live && this.replay.hostHandOver(live, "own_call")) {
+            logLine("replay.own_call", {
+                run: run.runId,
+                scenario: live.scenarioId ?? undefined,
+                tool: toolName,
+                why: "the model made a call of its own while the plan was live — the plan is handed over, and the call runs as written",
+            });
+        }
+        this.noteHandover(run);
+        const words = this.hostWords(payload);
+        // Counted, never waited on, and never arming: see `tryIntentMatch`.
+        await this.tryIntentMatch(session, run, toolName, words.intent, modelArgs);
+        if (run.fragment?.state === "due" && !run.pendingDirective) {
+            await this.openFragment(session, run, words.context, toolName, modelArgs);
+        }
+        // The hook is the only observer of every call of such a host: nothing of
+        // it goes through a proxy of this folder, whatever a tool is named.
+        const pair = run.ordering.allocatePair();
+        run.builtIns.set(toolUseId || `anon_${pair.selected}`, {
+            stepIndex: pair.selected,
+            responseIndex: pair.response,
+            toolName,
+        });
+        if (run.recording) {
+            const toolInput = serializeCapped(redact(modelArgs));
+            this.queue.push(() => {
+                this.recorder.recordToolSelected(run.runId, pair.selected, {
+                    toolName,
+                    toolInput,
+                    context: words.context || undefined,
+                    intent: words.thinking,
+                });
+            });
+        }
+        logDetail("tool.pre", { run: run.runId, tool: toolName, step: pair.selected });
+        return { stepIndex: pair.selected };
+    }
+    /**
+     * What the model wrote and reasoned before a call, as its host handed it
+     * over with the call — the values {@link intentForToolUse} and
+     * {@link thinkingForToolUse} read from a transcript, under the same switch:
+     * a source `BIR_INTENT_SOURCES` turned off is not taken from the payload
+     * either. `context` is the written text only; thinking rides apart.
+     */
+    hostWords(payload) {
+        const written = this.intentSources.has("text") ? hostText(payload.context) : undefined;
+        const reasoned = this.intentSources.has("thinking") ? hostText(payload.thinking) : undefined;
+        return {
+            intent: written
+                ? { text: written, source: "text" }
+                : reasoned
+                    ? { text: reasoned, source: "thinking" }
+                    : undefined,
+            context: written ?? "",
+            thinking: reasoned ? { text: reasoned, source: "thinking" } : undefined,
+        };
+    }
     /** This run's plan, when it is armed, still live, and announced to the model. */
     livePlan(run) {
         const state = run.replay;
@@ -2915,6 +3545,10 @@ export class ControlServer {
         const opts = this.replay.intentMatch;
         if (!this.replay.enabled || !opts.enabled)
             return undefined;
+        // A run of another host that only records is a run with replay off: no
+        // probe is sent, so it adds nothing to the step counts either.
+        if (this.recordsOnly(session, run))
+            return undefined;
         if (!isIntentMatcher(this.recorder))
             return undefined;
         if (this.replay.isDirectTool(toolName))
@@ -2953,6 +3587,7 @@ export class ControlServer {
             .map((s) => s.scenarioId)
             .filter((id) => typeof id === "string");
         const startedAt = Date.now();
+        const framework = frameworkOf(session);
         const probe = this.recorder
             .matchIntent({
             text,
@@ -2969,13 +3604,19 @@ export class ControlServer {
             ranThrough: this.ranThroughFor(run),
             ...(this.replay.segmentArm ? { acceptSegments: true } : {}),
             supportsCalls: true,
+            // Left out for Claude Code: a missing framework means Claude Code to
+            // the service, which matches a step only inside its own host.
+            ...(framework ? { framework } : {}),
         }, 
         // The probe's own budget (`BIR_INTENT_MATCH_BUDGET_MS`) ends the request
         // itself — waited on or not — so an abandoned probe releases its socket
         // rather than holding it for as long as the service takes to answer.
         { timeoutMs: opts.budgetMs })
             .catch(() => null);
-        if (!this.intentArming()) {
+        // In a session of another host a probe only counts: a plan is started
+        // there by the prompt, and stepped through by an adapter that was told of
+        // it then. Nothing could announce one that armed in the middle of a run.
+        if (!this.intentArming() || otherHost(session)) {
             // Counted, never waited on: whatever the answer says is bookkeeping.
             void probe.then((late) => {
                 if (late)
@@ -3017,10 +3658,7 @@ export class ControlServer {
         // seconds, and this call is waiting. A plan not armed in time is dropped
         // unused — it was never announced, so it never steers — and its ticket is
         // swept like any unredeemed one (R-OUT-12).
-        const arming = this.armOrLog(run, this.replay.arm(match, text, this.wrapped, "intent", {
-            liveCall: { toolName, toolInput },
-            recentResults: recentToolResults(session.transcriptPath, this.deriveRecentResults),
-        }));
+        const arming = this.armOrLog(run, this.replay.arm(match, text, this.wrapped, "intent", { liveCall: { toolName, toolInput }, recentResults: this.recentResultsFor(session, "call") }, this.hostContext(session, run)));
         const state = await this.withinBudget(arming, INTENT_ARM_DERIVE_MS);
         if (state === undefined)
             return undefined; // it threw, and said so
@@ -3233,7 +3871,9 @@ export class ControlServer {
             return;
         const input = reasoning.trim() || `${toolName} ${serializeCapped(redact(args))}`.slice(0, 2_000);
         const fallbackOf = { scenarioId: f.scenarioId, stepIndex: f.stepIndex };
-        const id = this.recorder.startRun(input, { ...this.runMetadata(session), fallbackOf }, { fallbackOf });
+        // The fragment is a run of the same host as the turn it continues.
+        const framework = frameworkOf(session);
+        const id = this.recorder.startRun(input, { ...this.runMetadata(session), fallbackOf }, framework ? { fallbackOf, framework } : { fallbackOf });
         for (const c of run.correlations.values()) {
             c.settled = true;
             if (c.fallback)
@@ -3362,6 +4002,17 @@ export class ControlServer {
         const session = this.ensureSession(payload);
         const toolUseId = payload.tool_use_id ?? "";
         const toolName = payload.tool_name ?? "unknown";
+        const other = otherHost(session);
+        // Only a prompt opens a run for another host (see `onHostToolPre`): a
+        // result that finds none open is a closed run's, and is not recorded.
+        if (other && !(session.run && !session.run.finished)) {
+            logDetail("tool.post.skipped", {
+                sess: session.sessionId,
+                tool: toolName,
+                why: "no open run — only a prompt opens one for this host",
+            });
+            return {};
+        }
         if (toolName.startsWith(`mcp__${SCENARIO_SERVER_KEY}__`))
             this.birToolSeen = true;
         // Every completion, pinned or not, before anything below can return: it
@@ -3412,7 +4063,7 @@ export class ControlServer {
         const skippedAtPre = toolUseId !== "" && run.housekeepingUses?.delete(toolUseId) === true;
         if (skippedAtPre)
             return {};
-        if (!run.builtIns.has(toolUseId) && isHousekeepingCall(toolName, payload.tool_input))
+        if (!run.builtIns.has(toolUseId) && isHousekeepingCall(toolName, payload.tool_input, other))
             return {};
         // Nor for an unarmed `run_scenario`. The plan may have retired since the
         // pre hook, so the test is whether that hook opened a step, not the plan.
@@ -3427,12 +4078,29 @@ export class ControlServer {
         // recorded, and only fall back to the hook's view if no report arrives.
         const replay = run.replay;
         const pinnedHere = replay && this.replay.isPinned(replay, toolUseId);
+        // The result of a call the adapter of another host made for the plan,
+        // which the recorder does not hold as pinned: the plan is gone — the run
+        // was sealed and opened again, or the recorder restarted. Nothing of it
+        // is recorded: it was never the model's call.
+        if (other && payload.scripted === true && !pinnedHere) {
+            logDetail("tool.post.skipped", { run: run.runId, tool: toolName, why: "a scripted call this recorder did not pin" });
+            return {};
+        }
         const correlation = [...run.correlations.values()].find((c) => c.toolUseId && c.toolUseId === toolUseId);
         if (pinnedHere && replay) {
+            // What another host says it did to the step itself, read before any
+            // failure: a person's "no" arrives as an error result, and is no fault
+            // of the plan (controller.ts, `PostToolOptions.hostStop`).
+            const hostStop = other && (payload.host_stop === "rejected" || payload.host_stop === "edited")
+                ? payload.host_stop
+                : undefined;
             // The host's verdict, which outranks anything read from the output: a
             // step that failed must never thread as if it worked (controller.ts).
-            const hostFailure = failed ? this.errorText(payload) : undefined;
-            if (correlation && this.replay.threadsFromProxy(replay, toolUseId)) {
+            const hostFailure = failed && !hostStop ? this.errorText(payload) : undefined;
+            if (hostStop) {
+                this.replay.postTool(replay, toolUseId, serializeCapped(payload.tool_response ?? {}), undefined, { hostStop });
+            }
+            else if (correlation && this.replay.threadsFromProxy(replay, toolUseId)) {
                 correlation.threadToolUseId = toolUseId;
                 correlation.threadFallback = setTimeout(() => {
                     if (!this.replay.isPinned(replay, toolUseId))
@@ -3554,9 +4222,48 @@ export class ControlServer {
         // arriving. A later prompt in the same session opens a fresh run, exactly as
         // it did before. The drain that follows is background work: it is what
         // lets the recorder forget the run once the service has it.
-        this.closeRun(session, { detach: false });
+        //
+        // Another host hands the run's answer and its tokens over here — it has
+        // no transcript to read them from — and says when the run failed or its
+        // recording is not whole.
+        const reason = otherHost(session) ? this.noteHostStop(run, payload) : "stop";
+        this.closeRun(session, { detach: false, reason });
         return {};
     }
+    /**
+     * Keep what another host handed over with its stop — on the run, not on the
+     * session: a later prompt of the session opens a new run, which must not
+     * inherit an answer or a cost. Returns why the run is closed.
+     *
+     *  - `final_answer`, `usage`: the answer and the tokens (see `sealRun`,
+     *    `hostCost`).
+     *  - `incomplete`: the recording is not the whole run — the adapter lost
+     *    calls, a person changed one, or one was answered in its tool's place.
+     *    The run is flagged lossy, so its finish carries the service's mark; the
+     *    mark has no place for a text, which goes to the log only.
+     *  - `failed`: the run failed. It is closed with that text as its error
+     *    and no final answer. An exception's text can hold a password or a
+     *    user's data: it is cleaned and cut like every text that is sent.
+     */
+    noteHostStop(run, payload) {
+        run.hostAnswer = typeof payload.final_answer === "string" && payload.final_answer ? payload.final_answer : undefined;
+        run.hostUsage = hostUsageOf(payload);
+        const incomplete = hostText(payload.incomplete, 500);
+        if (incomplete !== undefined) {
+            run.lossy = true;
+            logLine("run.incomplete", {
+                run: run.runId,
+                why: redactText(incomplete),
+                effect: "its recording is marked incomplete: never calculated, and it no longer catches its prompt",
+            });
+        }
+        if (payload.failed === undefined || payload.failed === null || payload.failed === false)
+            return "stop";
+        const failed = hostText(payload.failed, 2_000);
+        run.hostFailed = failed ? redactText(failed) : "the host said the run failed";
+        logLine("run.host_failed", { run: run.runId, error: run.hostFailed });
+        return "host_failed";
+    }
     /**
      * `SessionEnd` — `/clear`, exit, logout. Answered at once: the host is
      * waiting on it to exit, and this process outlives the session, so the run
@@ -3570,7 +4277,7 @@ export class ControlServer {
             if (sessionId === session.sessionId)
                 this.proxySessions.delete(proxyId);
         }
-        this.closeRun(session, { detach: false, flushMs: FLUSH_MS.sessionEnd });
+        this.closeRun(session, { detach: false, flushMs: FLUSH_MS.sessionEnd, reason: "session_end" });
         // Forgotten a little later by the reaper, not now: a late report or post
         // for its last turn must still find that turn rather than open a new one.
         session.endedAt = Date.now();
@@ -4062,7 +4769,10 @@ export class ControlServer {
         const known = bound ? this.sessions.get(bound) : undefined;
         if (known)
             return known;
-        const recent = this.recentSessions();
+        // Never a session of another host: none of its calls goes through a
+        // proxy, and a proxy's step must not open a run there — only its own
+        // prompt does (see `onHostToolPre`).
+        const recent = this.recentSessions().filter((s) => !otherHost(s));
         const active = recent.find((s) => this.isActive(s));
         if (active)
             return active;