@basein/runner 0.3.9 → 0.3.11

package/dist/replay/controller.js

@@ -62,7 +62,7 @@ export const DEFAULT_BUDGETS = {
     deriveMs: 8_000,
     planMs: 100_000,
     stepMs: 60_000,
-    hookDeriveMs: 4_000,
+    hookDeriveMs: 8_000,
     preToolMs: 9_000,
 };
 /**
@@ -311,15 +311,21 @@ export class ReplayController {
      * Always returns a state — a declined match still has a ticket to redeem and a
      * baseline sample to contribute, and losing that is how a savings ledger ends
      * up with a denominator nobody measured.
+     *
+     * `host` is given for a session whose host is not Claude Code, and is kept
+     * on the state (see {@link HostContext}).
      */
-    async arm(match, prompt, wrapped, armedBy = "prompt", ctx = {}) {
+    async arm(match, prompt, wrapped, armedBy = "prompt", ctx = {}, host) {
         const state = {
             scenarioId: match.scenarioId,
             ticket: match.executionTicket,
             similarity: match.similarity,
             matchedRunId: match.runId,
             mode: "none",
-            wrapped,
+            // No proxy of this folder sees another host's calls, whatever a tool is
+            // named: every output is threaded from the host's own report.
+            wrapped: host ? new Set() : wrapped,
+            host,
             pinned: new Map(),
             outcome: "not_steered",
             deriveCostUsd: 0,
@@ -364,6 +370,18 @@ export class ReplayController {
         // Gate 2 — replay enabled.
         if (!this.enabled)
             return decline("BIR_REPLAY=0", "replay_disabled");
+        // And asked for. An adapter that only records never asks for a plan, and
+        // one started for it anyway would have nobody to step through it — while
+        // every call its model made itself would be read against the plan.
+        if (host?.recordsOnly) {
+            return decline(`the ${host.app} adapter of this run only records — it asked for no plan with its prompt`, "host_records_only");
+        }
+        // The service matched the prompt and handed over nothing, because this
+        // runner is older than its plans need (its RUNNER_MIN_CONTRACT). Its own
+        // code, ahead of "no scenario": the fix is an update, not a calculation.
+        if (match.withheld === "runner_update_required") {
+            return decline("the service hands this runner no plan until it is updated — run `bir update`", "runner_update_required");
+        }
         // Gate 3 — a ready scenario with steps.
         const scenario = match.scenario;
         if (!match.scenarioId || !isReadyScenario(scenario)) {
@@ -428,7 +446,13 @@ export class ReplayController {
         // built-in on `BIR_BUILTIN_TOOLS` counts as reachable: the runner
         // executes it itself (replay/builtins.ts), so a chain that starts with a
         // `Read` no longer forces steer mode.
-        const mode = modeFor(planned.map((e) => e.step), wrapped, this.opts.allowServers, this.builtinTools);
+        //
+        // Another host's plan is always `steer`, every step `live`: its tools are
+        // in its own process, and a tool it happens to call `Read` or
+        // `mcp__fleet__list` is not the runner's to run or a proxy's to reach.
+        const allowServers = host ? undefined : this.opts.allowServers;
+        const builtinTools = host ? undefined : this.builtinTools;
+        const mode = modeFor(planned.map((e) => e.step), state.wrapped, allowServers, builtinTools);
         if (mode === "none")
             return decline("no step is executable", "coverage");
         // Tool results feed derivation as context, and they are whatever the agent
@@ -441,11 +465,11 @@ export class ReplayController {
         // target only a result names declines more often — one replay, never a
         // command nobody asked for.
         let deriveCtx = ctx;
-        if (ctx.recentResults?.length && sinkOfPlan(planned) === "command") {
+        if (ctx.recentResults?.length && sinkOfPlan(planned, host?.sinks) === "command") {
             deriveCtx = { liveCall: ctx.liveCall };
             logLine("replay.derive_context", {
                 scenario: scenario.id,
-                shell: hasShellStep(planned) || undefined,
+                shell: hasShellStep(planned, host?.sinks) || undefined,
                 why: "a step's input is run by a shell or a database (or its tool is named for one, such as *_query) — " +
                     "recent tool results are not read for its parameters, so a target only they name is not found",
             });
@@ -527,7 +551,7 @@ export class ReplayController {
             // same check still runs where the values settle later (`readyFor`).
             // It travels as `missing_target`: the value read for a target could not
             // be used, and no new code reaches a service that may not know it.
-            const sink = sinkOfPlan(planned);
+            const sink = sinkOfPlan(planned, host?.sinks);
             if (result?.derived && sink) {
                 const bad = unsafeParameter(result.params, scenario.paramsObject, sink);
                 if (bad) {
@@ -590,6 +614,7 @@ export class ReplayController {
             run: match.runId,
             scenario: scenario.id,
             mode,
+            host: host?.app,
             steps: entries.length,
             stopsAt: stopAt,
             by: armedBy === "intent" ? "intent" : undefined,
@@ -602,11 +627,99 @@ export class ReplayController {
             unusable: flat.stopReason?.reason,
             // Which steps the service told this plan to stop in front of, and why.
             stops: stopLines(entries),
-            coverage: coverageOf(entries.map((e) => e.step), wrapped, this.opts.allowServers, this.builtinTools).join(","),
+            coverage: coverageOf(entries.map((e) => e.step), state.wrapped, allowServers, builtinTools).join(","),
             tools: entries.map((e) => e.step.toolName ?? "").join(","),
         });
         return state;
     }
+    /**
+     * The armed plan as data: the steps it will run, in order, and where it
+     * stops when that is before its end. For a host that steps through the plan
+     * itself and must not have to pick the tool names out of a directive
+     * written for a model — a reworded sentence would break every adapter in
+     * the field. Built from the same entries the directive lists.
+     */
+    planData(state) {
+        const plan = state.plan;
+        if (!plan || state.retired)
+            return undefined;
+        const steps = plan
+            .allEntries()
+            .slice(0, plan.stepCount)
+            .map((entry, stepIndex) => ({ stepIndex, toolName: entry.step.toolName ?? "" }));
+        return {
+            scenarioId: state.scenarioId,
+            mode: state.mode,
+            steps,
+            ...(plan.stopsEarly() ? { stopAt: plan.stepCount } : {}),
+        };
+    }
+    /**
+     * Take back a plan that armed and has run nothing, as a decline.
+     *
+     * For what `arm` could not know: which tools the agent of another host
+     * holds. Such a host shows its tools only when its model is about to be
+     * called, with the first request for a step, and a plan that names a tool
+     * the agent lacks cannot be finished there. It ends before any step runs,
+     * booked like any gate's decline: `not_steered` under `code`, no step
+     * marked failed or missing — either would count against a plan that is
+     * not at fault. Returns false, changing nothing, once a step has run.
+     */
+    declineArmed(state, code, why) {
+        if (!state.plan || state.retired)
+            return false;
+        if (state.stepsPinned > 0 || state.pinned.size > 0 || state.stepResults.size > 0)
+            return false;
+        state.declined = code;
+        logLine("replay.decision", {
+            verdict: "no-steer",
+            code,
+            run: state.matchedRunId,
+            scenario: state.scenarioId ?? undefined,
+            similarity: state.similarity.toFixed(3),
+            kind: state.kind,
+            why,
+        });
+        state.plan = undefined;
+        state.mode = "none";
+        state.stepsPlanned = 0;
+        this.retire(state, undefined);
+        return true;
+    }
+    /**
+     * Hand a live plan over for something its host did, not the plan: the
+     * model made a call of its own while the plan was live (`own_call`), the
+     * run was closed with the plan still live (`closed`), or the host was
+     * answered without a step's arguments because they were not ready in time
+     * (`late`).
+     *
+     * Only for a host that is not Claude Code, where a call the plan did not
+     * hand out is by definition the model's own — it is never pinned and never
+     * answered with a bundle. No step is marked failed, so nothing is counted
+     * against the plan; the outcome is `fell_back` when a step ran and `failed`
+     * when none did, as for every hand-over. The note is the caller's to
+     * deliver ({@link takeNote}). Returns false when there was no live plan.
+     */
+    hostHandOver(state, why) {
+        const plan = state.plan;
+        if (!plan || state.retired)
+            return false;
+        const position = plan.currentStepIndex;
+        this.handOver(state, {
+            kind: "step_failed",
+            step: plan.currentStep(),
+            entry: plan.currentEntry(),
+            position,
+            error: why === "own_call"
+                ? "the model made a call of its own, so the scenario stopped"
+                : why === "late"
+                    ? "its arguments were not ready in time"
+                    : "the run ended before this step",
+            delivery: "above",
+            stopReason: "not_run",
+        });
+        return true;
+    }
     /**
      * The directive to inject via `additionalContext`, or undefined when declined.
      *
@@ -650,6 +763,10 @@ export class ReplayController {
         const plan = state.plan;
         if (!plan || state.retired || state.mode !== "steer")
             return false;
+        // Another host reads the plan as data and is handed each step's arguments
+        // when it asks for them: there is no preview to wait for.
+        if (state.host)
+            return false;
         if (plan.parametersSettled)
             return true;
         const planned = plan.allEntries().slice(0, plan.stepCount);
@@ -695,9 +812,13 @@ export class ReplayController {
      * Deliver text to the model in place of the tool call it was about to make:
      * as genuine command output for `Bash`, as the denial reason otherwise — the
      * two channels a divergence bundle already uses.
+     *
+     * `otherHost` is a session whose host is not Claude Code: a tool it calls
+     * `Bash` is its own, and its command is never rewritten. The text is always
+     * the refusal reason there.
      */
-    deliverInstead(text, toolName) {
-        if (toolName === "Bash") {
+    deliverInstead(text, toolName, otherHost = false) {
+        if (toolName === "Bash" && !otherHost) {
             // A short command, whatever the text's size (bash-channel.ts): a long
             // heredoc is cut by the shell, and a long output by the host.
             const command = bashCommandFor(truncate(text, BASH_CHANNEL_MAX));
@@ -750,7 +871,8 @@ export class ReplayController {
         // `bir scenario show` the model runs while a Bash step is expected must
         // run as `bir`, never be swapped for the plan's command (D13). And before
         // the wait for the parameters, which a `ToolSearch` has no use for.
-        if (isHousekeepingCall(toolName, toolInput)) {
+        const otherHost = state.host !== undefined;
+        if (isHousekeepingCall(toolName, toolInput, otherHost)) {
             logDetail("replay.housekeeping", {
                 tool: toolName,
                 step: `${plan.currentStepIndex}/${plan.stepCount}`,
@@ -797,7 +919,7 @@ export class ReplayController {
                 stopReason: "not_run",
             });
             const note = this.takeNote(state);
-            return note ? this.deliverInstead(note, toolName) : { kind: "abort" };
+            return note ? this.deliverInstead(note, toolName, otherHost) : { kind: "abort" };
         }
         // ONE CALL AT A TIME. A pin moves the cursor only when its output threads,
         // which for a wrapped step is the proxy's report — landing either side of
@@ -871,11 +993,29 @@ export class ReplayController {
                     });
                     const note = this.takeNote(state);
                     if (note)
-                        return this.deliverInstead(note, toolName);
+                        return this.deliverInstead(note, toolName, otherHost);
                 }
                 return { kind: "abort" };
             }
         }
+        if (state.host) {
+            // Another host steps through the plan by asking for each step in turn,
+            // so a request for anything but the next step is its adapter out of
+            // step with the plan. Nothing can be recovered by running the rest
+            // here — only the host can run its tools — so the plan stops, and the
+            // model is told which steps ran. No step is marked failed.
+            this.handOver(state, {
+                kind: "step_failed",
+                step: plan.currentStep(),
+                entry: plan.currentEntry(),
+                position: plan.currentStepIndex,
+                error: `the scenario's next step is ${expected ?? "none"}, and the host asked for ${toolName}`,
+                delivery: "above",
+                stopReason: "not_run",
+            });
+            const note = this.takeNote(state);
+            return note ? this.deliverInstead(note, toolName, true) : { kind: "abort" };
+        }
         return await this.diverge(state, toolName, `expected ${expected ?? "no more tools"}, model called ${toolName}`, deadline, hook.signal);
     }
     /**
@@ -927,7 +1067,9 @@ export class ReplayController {
         if (inFlight.size > 0)
             state.lingering = inFlight;
         const note = this.takeNote(state);
-        return note ? this.deliverInstead(note, toolName) : { kind: "passthrough" };
+        return note
+            ? this.deliverInstead(note, toolName, state.host !== undefined)
+            : { kind: "passthrough" };
     }
     /**
      * Wait until the plan's outstanding pins thread, or until waiting is no
@@ -1055,6 +1197,24 @@ export class ReplayController {
         // the step: a called segment numbers its steps from zero too, and without
         // this its step 0 replaced the caller's (segmented.md R-CALL-13).
         const entry = plan.allEntries()[pin.stepIndex];
+        // THE HOST STOPPED THE STEP, and says so. Read before any failure: a
+        // person's "no" arrives as an error result, and booked as one it would be
+        // counted against a plan that did nothing wrong — after enough of them the
+        // service stops serving the step. Nothing threads either way: after
+        // `rejected` the tool never ran, and after `edited` its result answers a
+        // call the plan did not plan, which its later steps were not computed for.
+        if (how.hostStop && step) {
+            this.hostStopped(state, pin, step, entry, output, how.hostStop);
+            this.handOver(state, {
+                kind: "step_failed",
+                step,
+                entry,
+                position: pin.stepIndex,
+                delivery: "above",
+                stopReason: how.hostStop === "edited" ? "host_edited" : "host_rejected",
+            });
+            return false;
+        }
         // The output threads into the step at the cursor. One pin at a time
         // (`preTool`) keeps that the pin's own step; if it ever is not, threading
         // would feed one step's output to another's logic, so the plan stops.
@@ -1226,6 +1386,11 @@ export class ReplayController {
         const step = plan.allSteps()[pin.stepIndex];
         if (!step)
             return;
+        if (how.hostStop) {
+            // The host stopped it: neither a failure nor work the plan did.
+            this.hostStopped(state, pin, step, plan.allEntries()[pin.stepIndex], output, how.hostStop);
+            return;
+        }
         const ms = Date.now() - pin.pinnedAt;
         // Read the same way as a live pin's (`pinFailure`). A call that was sent
         // and not seen through says so in its verdict: it may have done its work.
@@ -1260,6 +1425,39 @@ export class ReplayController {
             why: "a step pinned before the hand-over finished — counted, not threaded",
         });
     }
+    /**
+     * Record a step its host stopped ({@link PostToolOptions.hostStop}) as
+     * `skipped`, in plain words, and remember the stop for the report. Never
+     * `failed`: the service counts failures against the plan. And not counted
+     * in `stepsPinned`: the plan's own call did not run.
+     */
+    hostStopped(state, pin, step, entry, output, stop) {
+        const edited = stop === "edited";
+        // After `rejected` nothing later can change what the report may claim.
+        if (state.hostStop !== "rejected")
+            state.hostStop = stop;
+        logLine("replay.step_host_stopped", {
+            scenario: state.scenarioId ?? undefined,
+            n: step.stepIndex,
+            tool: step.toolName ?? undefined,
+            stop,
+            why: edited
+                ? "a person changed this call before it ran — it ran with their arguments, and the plan stops there"
+                : "the host did not run this step — a person said no or answered in its place, or a limit blocked it",
+        });
+        this.recordStep(state, {
+            step,
+            entry,
+            // The plan's own arguments are what a refused call was asked with; a
+            // changed call ran with other ones, which only the host knows.
+            input: edited ? undefined : pin.input,
+            output: answerOf(output),
+            outcome: "skipped",
+            stage: "tool_call",
+            error: edited ? "a person changed this call" : "the host did not run this step",
+            ms: Date.now() - pin.pinnedAt,
+        });
+    }
     /** Whether a pinned call's output is threaded from the proxy's report (§7.2). */
     threadsFromProxy(state, toolUseId) {
         const pin = state.pinned.get(toolUseId) ?? state.lingering?.get(toolUseId);
@@ -1529,8 +1727,14 @@ export class ReplayController {
             stepsPlanned: state.stepsPlanned,
             stepsPinned: state.stepsPinned,
             // A run its caller cancelled ended the turn early: its cost is no
-            // measurement of the task, whatever the transcript says.
-            measured: d.measured && state.callerCancelled !== true,
+            // measurement of the task, whatever the transcript says. So is one a
+            // person said no in: the model is told not to run that step, the task
+            // ends short of itself, and a verified saving booked against it would
+            // be the cost of the work nobody did.
+            measured: d.measured &&
+                state.callerCancelled !== true &&
+                state.hostStop !== "rejected" &&
+                d.cutShort !== true,
             pricingVersion: PRICING_VERSION,
             prompt: d.prompt,
             steps,
@@ -1559,7 +1763,14 @@ export class ReplayController {
             // wrong before — a declined prompt scenario followed by an intent-armed
             // plan, whose "baseline" was really the turn cut short at the second arm.
             // A lone plan, armed or declined, sends nothing: the default is eligible.
-            baselineEligible: d.siblings?.some((s) => s !== state && s.plan !== undefined)
+            //
+            // Nor is a turn its host stopped a step of, or one that was cut short.
+            // After a person's "no" the task ended early; after a changed call that
+            // was the plan's first step, the turn made one model call fewer than
+            // the task needs — the one the plan's call replaced.
+            baselineEligible: d.siblings?.some((s) => s !== state && s.plan !== undefined) ||
+                state.hostStop !== undefined ||
+                d.cutShort === true
                 ? false
                 : undefined,
         };
@@ -1915,7 +2126,7 @@ export class ReplayController {
             // done its work, and the model must know before it does the task itself.
             if (stop?.reason === "uncertain" && stop.flatIndex !== undefined) {
                 const note = this.stopNote(state, plan, stop, "none");
-                return this.deliverInstead(note, toolName);
+                return this.deliverInstead(note, toolName, state.host !== undefined);
             }
             return { kind: "abort" };
         }
@@ -1949,7 +2160,7 @@ export class ReplayController {
         // Bash-clean delivery: the model reaches for `Bash` when it cannot call a
         // scripted tool, and a genuine command output is trusted where a `deny`
         // reason is read as adversarial interception.
-        const action = this.deliverInstead(text, toolName);
+        const action = this.deliverInstead(text, toolName, state.host !== undefined);
         logDetail("replay.inject", { channel: action.kind, bytes: text.length });
         return action;
     }
@@ -2033,9 +2244,11 @@ export class ReplayController {
                             ? "a second call arrived while the pinned step was still running — the agent continues from here"
                             : h.stopReason === "budget" || h.stopReason === "cancelled"
                                 ? "the run was cut short before this step — the agent continues from here"
-                                : h.stopReason === "not_run" || h.stopReason === "uncertain"
-                                    ? "a step produced no result here — the agent continues from here"
-                                    : "a step broke — the agent continues from here",
+                                : h.stopReason === "host_rejected" || h.stopReason === "host_edited"
+                                    ? "the host stopped this step itself — no fault of the plan; the agent continues from here"
+                                    : h.stopReason === "not_run" || h.stopReason === "uncertain"
+                                        ? "a step produced no result here — the agent continues from here"
+                                        : "a step broke — the agent continues from here",
         });
     }
     /**
@@ -2052,6 +2265,9 @@ export class ReplayController {
     noteFor(state, h) {
         const plan = state.plan;
         const executed = h.ran ?? (h.ranThisStep ? h.position + 1 : h.position);
+        // A step its host stopped was dealt with there — refused, answered, or
+        // run with a person's arguments — so it is not among what is left to do.
+        const handled = h.ranThisStep === true || h.stopReason === "host_rejected" || h.stopReason === "host_edited";
         let params;
         try {
             params = plan?.parameters;
@@ -2082,7 +2298,7 @@ export class ReplayController {
             inFlight: h.inFlight,
             ranThisStep: h.ranThisStep,
             totalSteps: plan?.totalSteps ?? state.stepsPlanned,
-            remainingTools: plan ? plan.toolsFrom(h.ranThisStep ? h.position + 1 : h.position) : [],
+            remainingTools: plan ? plan.toolsFrom(handled ? h.position + 1 : h.position) : [],
             params,
             delivery: h.delivery,
         });
@@ -2103,6 +2319,12 @@ export class ReplayController {
     executeStep(state, opts = {}) {
         return async (step, input) => {
             const name = step.toolName ?? "";
+            // Another host's tools are in its own process, whatever they are
+            // named: one it calls `Bash` or `mcp__fleet__list` is not the runner's
+            // built-in or a proxy's upstream. Nothing of such a plan runs here.
+            if (state.host) {
+                throw new StepRunError(`${name || "this step"} runs in the host's own process`, "not_run");
+            }
             const mcp = parseQualifiedName(name);
             if (!mcp) {
                 // An allow-listed built-in runs *here*, against the session's own
@@ -2254,7 +2476,9 @@ export class ReplayController {
                 }
             }
         }
-        const sink = opts.adHoc ? undefined : sinkOfPlan(plan.allEntries().slice(0, plan.stepCount));
+        const sink = opts.adHoc
+            ? undefined
+            : sinkOfPlan(plan.allEntries().slice(0, plan.stepCount), state.host?.sinks);
         if (sink) {
             const bad = unsafeParameter(plan.derivedValues, plan.paramsSchema, sink);
             if (bad) {

package/dist/replay/derive.js

@@ -32,6 +32,7 @@
  */
 import { redactText } from "../record/redact.js";
 import { isUnhealthyStatus, serviceHealth, timeoutSignal } from "../util/service-health.js";
+import { serviceHeaders } from "../util/service-headers.js";
 import { calculateCostUsd } from "./pricing.js";
 export const DEFAULT_DERIVE_MODEL = "claude-haiku-4-5-20251001";
 const ANTHROPIC_URL = "https://api.anthropic.com/v1/messages";
@@ -311,6 +312,7 @@ async function deriveViaService(opts, service, schema, keys) {
             headers: {
                 "content-type": "application/json",
                 authorization: `Bearer ${service.token}`,
+                ...serviceHeaders(),
             },
             body: JSON.stringify({
                 prompt: outgoingPrompt(opts.prompt),

package/dist/replay/handover.d.ts

@@ -45,7 +45,19 @@ export type HandoverStopReason =
 /** The run was cancelled before it. */
  | "cancelled"
 /** Another of the plan's calls was still in flight (steer mode runs one at a time). */
- | "concurrent";
+ | "concurrent"
+/**
+ * A host that is not Claude Code wrote the step's result itself, and its
+ * tool never ran: a person said no, a person answered in the tool's place,
+ * or a call limit blocked the call. Not a fault of the plan.
+ */
+ | "host_rejected"
+/**
+ * The step's tool ran in such a host, with arguments a person chose in
+ * place of the plan's. Its result is real; the plan's later steps were
+ * computed for the call it planned, so it stops there.
+ */
+ | "host_edited";
 export interface HandoverNoteInput {
     intent: string;
     kind: FallbackKind;

package/dist/replay/handover.js

@@ -56,6 +56,12 @@ export function buildHandoverNote(n) {
         // says it may have completed.
         lines.push("No step of the scenario is known to have finished; the task is yours.");
     }
+    else if (n.stopReason === "host_rejected" || n.stopReason === "host_edited") {
+        // The first step was answered by the host, or ran with a person's
+        // arguments: "the whole task is yours" would invite the model to do that
+        // step over, which the next line tells it not to.
+        lines.push("No step of the scenario ran as it was planned.");
+    }
     else {
         lines.push("No step of the scenario ran; the whole task is yours.");
     }
@@ -109,6 +115,19 @@ export function buildHandoverNote(n) {
 function stepFailedLine(n, human, tool) {
     const at = `Step ${human} of ${n.totalSteps}${tool}`;
     const detail = n.error ? truncate(n.error, MAX_ERROR_CHARS) : "";
+    // The two stops a host that is not Claude Code reports, first: neither is
+    // a failure, and neither is the model's to make good.
+    if (n.stopReason === "host_rejected") {
+        // One sentence for three causes — a person said no, a person answered in
+        // the tool's place, a call limit blocked the call — so it names none of
+        // them, and never says "do it yourself": the person may have meant no.
+        return (`${at} was not run by the host. The result above was written by the host, not by the tool. ` +
+            "Do not run the step again unless the user asks.");
+    }
+    if (n.stopReason === "host_edited") {
+        return (`${at} ran with arguments a person chose, not the scenario's. Its result above is real ` +
+            "and its side effects are in place. Do not run it again.");
+    }
     if (n.ranThisStep) {
         // Its tool ran and did its work; only the scenario's reading of the result
         // broke. A model told "failed" here runs the write again.

package/dist/replay/safety.d.ts

@@ -43,16 +43,27 @@ import type { ParamsSchema } from "./types.js";
  * or a database, `write` is only written into a file.
  */
 export type SinkKind = "command" | "write";
+/**
+ * The sinks a host that is not Claude Code declared for its own tools, by
+ * tool name. Passing one — even an empty one — says the tool names are that
+ * host's: `Bash`, `Edit` and `mcp__server__tool` then mean nothing by
+ * themselves. A tool the host declared is what it was declared; any other is
+ * judged by the words of its plain name (`run_sql`, `execQuery`).
+ */
+export interface HostSinks {
+    command?: readonly string[];
+    write?: readonly string[];
+}
 /** Whether this tool's input is run by a shell. */
-export declare function isShellTool(toolName: string | null | undefined): boolean;
+export declare function isShellTool(toolName: string | null | undefined, host?: HostSinks): boolean;
 /** How this tool consumes its input, or undefined when it is neither run nor written. */
-export declare function sinkOf(toolName: string | null | undefined): SinkKind | undefined;
+export declare function sinkOf(toolName: string | null | undefined, host?: HostSinks): SinkKind | undefined;
 /** Whether this tool's input is run or written: a shell, a file edit, a query. */
 export declare function isCommandSink(toolName: string | null | undefined): boolean;
 /** The strictest sink among the planned steps, or undefined when there is none. */
-export declare function sinkOfPlan(entries: readonly FlatEntry[]): SinkKind | undefined;
+export declare function sinkOfPlan(entries: readonly FlatEntry[], host?: HostSinks): SinkKind | undefined;
 /** Whether any planned step runs its input through a shell. */
-export declare function hasShellStep(entries: readonly FlatEntry[]): boolean;
+export declare function hasShellStep(entries: readonly FlatEntry[], host?: HostSinks): boolean;
 /** Whether any planned step's input is run or written. */
 export declare function hasCommandSink(entries: readonly FlatEntry[]): boolean;
 /**

package/dist/replay/safety.js

@@ -84,16 +84,29 @@ const UNSAFE = /[`$;&|<>\\"'\r\n\u0000]|--|\/\*/;
  * apostrophe, at the cost of a denied call and a model round trip each time.
  */
 const WRITE_UNSAFE = /[\r\n\u0000]/;
+/** Whether a plain tool name of another host says its input is run. */
+function plainNameSays(name, words) {
+    return words.test(nameWords(name));
+}
 /** Whether this tool's input is run by a shell. */
-export function isShellTool(toolName) {
+export function isShellTool(toolName, host) {
     const name = toolName ?? "";
+    if (host)
+        return plainNameSays(name, MCP_SHELL_WORD);
     if (SHELL_BUILTINS.has(name))
         return true;
     return mcpNameSays(name, MCP_SHELL_WORD);
 }
 /** How this tool consumes its input, or undefined when it is neither run nor written. */
-export function sinkOf(toolName) {
+export function sinkOf(toolName, host) {
     const name = toolName ?? "";
+    if (host) {
+        if (host.command?.includes(name))
+            return "command";
+        if (host.write?.includes(name))
+            return "write";
+        return plainNameSays(name, MCP_COMMAND_WORD) ? "command" : undefined;
+    }
     if (SHELL_BUILTINS.has(name))
         return "command";
     if (WRITE_BUILTINS.has(name))
@@ -105,10 +118,10 @@ export function isCommandSink(toolName) {
     return sinkOf(toolName) !== undefined;
 }
 /** The strictest sink among the planned steps, or undefined when there is none. */
-export function sinkOfPlan(entries) {
+export function sinkOfPlan(entries, host) {
     let found;
     for (const e of entries) {
-        const sink = sinkOf(e.step.toolName);
+        const sink = sinkOf(e.step.toolName, host);
         if (sink === "command")
             return sink;
         found ??= sink;
@@ -116,8 +129,8 @@ export function sinkOfPlan(entries) {
     return found;
 }
 /** Whether any planned step runs its input through a shell. */
-export function hasShellStep(entries) {
-    return entries.some((e) => isShellTool(e.step.toolName));
+export function hasShellStep(entries, host) {
+    return entries.some((e) => isShellTool(e.step.toolName, host));
 }
 /** Whether any planned step's input is run or written. */
 export function hasCommandSink(entries) {

package/dist/replay/source-run.js

@@ -40,6 +40,7 @@
  */
 import { logDetail, logLine, errText } from "../util/log.js";
 import { isUnhealthyStatus, serviceHealth, serviceTimeoutMs, timeoutSignal, } from "../util/service-health.js";
+import { serviceHeaders } from "../util/service-headers.js";
 export class SourceRunCache {
     opts;
     /** run id → every recorded output of that run, in order. */
@@ -109,7 +110,7 @@ export class SourceRunCache {
         let res;
         try {
             res = await doFetch(`${this.opts.baseUrl.replace(/\/+$/, "")}/recordings/runs/${runId}`, {
-                headers: { authorization: `Bearer ${token}` },
+                headers: { authorization: `Bearer ${token}`, ...serviceHeaders() },
                 signal: timeoutSignal(this.opts.timeoutMs ?? serviceTimeoutMs()),
             });
         }