@foldrun/core 2.3.0 → 2.5.0

package/dist/src/runs-filter.d.ts

@@ -0,0 +1,48 @@
+export interface RunFilter {
+    /** A step called a tool whose name contains this (`web`, `crm_export`). */
+    tool?: string;
+    /** A tool call errored. */
+    toolError?: boolean;
+    /** A step was this agent. */
+    agent?: string;
+    /** A step ran a model whose name contains this (`haiku`, `opus`). */
+    model?: string;
+    /** The run read at least this many input tokens, all steps together. */
+    minTokens?: number;
+    /** The run took at least this many seconds. */
+    minSecs?: number;
+}
+/** The query parameters a filter comes from: tool, tool_error, agent,
+ *  model, min_tokens, min_secs. Unreadable numbers are refused in words. */
+export declare function parseRunFilter(q: {
+    get(name: string): string | null;
+}): {
+    filter: RunFilter;
+    problems: string[];
+};
+export declare const isEmptyFilter: (f: RunFilter) => boolean;
+type FilterableStep = {
+    agent: string;
+    model?: string;
+    tools?: string[];
+    toolErrors?: number;
+    /** A whole record has events instead of the index's tools/toolErrors. */
+    events?: {
+        type: string;
+        text: string;
+        ms?: number;
+        err?: boolean;
+    }[];
+    tokens?: {
+        input?: number;
+    } | null;
+    startedAt?: string;
+    finishedAt?: string;
+};
+type FilterableRun = {
+    startedAt: string;
+    finishedAt?: string | null;
+    steps: FilterableStep[];
+};
+export declare function matchesRunFilter(run: FilterableRun, f: RunFilter, now?: number): boolean;
+export {};

package/dist/src/runs-filter.js

@@ -0,0 +1,73 @@
+// Search over runs (FOL-72 step 9): one filter for the runs API, the runs
+// pages and `foldrun runs`, read off the run index — the tools each step
+// called, its tool errors, its agent and model, tokens and how long it took.
+// Pure.
+/** The query parameters a filter comes from: tool, tool_error, agent,
+ *  model, min_tokens, min_secs. Unreadable numbers are refused in words. */
+export function parseRunFilter(q) {
+    const filter = {};
+    const problems = [];
+    const text = (k) => q.get(k)?.trim() || undefined;
+    const tool = text("tool");
+    if (tool)
+        filter.tool = tool.toLowerCase();
+    const te = text("tool_error");
+    if (te)
+        filter.toolError = te === "1" || te === "true" || te === "yes";
+    const agent = text("agent");
+    if (agent)
+        filter.agent = agent;
+    const model = text("model");
+    if (model)
+        filter.model = model.toLowerCase();
+    for (const [k, field] of [["min_tokens", "minTokens"], ["min_secs", "minSecs"]]) {
+        const v = text(k);
+        if (v === undefined)
+            continue;
+        // "50k" and "1.5k" are thousands (Codex review: "1.5k" read as 1.5).
+        const kilo = /^(\d+(?:\.\d+)?)k$/i.exec(v);
+        const n = kilo ? Number(kilo[1]) * 1000 : Number(v);
+        if (!Number.isFinite(n) || n < 0)
+            problems.push(`${k} is a number (${k === "min_tokens" ? "50000 or 50k" : "seconds"}), not ${v}`);
+        else
+            filter[field] = n;
+    }
+    return { filter, problems };
+}
+export const isEmptyFilter = (f) => Object.keys(f).length === 0;
+/** The index's facts, or worked out from a whole record's events (Codex
+ *  review: the workspace runs page reads whole records). */
+function factsOf(s) {
+    if (s.tools !== undefined || s.toolErrors !== undefined || !s.events)
+        return { tools: s.tools ?? [], toolErrors: s.toolErrors ?? 0 };
+    const tools = new Set();
+    let errs = 0;
+    for (const e of s.events) {
+        if (e.type !== "tool")
+            continue;
+        if (e.ms == null)
+            tools.add(e.text);
+        else if (e.err)
+            errs++;
+    }
+    return { tools: [...tools], toolErrors: errs };
+}
+export function matchesRunFilter(run, f, now = Date.now()) {
+    const steps = (run.steps ?? []).map((s) => ({ ...s, ...factsOf(s) }));
+    if (f.tool && !steps.some((s) => (s.tools ?? []).some((t) => t.toLowerCase().includes(f.tool))))
+        return false;
+    if (f.toolError !== undefined && steps.some((s) => (s.toolErrors ?? 0) > 0) !== f.toolError)
+        return false;
+    if (f.agent && !steps.some((s) => s.agent === f.agent))
+        return false;
+    if (f.model && !steps.some((s) => (s.model ?? "").toLowerCase().includes(f.model)))
+        return false;
+    if (f.minTokens !== undefined && steps.reduce((n, s) => n + (s.tokens?.input ?? 0), 0) < f.minTokens)
+        return false;
+    if (f.minSecs !== undefined) {
+        const secs = ((run.finishedAt ? Date.parse(run.finishedAt) : now) - Date.parse(run.startedAt)) / 1000;
+        if (!(secs >= f.minSecs))
+            return false;
+    }
+    return true;
+}

package/dist/src/scan.d.ts

@@ -25,6 +25,10 @@ export interface ScanFinding {
     message: string;
     /** Stable across edits elsewhere in the file: rule + file + line text. */
     fingerprint: string;
+    /** This rule had more to say in this file than PER_FILE_RULE: this
+     *  finding counts the rest, so what is not listed is not resolved. Its
+     *  fingerprint is of everything it counts, so a change among them is new. */
+    truncated?: true;
 }
 export interface ScanOptions {
     /** Tool names whose definition says `outward: true` — the CLI and the
@@ -66,11 +70,25 @@ export declare function redactSecret(secret: string): string;
 /** The text with every credential in it redacted — for a finding that
  *  quotes source, so no message ever carries a key whole. */
 export declare function redactText(text: string): string;
+/**
+ * Text from outside the workspace — what a remote MCP server says about its
+ * tools — through the content rules with nothing the text itself can turn
+ * off: no foldrun-ignore, no binary or vendored-path skip, no fences
+ * (FOL-58, Codex review: each of those let a server silence its own finding).
+ */
+export declare function untrustedTextFindings(text: string): {
+    rule: string;
+    line: number;
+    message: string;
+}[];
 /** The known field a key was probably meant to be, or null. */
 export declare function nearestField(key: string, known: readonly string[]): string | null;
+/** How many times one rule is listed for one file before the rest are counted. */
+export declare const PER_FILE_RULE = 100;
 /**
  * Every finding in these files, ignores applied. Findings are sorted by file
- * then line, and one rule says one thing once per line.
+ * then line, and one rule says one thing once per line, and at most
+ * PER_FILE_RULE times in one file.
  */
 export declare function scanFiles(files: ScanFile[], options?: ScanOptions): ScanFinding[];
 /**

package/dist/src/scan.js

@@ -26,7 +26,7 @@
 // The reason is required: an ignore without one ignores nothing and is itself
 // reported, because "why is this allowed?" is the question a reviewer asks.
 import crypto from "node:crypto";
-import matter from "gray-matter";
+import matter from "./matter.js";
 import { refNames } from "./refs.js";
 import { resolveNetwork } from "./network.js";
 import { frontmatterProblems, schemaKindOf } from "./frontmatter-schema.js";
@@ -117,6 +117,24 @@ export const SCAN_RULES = [
             "so a run tomorrow uses what was tested today.",
         owasp: ["ASI04"],
     },
+    {
+        id: "supply-chain/known-vulnerability",
+        category: "supply-chain",
+        level: "warn",
+        title: "A pinned runtime package with known vulnerabilities",
+        help: "OSV.dev lists vulnerabilities for this exact version. Upgrade to a fixed one. An online check: `foldrun check --to <ws> --online`, " +
+            "Checks → Check online, and the daily rescan.",
+        owasp: ["ASI04"],
+    },
+    {
+        id: "content/mcp-tool-text",
+        category: "content",
+        level: "warn",
+        title: "An MCP server's tool text carries hidden or injected instructions",
+        help: "What a remote MCP server says about its tools reaches the model as instructions. Hidden characters or an order in a tool " +
+            "description is a server steering your agent. An online check, for servers reached by URL; a command server is never run to check it.",
+        owasp: ["ASI01", "ASI04"],
+    },
     {
         id: "config/unknown-field",
         category: "config",
@@ -399,13 +417,15 @@ const INJECTION = [
     /\b(?:send|post|upload|exfiltrate)\s+(?:all\s+|the\s+|every\s+)?(?:secrets?|credentials|api\s+keys?|tokens?|env(?:ironment)?\s+variables)\s+to\b/i,
 ];
 const BLOB = /[A-Za-z0-9+/]{300,}={0,2}/g;
-function scanContent(file, lines, push) {
-    const md = /\.md$/i.test(file.path);
-    const data = isDataDoc(file.path);
+function scanContent(file, lines, push, untrusted = false) {
+    // Untrusted text (a remote server's) is read as data, every line: it
+    // cannot fence an order off as an "example" either.
+    const md = untrusted || /\.md$/i.test(file.path);
+    const data = untrusted || isDataDoc(file.path);
     let fenced = false;
     for (let i = 0; i < lines.length; i++) {
         const line = i === 0 ? lines[i].replace(/^/, "") : lines[i];
-        if (/^\s*(?:```|~~~)/.test(line))
+        if (!untrusted && /^\s*(?:```|~~~)/.test(line))
             fenced = !fenced;
         HIDDEN.lastIndex = 0;
         if (HIDDEN.test(line)) {
@@ -431,6 +451,17 @@ function scanContent(file, lines, push) {
         }
     }
 }
+/**
+ * Text from outside the workspace — what a remote MCP server says about its
+ * tools — through the content rules with nothing the text itself can turn
+ * off: no foldrun-ignore, no binary or vendored-path skip, no fences
+ * (FOL-58, Codex review: each of those let a server silence its own finding).
+ */
+export function untrustedTextFindings(text) {
+    const out = [];
+    scanContent({ path: "untrusted", content: text }, text.split(/\r?\n/), (rule, _file, line, _text, message) => out.push({ rule, line: line ?? 0, message }), true);
+    return out;
+}
 /** The text hidden in tag characters: each is U+E0000 + an ASCII code. */
 function decodeTags(s) {
     let out = "";
@@ -657,9 +688,12 @@ const RUNTIME_WRITTEN = /(?:^|\/)(?:\.cache|\.npm|\.local|\.pnpm-store|\.yarn|\.
 function isText(f) {
     return !VENDORED.test(f.path) && !f.content.slice(0, 8000).includes("\u0000") && !/\.(?:png|jpe?g|gif|webp|ico|pdf|zip|gz|woff2?|ttf|mp[34]|mov|wasm)$/i.test(f.path);
 }
+/** How many times one rule is listed for one file before the rest are counted. */
+export const PER_FILE_RULE = 100;
 /**
  * Every finding in these files, ignores applied. Findings are sorted by file
- * then line, and one rule says one thing once per line.
+ * then line, and one rule says one thing once per line, and at most
+ * PER_FILE_RULE times in one file.
  */
 export function scanFiles(files, options = {}) {
     const want = options.only?.length ? new Set(options.only) : null;
@@ -667,6 +701,11 @@ export function scanFiles(files, options = {}) {
     const findings = [];
     const seen = new Set();
     const ignoresByFile = new Map();
+    // One rule in one file says it PER_FILE_RULE times, then counts the rest:
+    // a million lines of hidden characters is one problem, not a million
+    // findings held in memory (Codex review of the 20 Oct rescan outage).
+    const perFileRule = new Map();
+    const more = new Map();
     const push = (rule, file, line, text, message, level) => {
         if (!enabled(rule))
             return;
@@ -676,6 +715,16 @@ export function scanFiles(files, options = {}) {
         const key = `${rule}\0${file}\0${line ?? ""}\0${message}`;
         if (seen.has(key))
             return;
+        const rf = `${rule}\0${file}`;
+        const said = perFileRule.get(rf) ?? 0;
+        if (said >= PER_FILE_RULE) {
+            const m = more.get(rf) ?? { rule, file, level, n: 0, hash: crypto.createHash("sha256") };
+            m.n++;
+            m.hash.update(`${findingFingerprint(rule, file, text)}\0`);
+            more.set(rf, m);
+            return;
+        }
+        perFileRule.set(rf, said + 1);
         seen.add(key);
         findings.push({ rule, level: level ?? scanRule(rule)?.level ?? "warn", file, ...(line ? { line } : {}), message, fingerprint: findingFingerprint(rule, file, text) });
     };
@@ -719,8 +768,12 @@ export function scanFiles(files, options = {}) {
             toolDefs.set(f.path, { data, lines });
         }
     }
-    const workspaceMd = files.find((f) => f.path === "AGENTS.md");
+    // project.md is the older name the runtime still reads (Codex review, FOL-58).
+    const workspaceMd = files.find((f) => f.path === "AGENTS.md") ?? files.find((f) => f.path === "project.md");
     scanAgents(agents, outward, toolDefs, push, { account: options.accountNetwork, workspace: workspaceMd ? frontOf(workspaceMd.content)?.network : undefined });
+    for (const m of more.values()) {
+        findings.push({ rule: m.rule, level: m.level ?? scanRule(m.rule)?.level ?? "warn", file: m.file, message: `and ${m.n} more like this in this file, not listed`, fingerprint: m.hash.digest("hex").slice(0, 16), truncated: true });
+    }
     return findings.sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule));
 }
 /**

package/dist/src/starter.js

@@ -357,7 +357,7 @@ All of it, \`/api/workspaces/<workspace>\` unless noted:
 | \`/assistant\` | POST | ask the assistant, or have it write agents, flows, tools and skills — from the docs only; proposals come back, nothing is written |
 
 Account-level, outside \`/workspaces\`: \`/api/secrets\`, \`/api/keys\`, \`/api/schedule\`,
-\`/api/approvals\`, \`/api/usage\`, \`/api/library/<kind>\`, \`/api/team\`, \`/api/billing\`,
+\`/api/approvals\`, \`/api/issues\` (what went wrong, open until resolved), \`/api/usage\`, \`/api/library/<kind>\`, \`/api/team\`, \`/api/billing\`,
 \`/api/me/notifications\` (what mail you get; a key acts for whoever minted it),
 \`/api/account/backups\` (snapshots, restore requests), \`/api/me/onboarding\` (getting started),
 \`/api/healthz\` and \`/api/version\` (open), \`/api/changelog\` (release notes)
@@ -391,6 +391,7 @@ subflow), \`foldrun flow rm-step\` removes a step, and \`foldrun agent link
 trigger: manual          # manual | schedule | webhook
 schedule: "0 9 * * 1"    # cron, when trigger: schedule
 timezone: Australia/Sydney
+owner: ana@example.com   # who answers for it; else the workspace's, else the account's
 model: default           # a default for every step here
 effort: low
 overlap: skip            # skip | queue — what a second run does while one is live
@@ -448,10 +449,11 @@ by a model: what this role is for, what it must not do, what good looks like.
 ---
 name: researcher
 description: Finds and summarises sources.
+owner: ana@example.com      # who answers for it; else the workspace's, else the account's
 model: default              # fast | default | max
 effort: low                 # how hard to think about it
 size: large                 # small | large | heavy — the sandbox it rents
-tools: [web, read, ask, my-folder-tool]  # built-ins and your own tools/, one list; \`ask\` lets it ask you mid-step
+tools: [web, read, ask, peers, my-folder-tool]  # built-ins and your own tools/, one list; \`ask\` lets it ask you mid-step, \`peers\` lets it message the steps running beside it
 disallowedTools: [Bash]     # subtract from what it would otherwise have
 skills: [house-style]       # from skills/
 hooks: [no-force-push]      # from hooks/ or the library: code at every tool call

package/dist/src/step-exec.d.ts

@@ -1,6 +1,6 @@
 import { type HookDef, type HookRecord } from "./hooks.ts";
 import type { McpServerConfig } from "@anthropic-ai/claude-agent-sdk";
-import type { Effort } from "./store.ts";
+import { type Effort, type ModelCall } from "./store.ts";
 import { type TokenPrice } from "./catalog.ts";
 import type { TestEffect } from "./test-mode.ts";
 import type { OperatorEvent } from "./operator.ts";
@@ -57,6 +57,11 @@ export interface ExecOutcome {
     browserPod?: BrowserPodOutcome;
 }
 export interface ExecOptions {
+    /** What the step reports beyond its events (FOL-54 step 4): `metadata`
+     *  sends each model call (`turn`); `full` also sends each tool call's input
+     *  and output (`io`). Unset sends neither — the consult, the probe and any
+     *  caller that does not store them. */
+    capture?: "metadata" | "full";
     /** `hooks:` resolved host-side (hooks.ts): run at this step's own dispatch,
      *  inside its sandbox. `hookBase` is what every hook event carries. */
     hooks?: HookDef[];
@@ -175,7 +180,30 @@ export type EventExtra = {
     subagent?: string;
     check?: boolean;
     hook?: HookRecord;
+    /** A tool call's content, on its way to the runner (FOL-54 step 4): the
+     *  runner masks it, stores it beside the run and keeps only `captured` on
+     *  the event. Sent only under `capture: "full"`. */
+    io?: CallIo;
+    /** One model call, on its way to the runner's `step.calls` — not an event. */
+    turn?: ModelCall;
+    /** The model's first response of the step has begun streaming — the
+     *  moment the prompt cache entry its request wrote becomes readable. Sent
+     *  once; the runner's fan-out gate reads it. Not an event. */
+    responding?: true;
+    /** Set by the runner once it stored `io` (RunEvent.captured). */
+    captured?: boolean;
+    /** On a tool call: the model call (its message id) that asked for it. */
+    inCall?: string;
 };
+/** A tool call's input (on the call) or output (on its completion), capped. */
+export interface CallIo {
+    input?: string;
+    output?: string;
+    /** The whole input's / output's length, in characters, before any cut. */
+    inputChars?: number;
+    outputChars?: number;
+    truncated?: boolean;
+}
 /** Conservative per-token rates for a model nothing else can price — an
  *  unknown id on a gateway with no catalogue. Opus-class, so a ceiling
  *  still means something. Only ever reached when `knownPrice` below does

package/dist/src/step-exec.js

@@ -12,13 +12,14 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
+import { CAPTURE_CAP } from "./store.js";
 import { costOf } from "./catalog.js";
 import { spawn } from "node:child_process";
 import { checkPaths, checkBash, isFilesystemTool, linkWorkspace, workspaceLinkEnv, resolveAgentPath, isWithin } from "./confine.js";
 import { DELEGATE_TOOLS, subagentGuard, toAgentDefinitions } from "./subagents.js";
 import { hostSafeEnv } from "./host-env.js";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.js";
-import { CallCounter, limitKeysFor } from "./limits.js";
+import { CallCounter, callKeysFor } from "./limits.js";
 import { classifyCall, podAt, readPodEvents } from "./browser-pod.js";
 /** The four counts from one SDK usage object (snake_case, as the API
  *  reports it). The API counts fresh input apart from the cache's; here
@@ -50,6 +51,14 @@ export function verifyBudgetMs(timeoutSec, elapsedMs) {
 /** After an interrupt is asked for, how long the model loop gets to wind
  *  down on its own before the query is aborted outright. */
 export const INTERRUPT_GRACE_MS = 10_000;
+// The cap plus slack: the runner masks, then cuts to the cap (capture.ts), so
+// a secret on the edge is masked whole.
+const SEND_CAP = CAPTURE_CAP + 4096;
+function capped(text) {
+    if (text.length <= SEND_CAP)
+        return { text, chars: text.length, truncated: false };
+    return { text: text.slice(0, SEND_CAP), chars: text.length, truncated: true };
+}
 /** The tag on every event a failed check writes — `verify:`, `output: json`,
  *  a schema — headline and detail alike. The runner's no-retry rule for
  *  outward steps reads it (actedThenFailedCheck); reading the wording of the
@@ -228,6 +237,10 @@ async function executeStepInner(opts, runQuery) {
             ...(opts.effort ? { effort: opts.effort } : {}),
             systemPrompt: opts.systemPrompt,
             ...(opts.maxTurns ? { maxTurns: opts.maxTurns } : {}),
+            // The raw stream, only when model calls are recorded: an assistant
+            // message carries usage from the call's start (output a few tokens) and
+            // no stop reason; the call's message_delta has both (FOL-72).
+            ...(opts.capture ? { includePartialMessages: true } : {}),
             // Sub-agents: the SDK's own delegation. Every definition carries an
             // explicit tool list (an absent one inherits all of ours).
             ...(subagents ? { agents: toAgentDefinitions(subagents) } : {}),
@@ -313,7 +326,7 @@ async function executeStepInner(opts, runQuery) {
                                 // refused before it runs: the tool, and any paid API behind it,
                                 // never sees it.
                                 if (counter.active) {
-                                    const refusal = counter.take(limitKeysFor(hookInput.tool_name, hookInput.tool_input, opts.toolOwners));
+                                    const refusal = counter.take(callKeysFor(hookInput.tool_name, hookInput.tool_input, opts.toolOwners));
                                     if (refusal) {
                                         emit("info", `${refusal.message} (${hookInput.tool_name} refused)`, via ? { subagent: via } : undefined);
                                         return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: refusal.message } };
@@ -330,7 +343,7 @@ async function executeStepInner(opts, runQuery) {
                                     for (const r of v.records)
                                         record(r, via);
                                     const refundCall = () => { if (counter.active)
-                                        counter.refund(limitKeysFor(hookInput.tool_name, hookInput.tool_input, opts.toolOwners)); };
+                                        counter.refund(callKeysFor(hookInput.tool_name, hookInput.tool_input, opts.toolOwners)); };
                                     if (v.decision === "deny") {
                                         refundCall();
                                         return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: v.reason } };
@@ -407,7 +420,7 @@ async function executeStepInner(opts, runQuery) {
                 const fromGrantedServer = opts.mcpNames.some((n) => toolName.startsWith(`mcp__${n}__`));
                 // A call the hook counted and this refuses never ran: give it back.
                 const refund = () => { if (counter.active)
-                    counter.refund(limitKeysFor(toolName, input, opts.toolOwners)); };
+                    counter.refund(callKeysFor(toolName, input, opts.toolOwners)); };
                 if (!opts.allowed.includes(toolName) && !fromGrantedServer) {
                     refund();
                     return {
@@ -480,6 +493,29 @@ async function executeStepInner(opts, runQuery) {
     // ceiling and on the bill.
     const turns = new Map();
     let anonymousTurns = 0;
+    // Each model call as a span (FOL-54 step 4), keyed like `turns`: a turn's
+    // blocks arrive as several messages under one id, so it is updated in place
+    // and sent again; the runner keeps the latest by id.
+    const spans = new Map();
+    // From the raw stream: which call each agent is in (message_start), and each
+    // call's final output tokens and stop reason (message_delta).
+    const streaming = new Map();
+    let saidResponding = false;
+    const finals = new Map();
+    const withFinal = (span) => {
+        const f = finals.get(span.id);
+        return {
+            ...span,
+            ...(f?.output !== undefined ? { tokens: { ...span.tokens, output: f.output } } : {}),
+            // Without the stream (an older CLI), a call that used tools stopped to use them.
+            ...(f?.stop ? { stop: f.stop } : !span.stop && span.tools > 0 ? { stop: "tool_use" } : {}),
+        };
+    };
+    // When each agent's next request went out — the step's own, and each
+    // sub-agent's apart, so one's tool results do not restart another's clock.
+    const lastInputAt = new Map();
+    const sentAt = (via) => lastInputAt.get(via ?? "") ?? loopStartedAt;
+    let loopStartedAt = Date.now();
     const specByName = new Map((subagents ?? []).map((s) => [s.name, s]));
     const priceOf = (message) => {
         const parent = message.parent_tool_use_id;
@@ -560,13 +596,65 @@ async function executeStepInner(opts, runQuery) {
     };
     try {
         for await (const message of q) {
+            // The session is up: the first model call is timed from here, not from
+            // before the SDK and its MCP servers started.
+            if (message.type === "system" && message.subtype === "init")
+                loopStartedAt = Date.now();
+            if (message.type === "stream_event") {
+                const ev = message.event;
+                const agentKey = message.parent_tool_use_id ?? "";
+                if (ev?.type === "message_start" && ev.message?.id) {
+                    streaming.set(agentKey, ev.message.id);
+                    // The step's own first response has begun: its prompt is in the
+                    // cache now, so siblings held back to read it may start.
+                    if (!agentKey && !saidResponding) {
+                        saidResponding = true;
+                        emit("info", "", { responding: true });
+                    }
+                }
+                if (ev?.type === "message_delta") {
+                    const id = streaming.get(agentKey);
+                    if (id) {
+                        finals.set(id, {
+                            ...(typeof ev.usage?.output_tokens === "number" ? { output: ev.usage.output_tokens } : {}),
+                            ...(ev.delta?.stop_reason ? { stop: ev.delta.stop_reason } : {}),
+                        });
+                        const span = spans.get(id);
+                        if (span) {
+                            const final = withFinal(span);
+                            spans.set(id, final);
+                            emit("info", "", { turn: final });
+                        }
+                    }
+                }
+                continue;
+            }
             if (ended)
                 break;
             if (message.type === "assistant") {
                 const m = message.message;
                 const u = m.usage;
+                const turnKey = m.id ?? `turn-${anonymousTurns++}`;
                 if (u)
-                    turns.set(m.id ?? `turn-${anonymousTurns++}`, { u, price: priceOf(message) });
+                    turns.set(turnKey, { u, price: priceOf(message) });
+                if (opts.capture && u) {
+                    const t = usageFromSdk(u);
+                    const prior = spans.get(turnKey);
+                    const span = {
+                        id: turnKey,
+                        n: prior?.n ?? spans.size + 1,
+                        at: prior?.at ?? new Date().toISOString(),
+                        ms: prior?.ms ?? Date.now() - sentAt(subagentOf(message)),
+                        ...(m.model ? { model: m.model } : prior?.model ? { model: prior.model } : {}),
+                        ...(m.stop_reason ? { stop: m.stop_reason } : prior?.stop ? { stop: prior.stop } : {}),
+                        tokens: { input: t.inputTokens, output: t.outputTokens, cacheRead: t.cacheReadTokens, cacheWrite: t.cacheWriteTokens },
+                        tools: (prior?.tools ?? 0) + (m.content ?? []).filter((b) => b?.type === "tool_use").length,
+                        ...(subagentOf(message) ? { subagent: subagentOf(message) } : {}),
+                    };
+                    const final = withFinal(span);
+                    spans.set(turnKey, final);
+                    emit("info", "", { turn: final });
+                }
                 if (ceiling && u) {
                     spentUsd = turnsTotal();
                     if (spentUsd >= ceiling) {
@@ -590,6 +678,8 @@ async function executeStepInner(opts, runQuery) {
                             const input = block.input;
                             const to = String(input?.subagent_type ?? "subagent");
                             delegations.set(block.id, to);
+                            // That sub-agent's first model call is timed from its job going out.
+                            lastInputAt.set(to, Date.now());
                             // One line a person can read: who got the job, and what it was.
                             const job = String(input?.description ?? input?.prompt ?? "").replace(/\s+/g, " ").trim().slice(0, 160);
                             emit("info", `delegating to ${to}${job ? `: ${job}` : ""}`, { subagent: to });
@@ -597,7 +687,13 @@ async function executeStepInner(opts, runQuery) {
                         openCalls.set(block.id, { name: block.name, at: Date.now(), ...(via ? { subagent: via } : {}) });
                         if (pod)
                             ledger.set(block.id, classifyCall(block.name, block.input, pod));
-                        emit("tool", block.name, { call: block.id, ...(via ? { subagent: via } : {}) });
+                        const input = opts.capture === "full" ? capped(JSON.stringify(block.input ?? {})) : null;
+                        emit("tool", block.name, {
+                            call: block.id,
+                            ...(opts.capture ? { inCall: turnKey } : {}),
+                            ...(via ? { subagent: via } : {}),
+                            ...(input ? { io: { input: input.text, inputChars: input.chars, ...(input.truncated ? { truncated: true } : {}) } } : {}),
+                        });
                     }
                 }
             }
@@ -613,6 +709,7 @@ async function executeStepInner(opts, runQuery) {
                         if (!open)
                             continue;
                         openCalls.delete(block.tool_use_id);
+                        const output = opts.capture === "full" ? capped(toolResultText(block.content)) : null;
                         emit("tool", open.name, {
                             call: block.tool_use_id,
                             ms: Date.now() - open.at,
@@ -621,6 +718,7 @@ async function executeStepInner(opts, runQuery) {
                             bytes: toolResultText(block.content).length,
                             ...(block.is_error ? { err: true } : {}),
                             ...(open.subagent ? { subagent: open.subagent } : {}),
+                            ...(output ? { io: { output: output.text, outputChars: output.chars, ...(output.truncated ? { truncated: true } : {}) } } : {}),
                         });
                         // Why it failed, on the trail. The span above carried only `err`,
                         // so a refused call left the agent's own guess as the only account
@@ -633,6 +731,8 @@ async function executeStepInner(opts, runQuery) {
                         }
                         readPod(block.tool_use_id);
                     }
+                    // That agent's next model call is timed from here: the results went back.
+                    lastInputAt.set(subagentOf(message) ?? "", Date.now());
                 }
             }
             else if (message.type === "result") {