@foldrun/core 2.4.0 → 2.5.0

package/src/runs-filter.ts

@@ -0,0 +1,88 @@
+// Search over runs (FOL-72 step 9): one filter for the runs API, the runs
+// pages and `foldrun runs`, read off the run index — the tools each step
+// called, its tool errors, its agent and model, tokens and how long it took.
+// Pure.
+
+export interface RunFilter {
+  /** A step called a tool whose name contains this (`web`, `crm_export`). */
+  tool?: string;
+  /** A tool call errored. */
+  toolError?: boolean;
+  /** A step was this agent. */
+  agent?: string;
+  /** A step ran a model whose name contains this (`haiku`, `opus`). */
+  model?: string;
+  /** The run read at least this many input tokens, all steps together. */
+  minTokens?: number;
+  /** The run took at least this many seconds. */
+  minSecs?: number;
+}
+
+/** The query parameters a filter comes from: tool, tool_error, agent,
+ *  model, min_tokens, min_secs. Unreadable numbers are refused in words. */
+export function parseRunFilter(q: { get(name: string): string | null }): { filter: RunFilter; problems: string[] } {
+  const filter: RunFilter = {};
+  const problems: string[] = [];
+  const text = (k: string) => q.get(k)?.trim() || undefined;
+  const tool = text("tool");
+  if (tool) filter.tool = tool.toLowerCase();
+  const te = text("tool_error");
+  if (te) filter.toolError = te === "1" || te === "true" || te === "yes";
+  const agent = text("agent");
+  if (agent) filter.agent = agent;
+  const model = text("model");
+  if (model) filter.model = model.toLowerCase();
+  for (const [k, field] of [["min_tokens", "minTokens"], ["min_secs", "minSecs"]] as const) {
+    const v = text(k);
+    if (v === undefined) continue;
+    // "50k" and "1.5k" are thousands (Codex review: "1.5k" read as 1.5).
+    const kilo = /^(\d+(?:\.\d+)?)k$/i.exec(v);
+    const n = kilo ? Number(kilo[1]) * 1000 : Number(v);
+    if (!Number.isFinite(n) || n < 0) problems.push(`${k} is a number (${k === "min_tokens" ? "50000 or 50k" : "seconds"}), not ${v}`);
+    else filter[field] = n;
+  }
+  return { filter, problems };
+}
+
+export const isEmptyFilter = (f: RunFilter) => Object.keys(f).length === 0;
+
+type FilterableStep = {
+  agent: string;
+  model?: string;
+  tools?: string[];
+  toolErrors?: number;
+  /** A whole record has events instead of the index's tools/toolErrors. */
+  events?: { type: string; text: string; ms?: number; err?: boolean }[];
+  tokens?: { input?: number } | null;
+  startedAt?: string;
+  finishedAt?: string;
+};
+type FilterableRun = { startedAt: string; finishedAt?: string | null; steps: FilterableStep[] };
+
+/** The index's facts, or worked out from a whole record's events (Codex
+ *  review: the workspace runs page reads whole records). */
+function factsOf(s: FilterableStep): { tools: string[]; toolErrors: number } {
+  if (s.tools !== undefined || s.toolErrors !== undefined || !s.events) return { tools: s.tools ?? [], toolErrors: s.toolErrors ?? 0 };
+  const tools = new Set<string>();
+  let errs = 0;
+  for (const e of s.events) {
+    if (e.type !== "tool") continue;
+    if (e.ms == null) tools.add(e.text);
+    else if (e.err) errs++;
+  }
+  return { tools: [...tools], toolErrors: errs };
+}
+
+export function matchesRunFilter(run: FilterableRun, f: RunFilter, now = Date.now()): boolean {
+  const steps = (run.steps ?? []).map((s) => ({ ...s, ...factsOf(s) }));
+  if (f.tool && !steps.some((s) => (s.tools ?? []).some((t) => t.toLowerCase().includes(f.tool!)))) return false;
+  if (f.toolError !== undefined && steps.some((s) => (s.toolErrors ?? 0) > 0) !== f.toolError) return false;
+  if (f.agent && !steps.some((s) => s.agent === f.agent)) return false;
+  if (f.model && !steps.some((s) => (s.model ?? "").toLowerCase().includes(f.model!))) return false;
+  if (f.minTokens !== undefined && steps.reduce((n, s) => n + (s.tokens?.input ?? 0), 0) < f.minTokens) return false;
+  if (f.minSecs !== undefined) {
+    const secs = ((run.finishedAt ? Date.parse(run.finishedAt) : now) - Date.parse(run.startedAt)) / 1000;
+    if (!(secs >= f.minSecs)) return false;
+  }
+  return true;
+}

package/src/scan.ts

@@ -27,7 +27,7 @@
 // reported, because "why is this allowed?" is the question a reviewer asks.
 
 import crypto from "node:crypto";
-import matter from "gray-matter";
+import matter from "./matter.ts";
 import { refNames } from "./refs.ts";
 import { resolveNetwork } from "./network.ts";
 import { frontmatterProblems, schemaKindOf } from "./frontmatter-schema.ts";
@@ -62,6 +62,10 @@ export interface ScanFinding {
   message: string;
   /** Stable across edits elsewhere in the file: rule + file + line text. */
   fingerprint: string;
+  /** This rule had more to say in this file than PER_FILE_RULE: this
+   *  finding counts the rest, so what is not listed is not resolved. Its
+   *  fingerprint is of everything it counts, so a change among them is new. */
+  truncated?: true;
 }
 
 export interface ScanOptions {
@@ -173,6 +177,26 @@ export const SCAN_RULES: readonly ScanRule[] = [
       "so a run tomorrow uses what was tested today.",
     owasp: ["ASI04"],
   },
+  {
+    id: "supply-chain/known-vulnerability",
+    category: "supply-chain",
+    level: "warn",
+    title: "A pinned runtime package with known vulnerabilities",
+    help:
+      "OSV.dev lists vulnerabilities for this exact version. Upgrade to a fixed one. An online check: `foldrun check --to <ws> --online`, " +
+      "Checks → Check online, and the daily rescan.",
+    owasp: ["ASI04"],
+  },
+  {
+    id: "content/mcp-tool-text",
+    category: "content",
+    level: "warn",
+    title: "An MCP server's tool text carries hidden or injected instructions",
+    help:
+      "What a remote MCP server says about its tools reaches the model as instructions. Hidden characters or an order in a tool " +
+      "description is a server steering your agent. An online check, for servers reached by URL; a command server is never run to check it.",
+    owasp: ["ASI01", "ASI04"],
+  },
   {
     id: "config/unknown-field",
     category: "config",
@@ -451,13 +475,15 @@ const INJECTION: RegExp[] = [
 
 const BLOB = /[A-Za-z0-9+/]{300,}={0,2}/g;
 
-function scanContent(file: ScanFile, lines: string[], push: Push) {
-  const md = /\.md$/i.test(file.path);
-  const data = isDataDoc(file.path);
+function scanContent(file: ScanFile, lines: string[], push: Push, untrusted = false) {
+  // Untrusted text (a remote server's) is read as data, every line: it
+  // cannot fence an order off as an "example" either.
+  const md = untrusted || /\.md$/i.test(file.path);
+  const data = untrusted || isDataDoc(file.path);
   let fenced = false;
   for (let i = 0; i < lines.length; i++) {
     const line = i === 0 ? lines[i]!.replace(/^/, "") : lines[i]!;
-    if (/^\s*(?:```|~~~)/.test(line)) fenced = !fenced;
+    if (!untrusted && /^\s*(?:```|~~~)/.test(line)) fenced = !fenced;
     HIDDEN.lastIndex = 0;
     if (HIDDEN.test(line)) {
       const kind = HIDDEN_NAMES.find(([re]) => re.test(line))?.[1] ?? "invisible characters";
@@ -481,6 +507,18 @@ function scanContent(file: ScanFile, lines: string[], push: Push) {
   }
 }
 
+/**
+ * Text from outside the workspace — what a remote MCP server says about its
+ * tools — through the content rules with nothing the text itself can turn
+ * off: no foldrun-ignore, no binary or vendored-path skip, no fences
+ * (FOL-58, Codex review: each of those let a server silence its own finding).
+ */
+export function untrustedTextFindings(text: string): { rule: string; line: number; message: string }[] {
+  const out: { rule: string; line: number; message: string }[] = [];
+  scanContent({ path: "untrusted", content: text }, text.split(/\r?\n/), (rule, _file, line, _text, message) => out.push({ rule, line: line ?? 0, message }), true);
+  return out;
+}
+
 /** The text hidden in tag characters: each is U+E0000 + an ASCII code. */
 function decodeTags(s: string): string {
   let out = "";
@@ -742,9 +780,13 @@ function isText(f: ScanFile): boolean {
   return !VENDORED.test(f.path) && !f.content.slice(0, 8000).includes("\u0000") && !/\.(?:png|jpe?g|gif|webp|ico|pdf|zip|gz|woff2?|ttf|mp[34]|mov|wasm)$/i.test(f.path);
 }
 
+/** How many times one rule is listed for one file before the rest are counted. */
+export const PER_FILE_RULE = 100;
+
 /**
  * Every finding in these files, ignores applied. Findings are sorted by file
- * then line, and one rule says one thing once per line.
+ * then line, and one rule says one thing once per line, and at most
+ * PER_FILE_RULE times in one file.
  */
 export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFinding[] {
   const want = options.only?.length ? new Set(options.only) : null;
@@ -752,6 +794,11 @@ export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFin
   const findings: ScanFinding[] = [];
   const seen = new Set<string>();
   const ignoresByFile = new Map<string, Ignores>();
+  // One rule in one file says it PER_FILE_RULE times, then counts the rest:
+  // a million lines of hidden characters is one problem, not a million
+  // findings held in memory (Codex review of the 20 Oct rescan outage).
+  const perFileRule = new Map<string, number>();
+  const more = new Map<string, { rule: string; file: string; level?: ScanFinding["level"]; n: number; hash: crypto.Hash }>();
 
   const push: Push = (rule, file, line, text, message, level) => {
     if (!enabled(rule)) return;
@@ -759,6 +806,16 @@ export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFin
     if (ig && ignored(ig, rule, line)) return;
     const key = `${rule}\0${file}\0${line ?? ""}\0${message}`;
     if (seen.has(key)) return;
+    const rf = `${rule}\0${file}`;
+    const said = perFileRule.get(rf) ?? 0;
+    if (said >= PER_FILE_RULE) {
+      const m = more.get(rf) ?? { rule, file, level, n: 0, hash: crypto.createHash("sha256") };
+      m.n++;
+      m.hash.update(`${findingFingerprint(rule, file, text)}\0`);
+      more.set(rf, m);
+      return;
+    }
+    perFileRule.set(rf, said + 1);
     seen.add(key);
     findings.push({ rule, level: level ?? scanRule(rule)?.level ?? "warn", file, ...(line ? { line } : {}), message, fingerprint: findingFingerprint(rule, file, text) });
   };
@@ -800,8 +857,12 @@ export function scanFiles(files: ScanFile[], options: ScanOptions = {}): ScanFin
       toolDefs.set(f.path, { data, lines });
     }
   }
-  const workspaceMd = files.find((f) => f.path === "AGENTS.md");
+  // project.md is the older name the runtime still reads (Codex review, FOL-58).
+  const workspaceMd = files.find((f) => f.path === "AGENTS.md") ?? files.find((f) => f.path === "project.md");
   scanAgents(agents, outward, toolDefs, push, { account: options.accountNetwork, workspace: workspaceMd ? frontOf(workspaceMd.content)?.network : undefined });
+  for (const m of more.values()) {
+    findings.push({ rule: m.rule, level: m.level ?? scanRule(m.rule)?.level ?? "warn", file: m.file, message: `and ${m.n} more like this in this file, not listed`, fingerprint: m.hash.digest("hex").slice(0, 16), truncated: true });
+  }
 
   return findings.sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule));
 }

package/src/starter.ts

@@ -373,7 +373,7 @@ All of it, \`/api/workspaces/<workspace>\` unless noted:
 | \`/assistant\` | POST | ask the assistant, or have it write agents, flows, tools and skills — from the docs only; proposals come back, nothing is written |
 
 Account-level, outside \`/workspaces\`: \`/api/secrets\`, \`/api/keys\`, \`/api/schedule\`,
-\`/api/approvals\`, \`/api/usage\`, \`/api/library/<kind>\`, \`/api/team\`, \`/api/billing\`,
+\`/api/approvals\`, \`/api/issues\` (what went wrong, open until resolved), \`/api/usage\`, \`/api/library/<kind>\`, \`/api/team\`, \`/api/billing\`,
 \`/api/me/notifications\` (what mail you get; a key acts for whoever minted it),
 \`/api/account/backups\` (snapshots, restore requests), \`/api/me/onboarding\` (getting started),
 \`/api/healthz\` and \`/api/version\` (open), \`/api/changelog\` (release notes)
@@ -407,6 +407,7 @@ subflow), \`foldrun flow rm-step\` removes a step, and \`foldrun agent link
 trigger: manual          # manual | schedule | webhook
 schedule: "0 9 * * 1"    # cron, when trigger: schedule
 timezone: Australia/Sydney
+owner: ana@example.com   # who answers for it; else the workspace's, else the account's
 model: default           # a default for every step here
 effort: low
 overlap: skip            # skip | queue — what a second run does while one is live
@@ -464,10 +465,11 @@ by a model: what this role is for, what it must not do, what good looks like.
 ---
 name: researcher
 description: Finds and summarises sources.
+owner: ana@example.com      # who answers for it; else the workspace's, else the account's
 model: default              # fast | default | max
 effort: low                 # how hard to think about it
 size: large                 # small | large | heavy — the sandbox it rents
-tools: [web, read, ask, my-folder-tool]  # built-ins and your own tools/, one list; \`ask\` lets it ask you mid-step
+tools: [web, read, ask, peers, my-folder-tool]  # built-ins and your own tools/, one list; \`ask\` lets it ask you mid-step, \`peers\` lets it message the steps running beside it
 disallowedTools: [Bash]     # subtract from what it would otherwise have
 skills: [house-style]       # from skills/
 hooks: [no-force-push]      # from hooks/ or the library: code at every tool call

package/src/step-exec.ts

@@ -14,7 +14,7 @@ import os from "node:os";
 import path from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import type { HookInput, McpServerConfig, SDKMessage } from "@anthropic-ai/claude-agent-sdk";
-import type { Effort } from "./store.ts";
+import { CAPTURE_CAP, type Effort, type ModelCall } from "./store.ts";
 import { costOf, type TokenPrice } from "./catalog.ts";
 import type { TestEffect } from "./test-mode.ts";
 import type { OperatorEvent } from "./operator.ts";
@@ -23,7 +23,7 @@ import { checkPaths, checkBash, isFilesystemTool, linkWorkspace, workspaceLinkEn
 import { DELEGATE_TOOLS, subagentGuard, toAgentDefinitions, type SubagentSpec } from "./subagents.ts";
 import { hostSafeEnv } from "./host-env.ts";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.ts";
-import { CallCounter, limitKeysFor, type Limits } from "./limits.ts";
+import { CallCounter, callKeysFor, type Limits } from "./limits.ts";
 import { classifyCall, podAt, readPodEvents, type BrowserPodOutcome, type CallKind, type ClassifyContext } from "./browser-pod.ts";
 
 export interface ExecUsage {
@@ -86,6 +86,11 @@ export interface ExecOutcome {
 }
 
 export interface ExecOptions {
+  /** What the step reports beyond its events (FOL-54 step 4): `metadata`
+   *  sends each model call (`turn`); `full` also sends each tool call's input
+   *  and output (`io`). Unset sends neither — the consult, the probe and any
+   *  caller that does not store them. */
+  capture?: "metadata" | "full";
   /** `hooks:` resolved host-side (hooks.ts): run at this step's own dispatch,
    *  inside its sandbox. `hookBase` is what every hook event carries. */
   hooks?: HookDef[];
@@ -195,7 +200,50 @@ export type QueryLike = AsyncIterable<unknown> & { interrupt(): Promise<unknown>
 export type QueryFn = (args: { prompt: string; options: Record<string, unknown> }) => QueryLike;
 
 /** The pairing fields on a tool event — see RunEvent in store.ts. */
-export type EventExtra = { call?: string; ms?: number; err?: boolean; bytes?: number; effect?: TestEffect; operator?: OperatorEvent; subagent?: string; check?: boolean; hook?: HookRecord };
+export type EventExtra = {
+  call?: string;
+  ms?: number;
+  err?: boolean;
+  bytes?: number;
+  effect?: TestEffect;
+  operator?: OperatorEvent;
+  subagent?: string;
+  check?: boolean;
+  hook?: HookRecord;
+  /** A tool call's content, on its way to the runner (FOL-54 step 4): the
+   *  runner masks it, stores it beside the run and keeps only `captured` on
+   *  the event. Sent only under `capture: "full"`. */
+  io?: CallIo;
+  /** One model call, on its way to the runner's `step.calls` — not an event. */
+  turn?: ModelCall;
+  /** The model's first response of the step has begun streaming — the
+   *  moment the prompt cache entry its request wrote becomes readable. Sent
+   *  once; the runner's fan-out gate reads it. Not an event. */
+  responding?: true;
+  /** Set by the runner once it stored `io` (RunEvent.captured). */
+  captured?: boolean;
+  /** On a tool call: the model call (its message id) that asked for it. */
+  inCall?: string;
+};
+
+/** A tool call's input (on the call) or output (on its completion), capped. */
+export interface CallIo {
+  input?: string;
+  output?: string;
+  /** The whole input's / output's length, in characters, before any cut. */
+  inputChars?: number;
+  outputChars?: number;
+  truncated?: boolean;
+}
+
+// The cap plus slack: the runner masks, then cuts to the cap (capture.ts), so
+// a secret on the edge is masked whole.
+const SEND_CAP = CAPTURE_CAP + 4096;
+
+function capped(text: string): { text: string; chars: number; truncated: boolean } {
+  if (text.length <= SEND_CAP) return { text, chars: text.length, truncated: false };
+  return { text: text.slice(0, SEND_CAP), chars: text.length, truncated: true };
+}
 
 /** The tag on every event a failed check writes — `verify:`, `output: json`,
  *  a schema — headline and detail alike. The runner's no-retry rule for
@@ -391,6 +439,10 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
       ...(opts.effort ? { effort: opts.effort } : {}),
       systemPrompt: opts.systemPrompt,
       ...(opts.maxTurns ? { maxTurns: opts.maxTurns } : {}),
+      // The raw stream, only when model calls are recorded: an assistant
+      // message carries usage from the call's start (output a few tokens) and
+      // no stop reason; the call's message_delta has both (FOL-72).
+      ...(opts.capture ? { includePartialMessages: true } : {}),
       // Sub-agents: the SDK's own delegation. Every definition carries an
       // explicit tool list (an absent one inherits all of ours).
       ...(subagents ? { agents: toAgentDefinitions(subagents) } : {}),
@@ -474,7 +526,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
             // refused before it runs: the tool, and any paid API behind it,
             // never sees it.
             if (counter.active) {
-              const refusal = counter.take(limitKeysFor(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, opts.toolOwners));
+              const refusal = counter.take(callKeysFor(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, opts.toolOwners));
               if (refusal) {
                 emit("info", `${refusal.message} (${hookInput.tool_name} refused)`, via ? { subagent: via } : undefined);
                 return { hookSpecificOutput: { hookEventName: "PreToolUse" as const, permissionDecision: "deny" as const, permissionDecisionReason: refusal.message } };
@@ -489,7 +541,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
               // model differently from its delegates can tell them apart.
               const v = await runToolCallHooks(toolHooks, { tool: hookInput.tool_name, input, base: via ? { ...hookBase, subagent: via } : hookBase }, callHook);
               for (const r of v.records) record(r, via);
-              const refundCall = () => { if (counter.active) counter.refund(limitKeysFor(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, opts.toolOwners)); };
+              const refundCall = () => { if (counter.active) counter.refund(callKeysFor(hookInput.tool_name, hookInput.tool_input as Record<string, unknown>, opts.toolOwners)); };
               if (v.decision === "deny") {
                 refundCall();
                 return { hookSpecificOutput: { hookEventName: "PreToolUse" as const, permissionDecision: "deny" as const, permissionDecisionReason: v.reason! } };
@@ -558,7 +610,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
         // anything outside it is a denial with a reason the model can act on.
         const fromGrantedServer = opts.mcpNames.some((n) => toolName.startsWith(`mcp__${n}__`));
         // A call the hook counted and this refuses never ran: give it back.
-        const refund = () => { if (counter.active) counter.refund(limitKeysFor(toolName, input, opts.toolOwners)); };
+        const refund = () => { if (counter.active) counter.refund(callKeysFor(toolName, input, opts.toolOwners)); };
         if (!opts.allowed.includes(toolName) && !fromGrantedServer) {
           refund();
           return {
@@ -630,6 +682,29 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
   // ceiling and on the bill.
   const turns = new Map<string, { u: Record<string, number | undefined>; price: TokenPrice | null }>();
   let anonymousTurns = 0;
+  // Each model call as a span (FOL-54 step 4), keyed like `turns`: a turn's
+  // blocks arrive as several messages under one id, so it is updated in place
+  // and sent again; the runner keeps the latest by id.
+  const spans = new Map<string, ModelCall>();
+  // From the raw stream: which call each agent is in (message_start), and each
+  // call's final output tokens and stop reason (message_delta).
+  const streaming = new Map<string, string>();
+  let saidResponding = false;
+  const finals = new Map<string, { output?: number; stop?: string }>();
+  const withFinal = (span: ModelCall): ModelCall => {
+    const f = finals.get(span.id);
+    return {
+      ...span,
+      ...(f?.output !== undefined ? { tokens: { ...span.tokens, output: f.output } } : {}),
+      // Without the stream (an older CLI), a call that used tools stopped to use them.
+      ...(f?.stop ? { stop: f.stop } : !span.stop && span.tools > 0 ? { stop: "tool_use" } : {}),
+    };
+  };
+  // When each agent's next request went out — the step's own, and each
+  // sub-agent's apart, so one's tool results do not restart another's clock.
+  const lastInputAt = new Map<string, number>();
+  const sentAt = (via: string | null | undefined) => lastInputAt.get(via ?? "") ?? loopStartedAt;
+  let loopStartedAt = Date.now();
   const specByName = new Map((subagents ?? []).map((s) => [s.name, s]));
   const priceOf = (message: unknown): TokenPrice | null => {
     const parent = (message as { parent_tool_use_id?: string | null }).parent_tool_use_id;
@@ -705,11 +780,62 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
 
   try {
   for await (const message of q as AsyncIterable<SDKMessage>) {
+    // The session is up: the first model call is timed from here, not from
+    // before the SDK and its MCP servers started.
+    if (message.type === "system" && (message as { subtype?: string }).subtype === "init") loopStartedAt = Date.now();
+    if (message.type === "stream_event") {
+      const ev = (message as { event?: { type?: string; message?: { id?: string }; usage?: { output_tokens?: number }; delta?: { stop_reason?: string | null } } }).event;
+      const agentKey = (message as { parent_tool_use_id?: string | null }).parent_tool_use_id ?? "";
+      if (ev?.type === "message_start" && ev.message?.id) {
+        streaming.set(agentKey, ev.message.id);
+        // The step's own first response has begun: its prompt is in the
+        // cache now, so siblings held back to read it may start.
+        if (!agentKey && !saidResponding) {
+          saidResponding = true;
+          emit("info", "", { responding: true });
+        }
+      }
+      if (ev?.type === "message_delta") {
+        const id = streaming.get(agentKey);
+        if (id) {
+          finals.set(id, {
+            ...(typeof ev.usage?.output_tokens === "number" ? { output: ev.usage.output_tokens } : {}),
+            ...(ev.delta?.stop_reason ? { stop: ev.delta.stop_reason } : {}),
+          });
+          const span = spans.get(id);
+          if (span) {
+            const final = withFinal(span);
+            spans.set(id, final);
+            emit("info", "", { turn: final });
+          }
+        }
+      }
+      continue;
+    }
     if (ended) break;
     if (message.type === "assistant") {
-      const m = message.message as unknown as { id?: string; usage?: Record<string, number | undefined> };
+      const m = message.message as unknown as { id?: string; model?: string; stop_reason?: string | null; usage?: Record<string, number | undefined>; content?: { type?: string }[] };
       const u = m.usage;
-      if (u) turns.set(m.id ?? `turn-${anonymousTurns++}`, { u, price: priceOf(message) });
+      const turnKey = m.id ?? `turn-${anonymousTurns++}`;
+      if (u) turns.set(turnKey, { u, price: priceOf(message) });
+      if (opts.capture && u) {
+        const t = usageFromSdk(u);
+        const prior = spans.get(turnKey);
+        const span: ModelCall = {
+          id: turnKey,
+          n: prior?.n ?? spans.size + 1,
+          at: prior?.at ?? new Date().toISOString(),
+          ms: prior?.ms ?? Date.now() - sentAt(subagentOf(message)),
+          ...(m.model ? { model: m.model } : prior?.model ? { model: prior.model } : {}),
+          ...(m.stop_reason ? { stop: m.stop_reason } : prior?.stop ? { stop: prior.stop } : {}),
+          tokens: { input: t.inputTokens, output: t.outputTokens, cacheRead: t.cacheReadTokens, cacheWrite: t.cacheWriteTokens },
+          tools: (prior?.tools ?? 0) + (m.content ?? []).filter((b) => b?.type === "tool_use").length,
+          ...(subagentOf(message) ? { subagent: subagentOf(message)! } : {}),
+        };
+        const final = withFinal(span);
+        spans.set(turnKey, final);
+        emit("info", "", { turn: final });
+      }
       if (ceiling && u) {
         spentUsd = turnsTotal();
         if (spentUsd >= ceiling) {
@@ -731,13 +857,21 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
             const input = block.input as { subagent_type?: unknown; description?: unknown; prompt?: unknown } | undefined;
             const to = String(input?.subagent_type ?? "subagent");
             delegations.set(block.id, to);
+            // That sub-agent's first model call is timed from its job going out.
+            lastInputAt.set(to, Date.now());
             // One line a person can read: who got the job, and what it was.
             const job = String(input?.description ?? input?.prompt ?? "").replace(/\s+/g, " ").trim().slice(0, 160);
             emit("info", `delegating to ${to}${job ? `: ${job}` : ""}`, { subagent: to });
           }
           openCalls.set(block.id, { name: block.name, at: Date.now(), ...(via ? { subagent: via } : {}) });
           if (pod) ledger.set(block.id, classifyCall(block.name, block.input as Record<string, unknown> | undefined, pod));
-          emit("tool", block.name, { call: block.id, ...(via ? { subagent: via } : {}) });
+          const input = opts.capture === "full" ? capped(JSON.stringify(block.input ?? {})) : null;
+          emit("tool", block.name, {
+            call: block.id,
+            ...(opts.capture ? { inCall: turnKey } : {}),
+            ...(via ? { subagent: via } : {}),
+            ...(input ? { io: { input: input.text, inputChars: input.chars, ...(input.truncated ? { truncated: true } : {}) } } : {}),
+          });
         }
       }
     } else if (message.type === "user") {
@@ -750,6 +884,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
           const open = openCalls.get(block.tool_use_id);
           if (!open) continue;
           openCalls.delete(block.tool_use_id);
+          const output = opts.capture === "full" ? capped(toolResultText(block.content)) : null;
           emit("tool", open.name, {
             call: block.tool_use_id,
             ms: Date.now() - open.at,
@@ -758,6 +893,7 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
             bytes: toolResultText(block.content).length,
             ...(block.is_error ? { err: true } : {}),
             ...(open.subagent ? { subagent: open.subagent } : {}),
+            ...(output ? { io: { output: output.text, outputChars: output.chars, ...(output.truncated ? { truncated: true } : {}) } } : {}),
           });
           // Why it failed, on the trail. The span above carried only `err`,
           // so a refused call left the agent's own guess as the only account
@@ -769,6 +905,8 @@ async function executeStepInner(opts: ExecOptions, runQuery: QueryFn): Promise<E
           }
           readPod(block.tool_use_id);
         }
+        // That agent's next model call is timed from here: the results went back.
+        lastInputAt.set(subagentOf(message) ?? "", Date.now());
       }
     } else if (message.type === "result") {
       status = message.subtype === "success" ? "completed" : "failed";