@polymorphism-tech/morph-spec 8.19.0 → 8.21.0

package/src/commands/observability/cost.js

@@ -1,16 +1,26 @@
 /**
- * `morph-spec cost [feature] [--by task|phase] [--json]`
+ * `morph-spec cost [feature] [--by task|phase] [--all-trees] [--json]`
  *
  * A cost-facing view over the same harness event stream `telemetry` reads
  * (.morph/logs/events.jsonl): how much wall-clock time was spent inside
  * measured tasks (TaskStart→TaskEnd), how many context bytes were
  * re-ingested (grouped by kind: rubric/standard/skill/agents/plan-artifact/
  * code), and how many sub-agent dispatches happened (with total prompt
- * chars).
+ * chars). When the stream has `SessionUsage` events (real, hook-observed
+ * token counts), those are summed and shown too — see the sessionUsage
+ * caveat below.
  *
  * IMPORTANT: bytes re-ingested is a DETERMINISTIC PROXY for cost, not a
  * token count. Hooks only see what tools read off disk — never the model's
  * actual token usage — so this measures re-ingestion pressure, not spend.
+ * `sessionUsage` (when present) is the exception: real tokens, observed
+ * directly, not a proxy — see aggregateCost's docstring for the contract.
+ *
+ * `--all-trees` (Furo 3) widens the source from "just the current tree" to
+ * every git worktree that has its own events.jsonl — a fleet running N
+ * features in N worktrees otherwise only ever sees whichever tree `cost` was
+ * run from. Reuses the same worktree enumeration `doctor --worktrees`/`fleet`
+ * use (see loadTelemetryAllTrees in telemetry-reader.js).
  *
  * Read-only, always exits 0 on a normal (even empty) run — fail-open, an
  * empty stream is an answer, not an error. Only `--by` with an unknown value
@@ -18,7 +28,7 @@
  */
 
 import chalk from 'chalk';
-import { loadTelemetry, aggregateCost } from '../../lib/telemetry/telemetry-reader.js';
+import { loadTelemetry, loadTelemetryAllTrees, aggregateCost } from '../../lib/telemetry/telemetry-reader.js';
 
 const BYTES_CAVEAT =
   'Bytes re-ingeridos são um PROXY determinístico de custo (o que as ferramentas leram do disco) — NÃO são tokens reais. Hooks não enxergam o uso real de tokens do modelo.';
@@ -77,6 +87,19 @@ function printPhases(phases) {
   }
 }
 
+/**
+ * Real (hook-observed) token counts, when the stream has `SessionUsage`
+ * events — the non-proxy sibling of the bytes-re-ingested numbers above.
+ * No-op when absent (aggregateCost returns `null`, never a zeroed object).
+ */
+function printSessionUsage(sessionUsage) {
+  if (!sessionUsage) return;
+  console.log('\n' + chalk.white.bold('Tokens reais (sessões observadas)')
+    + chalk.gray(` · ${sessionUsage.sessions} SessionUsage`));
+  console.log(`  input=${sessionUsage.inputTokens}  output=${sessionUsage.outputTokens}  `
+    + `cacheRead=${sessionUsage.cacheReadTokens}  cacheCreation=${sessionUsage.cacheCreationTokens}`);
+}
+
 function printSummary(summary) {
   console.log(`\n  duração dentro de tasks medidas: ${fmtDuration(summary.taskDurationSeconds)}`);
   console.log(`  dispatches: ${summary.dispatches.count} (${summary.dispatches.promptChars} chars de prompt)`);
@@ -88,11 +111,67 @@ function printSummary(summary) {
     console.log('\n' + chalk.white.bold('Mix de tools'));
     for (const t of summary.tools) console.log(`  ${t.name.padEnd(16)} ${t.count}`);
   }
+
+  printSessionUsage(summary.sessionUsage);
+}
+
+/**
+ * `--all-trees` rendering: a short line per tree (so a fleet operator can
+ * spot which tree is expensive) followed by the COMBINED aggregate — full
+ * detail (task/phase breakdown honors `--by` here too, same as the
+ * single-tree path; a typeable flag combination is never a silent no-op).
+ *
+ * @param {string} [feature]
+ * @param {{ json?: boolean, by?: 'task'|'phase' }} options
+ * @param {string} cwd
+ */
+function printAllTrees(feature, options, cwd) {
+  const treesData = loadTelemetryAllTrees(cwd);
+  const perTree = treesData.map(({ tree, path, events }) => ({
+    tree,
+    path,
+    ...aggregateCost(events, { feature }),
+  }));
+  const combined = aggregateCost(treesData.flatMap((t) => t.events), { feature });
+
+  if (options.json) {
+    console.log(JSON.stringify({ allTrees: true, trees: perTree, combined }));
+    return;
+  }
+
+  if (combined.total === 0) {
+    const scope = feature ? ` para a feature "${feature}"` : '';
+    console.log(chalk.gray(`Telemetria vazia${scope} em todas as árvores — nenhuma tem eventos capturados ainda.`));
+    return;
+  }
+
+  console.log(chalk.white.bold(
+    `Custo do harness (proxy determinística) — todas as árvores (${perTree.length} com eventos, ${combined.total} eventos no total)`
+  ));
+  console.log(chalk.gray(`⚠ ${BYTES_CAVEAT}`));
+
+  for (const t of perTree) {
+    console.log('\n' + chalk.cyan.bold(`── Árvore: ${t.tree}`) + chalk.gray(` — ${t.path}`));
+    console.log(`   ${t.total} eventos · duração em tasks: ${fmtDuration(t.taskDurationSeconds)} · `
+      + `bytes: ${fmtBytes(t.bytesTotal)} · dispatches: ${t.dispatches.count}`);
+  }
+
+  console.log('\n' + chalk.white.bold('── Total agregado (todas as árvores)'));
+  if (combined.features.length) {
+    console.log(chalk.gray(`Features: ${combined.features.join(', ')}`));
+  }
+  if (options.by === 'task') {
+    printTasks(combined.tasks);
+  } else if (options.by === 'phase') {
+    printPhases(combined.phases);
+  } else {
+    printSummary(combined);
+  }
 }
 
 /**
  * @param {string} [feature] - narrow to a single feature
- * @param {{ json?: boolean, by?: 'task'|'phase', cwd?: string }} [options]
+ * @param {{ json?: boolean, by?: 'task'|'phase', allTrees?: boolean, cwd?: string }} [options]
  */
 export function costCommand(feature, options = {}) {
   if (options.by && !BY_MODES.includes(options.by)) {
@@ -102,7 +181,16 @@ export function costCommand(feature, options = {}) {
     return;
   }
 
-  const events = loadTelemetry(options.cwd || process.cwd());
+  const cwd = options.cwd || process.cwd();
+
+  if (options.allTrees) {
+    // Same fail-open + Windows-flush discipline as the single-tree path
+    // below — no forced process.exit(), --json included.
+    printAllTrees(feature, options, cwd);
+    return;
+  }
+
+  const events = loadTelemetry(cwd);
   const summary = aggregateCost(events, { feature });
 
   if (options.json) {

package/src/commands/project/update.js

@@ -24,8 +24,7 @@ import {
   checkProjectOutdated,
   saveProjectMorphVersion,
   getUpdateInstructions,
-  detectInstallMethod,
-  compareVersions
+  detectInstallMethod
 } from '../../utils/version-checker.js';
 import { installClaudeHooks, installGlobalStatusline } from '../../utils/claude-settings-manager.js';
 import { installSkills } from '../../utils/skills-installer.js';
@@ -33,6 +32,7 @@ import { installAgents, installDomainAgents } from '../../utils/agents-installer
 import { injectMorphImport } from '../../utils/claude-md-injector.js';
 import { getProjectTags } from '../../lib/stack-filter.js';
 import { updateClaudeMdAgentsBlock, installRulesForStack } from '../../scripts/setup-infra.js';
+import { reconcileLegacyTemplatesCopy } from '../../lib/installers/templates-reconcile.js';
 
 /**
  * Backup user's config.json before cleaning
@@ -89,67 +89,6 @@ async function cleanFrameworkDirs(morphPath, targetPath) {
   }
 }
 
-/**
- * Last CLI version whose `update`/`setup-infra` still wrote
- * `.morph/framework/templates/` unconditionally, before Task 2 of the R3
- * perf plan removed that copy. Used as the decision boundary in
- * `reconcileLegacyTemplatesCopy` below — see its doc comment for why a
- * version check is used instead of diffing file content.
- */
-const LAST_VERSION_THAT_COPIED_TEMPLATES = '8.17.0';
-
-/**
- * Reconcile a pre-existing `.morph/framework/templates/` copy now that
- * `update` no longer writes it (Task 2, R3 perf plan — resolution falls
- * back to the npm package's own framework/templates/, see
- * template-registry.js / architecture-scanner.js's layered resolver).
- *
- * Decided from the project's PRIOR recorded CLI version (before THIS
- * update writes a new one), not by diffing content against the package.
- * A content diff can't tell "stale copy from an older CLI version" apart
- * from "deliberate user override" — and staleness is the dominant case for
- * anyone who actually runs `update`, since template content does change
- * between releases. The version boundary is unambiguous instead:
- *
- *   - No local copy → nothing to do.
- *   - Prior version is unrecorded, OR <= LAST_VERSION_THAT_COPIED_TEMPLATES
- *     → the copy could ONLY have been put there by the OLD installer:
- *     `.morph/framework/**` is Edit-denied to the agent (MORPH_DENY in
- *     hooks-installer.js — "installer-managed, immutable at runtime"),
- *     the directory is gitignored, and every `update` before this fix
- *     unconditionally wiped + recopied it. There is no path by which a
- *     project on an old version could have a genuine override sitting
- *     here. Safe to delete unconditionally — it is dead weight, not data.
- *   - Prior version > LAST_VERSION_THAT_COPIED_TEMPLATES → `update` and
- *     `setup-infra` have never written this directory for this project.
- *     Anything found here was placed deliberately (by the user or other
- *     tooling) — this is the forward-looking override use case the
- *     layered resolver exists for. Preserve untouched, unconditionally,
- *     with no diffing.
- *
- * @param {string} templatesDest - .morph/framework/templates (may not exist)
- * @param {string|null} priorProjectVersion - project's recorded morph-spec
- *   version BEFORE this update run (checkProjectOutdated().current)
- * @returns {'absent'|'removed-legacy'|'preserved-override'}
- */
-export function reconcileLegacyTemplatesCopy(templatesDest, priorProjectVersion) {
-  if (!existsSync(templatesDest)) return 'absent';
-
-  const isLegacy = !priorProjectVersion
-    || compareVersions(priorProjectVersion, LAST_VERSION_THAT_COPIED_TEMPLATES) <= 0;
-
-  if (!isLegacy) return 'preserved-override';
-
-  try {
-    fs.removeSync(templatesDest);
-    return 'removed-legacy';
-  } catch {
-    // Couldn't remove — don't risk a half-broken state; leave it and let
-    // the layered resolver's override-first check pick it up as before.
-    return 'preserved-override';
-  }
-}
-
 /**
  * Restore user's config.json after reinstallation
  * @param {string} morphPath - Path to .morph directory

package/src/commands/state/gate-check.js

@@ -87,9 +87,12 @@ function evaluatorCompositeScore(cwd, featureName) {
  * never had (it shipped fully tested with zero callers; see the R4 report).
  *
  * `verificationStatus` feeds a real pause rule (verify vermelho pausa —
- * política adicionada em risk-detector.js no fecho do R4); `verification`
- * completo, verificationStale, diffstat e sha seguem como contexto de
- * auditoria persistido, sem regra própria.
+ * política adicionada em risk-detector.js no fecho do R4, qualquer gate).
+ * `verificationStale` também alimenta uma regra própria, mas só no ship
+ * (`gate === 'review'`) — sha do stamp divergindo do HEAD atual. `gate` em si
+ * é o que permite risk-detector.js diferenciar as duas. `verification`
+ * completo, diffstat e sha seguem como contexto de auditoria persistido, sem
+ * regra própria.
  *
  * @param {string} featureName
  * @param {object} feature
@@ -104,6 +107,10 @@ function collectSignals(featureName, feature, cwd, gateName) {
   const verification = feature.verification || null;
 
   const signals = {
+    // Furo 2: disk-derived, never in OVERRIDABLE_SIGNAL_KEYS — a caller
+    // cannot spoof which gate risk-detector.js thinks it is deciding, same
+    // anti-spoof rationale as workType (hotfix's forced pause).
+    gate: gateName,
     workType: feature.workType || 'feature',
     taskCount: tasks.length,
     standardsViolations: [],

package/src/core/templates/template-registry.js

@@ -171,34 +171,6 @@ export function searchTemplates(keyword, projectPath = null) {
   });
 }
 
-/**
- * Get template absolute path with fallback logic.
- *
- * Resolution order:
- *   1. Project-local override (.morph/framework/templates/{path})
- *   2. Framework universal template (framework/templates/{path})
- *
- * @param {string} templateId - Template identifier
- * @param {string} projectPath - Project root path
- * @returns {string|null} Absolute template path or null if not found
- */
-export function resolveTemplatePathById(templateId, projectPath) {
-  const template = getTemplateById(templateId, projectPath);
-  if (!template) {
-    return null;
-  }
-
-  // 1. Project-local override
-  const projectLocalPath = join(projectPath, '.morph/framework/templates', template.path);
-  if (existsSync(projectLocalPath)) {
-    return projectLocalPath;
-  }
-
-  // 2. Framework universal template
-  const frameworkPath = join(projectPath, 'framework/templates', template.path);
-  return existsSync(frameworkPath) ? frameworkPath : null;
-}
-
 /** Absolute path of this repo's own framework/templates/ directory. */
 const FRAMEWORK_TEMPLATES_DIR = join(__dirname, '../../../framework/templates');
 
@@ -206,8 +178,8 @@ const FRAMEWORK_TEMPLATES_DIR = join(__dirname, '../../../framework/templates');
  * Resolve a template id to its absolute path inside THIS framework repo's
  * `framework/templates/` directory — for generators running against the
  * framework itself (scaffold-generator, context-generator), not against an
- * installed `.morph/`. Use resolveTemplatePathById() when a project root and
- * its project-local overrides are in play.
+ * installed `.morph/`. Use architecture-scanner.js's `resolveTemplatePath()`
+ * when a project root and its project-local overrides are in play.
  *
  * @param {string} templateId - Template identifier (REGISTRY.json `id`)
  * @returns {string} Absolute path to the template file

package/src/lib/git/default-branch.js

@@ -112,26 +112,62 @@ function parseShortstat(text) {
   };
 }
 
+/**
+ * Count brand-new UNTRACKED files (never `git add`-ed) — the gap plain
+ * `git diff --shortstat` never sees, tracked-edits-only by design. Fail-open:
+ * any error (not a repo, git missing) reads as 0 untracked, never throws —
+ * this must not take down the whole `getDiffStat` result over a probe that
+ * is secondary to the diff itself.
+ *
+ * `--exclude-standard` matches gitignore the same way `git status` does, so
+ * scratch/build output never inflates the count.
+ *
+ * @param {string} cwd
+ * @returns {number}
+ */
+function countUntrackedFiles(cwd) {
+  try {
+    const out = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd, stdio: 'pipe' })
+      .toString();
+    return out.split('\n').filter((l) => l.trim()).length;
+  } catch {
+    return 0;
+  }
+}
+
 /**
  * `git diff --shortstat <baseRef>` against the CURRENT WORKING TREE (tracked
  * edits — staged, unstaged, and everything committed since baseRef —
  * deliberately not `baseRef...HEAD`, so a gate-check mid-implement still sees
- * uncommitted work). Same as plain `git diff`, this does NOT count brand-new
- * UNTRACKED files (never `git add`-ed) — a real, known gap if a gate check
- * runs before `git add`; not fixed here since covering it needs `--no-index`
- * or `git add -N` bookkeeping this shared helper doesn't own. Fail-open: null
- * when `baseRef` is falsy, cwd isn't a git repo, or the diff itself fails
- * (e.g. baseRef doesn't resolve).
+ * uncommitted work), PLUS a count of brand-new UNTRACKED files (never
+ * `git add`-ed) that plain `git diff` never shows regardless of commit vs
+ * working tree. `filesChanged` is the combined total (tracked-changed +
+ * untracked) so a caller reading just that one number gets the true scope of
+ * what changed; `untrackedFiles` is broken out separately so a caller that
+ * cares CAN tell diff-vs-new apart instead of the two being silently fused.
+ *
+ * Both git calls run with the same `cwd` — every current caller passes a
+ * feature/worktree root there, so `git diff`'s repo-wide default and
+ * `git ls-files`'s cwd-relative listing agree; a caller passing a
+ * sub-directory as `cwd` would see `untrackedFiles` scoped to that
+ * sub-directory while `insertions`/`deletions` stay repo-wide — not a
+ * concern today, but worth knowing if that assumption ever changes.
+ *
+ * Fail-open: null when `baseRef` is falsy, cwd isn't a git repo, or the diff
+ * itself fails (e.g. baseRef doesn't resolve). The untracked probe fails open
+ * on its own (see countUntrackedFiles) and never turns a good diff into null.
  *
  * @param {string|null} baseRef - typically `detectDefaultBranch(cwd)`
  * @param {string} [cwd]
- * @returns {{ filesChanged: number, insertions: number, deletions: number }|null}
+ * @returns {{ filesChanged: number, insertions: number, deletions: number, untrackedFiles: number }|null}
  */
 export function getDiffStat(baseRef, cwd = process.cwd()) {
   if (!baseRef) return null;
   try {
     const out = execFileSync('git', ['diff', '--shortstat', baseRef], { cwd, stdio: 'pipe' }).toString().trim();
-    return parseShortstat(out);
+    const stat = parseShortstat(out);
+    const untrackedFiles = countUntrackedFiles(cwd);
+    return { ...stat, filesChanged: stat.filesChanged + untrackedFiles, untrackedFiles };
   } catch {
     return null;
   }

package/src/lib/installers/templates-reconcile.js

@@ -0,0 +1,81 @@
+/**
+ * templates-reconcile.js — reconcile a pre-existing `.morph/framework/templates/`
+ * copy against the project's prior recorded morph-spec version.
+ *
+ * Shared by BOTH install paths that can encounter this directory:
+ *   - `morph-spec update` (src/commands/project/update.js) — always knows the
+ *     project's prior version (`checkProjectOutdated().current`, read from
+ *     `.morph/.morphversion` BEFORE this run overwrites it).
+ *   - `morph-spec init`/`setup-infra` (src/scripts/setup-infra.js) — the SAME
+ *     source (`getProjectMorphVersion()`, the function `checkProjectOutdated`
+ *     itself calls), read at the same point in the run (before its own write
+ *     of `.morph/.morphversion`), when it's available — e.g. a repair run
+ *     over an already-initialized project. Falls back to a plain warning when
+ *     it isn't (a project with no recorded version has nothing here for this
+ *     function to reconcile against safely).
+ */
+
+import { existsSync } from 'fs';
+import fs from 'fs-extra';
+import { compareVersions } from '../../utils/version-checker.js';
+
+/**
+ * Last CLI version whose `update`/`setup-infra` still wrote
+ * `.morph/framework/templates/` unconditionally, before Task 2 of the R3
+ * perf plan removed that copy. Used as the decision boundary in
+ * `reconcileLegacyTemplatesCopy` below — see its doc comment for why a
+ * version check is used instead of diffing file content.
+ */
+export const LAST_VERSION_THAT_COPIED_TEMPLATES = '8.17.0';
+
+/**
+ * Reconcile a pre-existing `.morph/framework/templates/` copy now that
+ * neither install path unconditionally writes it anymore (Task 2, R3 perf
+ * plan — resolution falls back to the npm package's own framework/templates/,
+ * see template-registry.js / architecture-scanner.js's layered resolver).
+ *
+ * Decided from the project's PRIOR recorded CLI version (before THIS run
+ * writes a new one), not by diffing content against the package. A content
+ * diff can't tell "stale copy from an older CLI version" apart from
+ * "deliberate user override" — and staleness is the dominant case for
+ * anyone who actually runs `update`/`setup-infra` again, since template
+ * content does change between releases. The version boundary is unambiguous
+ * instead:
+ *
+ *   - No local copy → nothing to do.
+ *   - Prior version is unrecorded, OR <= LAST_VERSION_THAT_COPIED_TEMPLATES
+ *     → the copy could ONLY have been put there by the OLD installer:
+ *     `.morph/framework/**` is Edit-denied to the agent (MORPH_DENY in
+ *     hooks-installer.js — "installer-managed, immutable at runtime"),
+ *     the directory is gitignored, and every install/update before this fix
+ *     unconditionally wiped + recopied it. There is no path by which a
+ *     project on an old version could have a genuine override sitting
+ *     here. Safe to delete unconditionally — it is dead weight, not data.
+ *   - Prior version > LAST_VERSION_THAT_COPIED_TEMPLATES → this install path
+ *     has never written this directory for this project. Anything found
+ *     here was placed deliberately (by the user or other tooling) — this is
+ *     the forward-looking override use case the layered resolver exists
+ *     for. Preserve untouched, unconditionally, with no diffing.
+ *
+ * @param {string} templatesDest - .morph/framework/templates (may not exist)
+ * @param {string|null} priorProjectVersion - project's recorded morph-spec
+ *   version BEFORE this run (e.g. `checkProjectOutdated().current`)
+ * @returns {'absent'|'removed-legacy'|'preserved-override'}
+ */
+export function reconcileLegacyTemplatesCopy(templatesDest, priorProjectVersion) {
+  if (!existsSync(templatesDest)) return 'absent';
+
+  const isLegacy = !priorProjectVersion
+    || compareVersions(priorProjectVersion, LAST_VERSION_THAT_COPIED_TEMPLATES) <= 0;
+
+  if (!isLegacy) return 'preserved-override';
+
+  try {
+    fs.removeSync(templatesDest);
+    return 'removed-legacy';
+  } catch {
+    // Couldn't remove — don't risk a half-broken state; leave it and let
+    // the layered resolver's override-first check pick it up as before.
+    return 'preserved-override';
+  }
+}

package/src/lib/risk-detector.js

@@ -8,7 +8,9 @@
  * Signals checked (in order):
  *   - designSystemDivergence: boolean — conflicting design sources detected
  *   - standardsViolations: string[]   — violations of mandate.md proibições
- *   - verificationStatus: string      — último `morph-spec verify` ('fail' pausa)
+ *   - verificationStatus: string      — último `morph-spec verify` ('fail' pausa, qualquer gate)
+ *   - verificationStale + gate: bool/str — stamp com sha != HEAD pausa SÓ no
+ *     ship (gate 'review') — código mudou depois do último verify
  *   - evalScore: number               — morph-eval score (pause if < 9)
  *   - taskCount: number               — total tasks (pause if > 20)
  */
@@ -64,6 +66,20 @@ export function shouldPauseGate(config, signals) {
     };
   }
 
+  // Furo 2: no gate de SHIP (review) apenas, um stamp de verification cujo
+  // sha diverge do HEAD atual significa que código mudou depois do último
+  // `morph-spec verify` — o resultado carimbado não cobre mais o que está
+  // prestes a ser aprovado. Pausa só aqui, nunca em plan/uiux/proposal: essa
+  // é uma regra de ship, não uma regra geral de gate. Stamp AUSENTE não entra
+  // aqui (verificationStale é fail-open para `false` em collectSignals
+  // quando não há stamp) — features legadas sem stamp continuam liberadas.
+  if (signals.gate === 'review' && signals.verificationStale === true) {
+    return {
+      pause: true,
+      reason: 'verification stamp desatualizado (sha difere do HEAD) — rode `morph-spec verify` de novo antes do ship',
+    };
+  }
+
   if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
     return {
       pause: true,
@@ -93,6 +109,9 @@ export function getRiskSignals(signals) {
     out.push(`standards violations: ${signals.standardsViolations.join(', ')}`);
   }
   if (signals.verificationStatus === 'fail') out.push('verify vermelho');
+  if (signals.gate === 'review' && signals.verificationStale === true) {
+    out.push('verification stamp desatualizado (stale) no ship');
+  }
   if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
     out.push(`eval score ${signals.evalScore}/10`);
   }

package/src/lib/telemetry/telemetry-reader.js

@@ -10,7 +10,8 @@
  */
 
 import { readFileSync, existsSync } from 'fs';
-import { join } from 'path';
+import { join, basename } from 'path';
+import { parseWorktreeList, resolvePrimaryRoot } from '../../commands/project/worktree.js';
 
 const EVENTS_FILE = join('.morph', 'logs', 'events.jsonl');
 
@@ -37,6 +38,45 @@ export function loadTelemetry(projectPath) {
   }
 }
 
+/**
+ * Enumerate every git worktree that has its OWN `.morph/logs/events.jsonl` —
+ * the data source for `cost --all-trees` (Furo 3). Reuses the SAME worktree
+ * enumeration `doctor --worktrees`/`fleet` already use (`parseWorktreeList` +
+ * `resolvePrimaryRoot` from commands/project/worktree.js — see
+ * src/lib/worktree/fleet-scanner.js and worktree-audit.js for the sibling
+ * consumers) instead of re-walking `git worktree list` here.
+ *
+ * `git worktree list --porcelain` always lists the PRIMARY worktree first —
+ * that entry is labeled `'root'`; every other entry is labeled by its
+ * directory basename (typically the feature slug, e.g. `worktrees/{f}` →
+ * `f`). Only trees whose events.jsonl actually exists are returned — a
+ * worktree that never ran the harness contributes nothing, silently.
+ *
+ * Fail-open, like `loadTelemetry`: outside a git repo (or on any git error)
+ * `resolvePrimaryRoot`/`parseWorktreeList` degrade to a single root entry —
+ * never throws.
+ *
+ * @param {string} [cwd]
+ * @returns {Array<{ tree: string, path: string, events: Object[] }>}
+ */
+export function loadTelemetryAllTrees(cwd = process.cwd()) {
+  const root = resolvePrimaryRoot(cwd);
+  const entries = parseWorktreeList(root);
+  const trees = entries.length ? entries : [{ path: root }];
+
+  const out = [];
+  for (const t of trees) {
+    const eventsPath = join(t.path, EVENTS_FILE);
+    if (!existsSync(eventsPath)) continue;
+    out.push({
+      tree: t.path === root ? 'root' : basename(t.path),
+      path: t.path,
+      events: loadTelemetry(t.path),
+    });
+  }
+  return out;
+}
+
 function rank(map) {
   return [...map.entries()]
     .map(([name, count]) => ({ name, count }))
@@ -211,6 +251,26 @@ function finalizeTask(state) {
  * check) — today only Read events carry `bytes`, but this stays correct if
  * that widens rather than reporting a silent 0.
  *
+ * Dispatch prompt size (Furo 3 — contract with the hooks-side telemetry-log
+ * rewrite): a dispatch event's `prompt` field is now TRUNCATED to 2k chars on
+ * write, with the original length carried separately as `promptChars`. When
+ * `promptChars` (a number) is present it is preferred; a legacy stream that
+ * only ever had the untruncated `prompt` string falls back to
+ * `prompt.length`, unchanged from before — every existing byte count stays
+ * exact against old logs.
+ *
+ * SessionUsage events (`{ event: 'SessionUsage', inputTokens, outputTokens,
+ * cacheReadTokens, cacheCreationTokens }`) are a session-level rollup, not a
+ * per-tool event — they don't touch toolCounts/bytesByKind/dispatches, only
+ * sum into `sessionUsage` (real, hook-observed token counts — NOT the bytes
+ * proxy). They participate in the `--feature` filter exactly like every
+ * other event (via `scoped`, computed once at the top): a rollup with no
+ * `feature` field is silently excluded by a feature-scoped call, same as any
+ * other feature-less event would be — no special-casing. `sessionUsage` is
+ * `null` when the stream carries none (nothing to show), never a zeroed
+ * object, so a caller can tell "observed, all zero" apart from "never
+ * observed" the same way `evalScore` does in gate-check's signals.
+ *
  * @param {Object[]} events - raw events (from loadTelemetry)
  * @param {{ feature?: string }} [opts] - optional feature filter
  * @returns {{
@@ -220,11 +280,14 @@ function finalizeTask(state) {
  *   bytesByKind: Object<string, number>,
  *   bytesTotal: number,
  *   dispatches: {count:number, promptChars:number},
+ *   sessionUsage: {inputTokens:number, outputTokens:number, cacheReadTokens:number, cacheCreationTokens:number, sessions:number}|null,
  *   tools: Array<{name:string,count:number}>,
  *   tasks: Array<Object>,
  *   phases: Array<{phase:string, bytesByKind:Object<string,number>, bytesTotal:number}>,
  * }}
  */
+const SESSION_USAGE_KEYS = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheCreationTokens'];
+
 export function aggregateCost(events, opts = {}) {
   const scoped = opts.feature
     ? (events || []).filter(e => e.feature === opts.feature)
@@ -237,6 +300,8 @@ export function aggregateCost(events, opts = {}) {
   const phaseBytes = new Map(); // phase -> Map(kind -> bytes)
   const activeByFeature = new Map(); // featureKey -> open task state
   const tasks = [];
+  const sessionUsageTotals = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0 };
+  let sessionUsageCount = 0;
 
   for (const e of scoped) {
     if (!e || typeof e !== 'object') continue;
@@ -260,6 +325,14 @@ export function aggregateCost(events, opts = {}) {
       continue;
     }
 
+    if (e.event === 'SessionUsage') {
+      sessionUsageCount += 1;
+      for (const key of SESSION_USAGE_KEYS) {
+        if (typeof e[key] === 'number' && Number.isFinite(e[key])) sessionUsageTotals[key] += e[key];
+      }
+      continue;
+    }
+
     if (e.tool) toolCounts.set(e.tool, (toolCounts.get(e.tool) || 0) + 1);
     const active = activeByFeature.get(featureKey(e));
     if (active && e.tool) {
@@ -277,12 +350,14 @@ export function aggregateCost(events, opts = {}) {
       }
     }
 
-    if ((e.tool === 'Agent' || e.tool === 'Task') && typeof e.prompt === 'string' && e.prompt) {
+    const hasPromptChars = typeof e.promptChars === 'number' && Number.isFinite(e.promptChars);
+    if ((e.tool === 'Agent' || e.tool === 'Task') && (hasPromptChars || (typeof e.prompt === 'string' && e.prompt))) {
+      const chars = hasPromptChars ? e.promptChars : e.prompt.length;
       dispatches.count += 1;
-      dispatches.promptChars += e.prompt.length;
+      dispatches.promptChars += chars;
       if (active) {
         active.dispatches.count += 1;
-        active.dispatches.promptChars += e.prompt.length;
+        active.dispatches.promptChars += chars;
       }
     }
   }
@@ -309,6 +384,7 @@ export function aggregateCost(events, opts = {}) {
     bytesByKind: mapToObj(bytesByKindGlobal),
     bytesTotal: sumValues(bytesByKindGlobal),
     dispatches,
+    sessionUsage: sessionUsageCount > 0 ? { ...sessionUsageTotals, sessions: sessionUsageCount } : null,
     tools: rank(toolCounts),
     tasks,
     phases,