@wardby/cli 0.8.0 → 0.9.0

package/dist/mcp/tools/agents.js

@@ -7,6 +7,7 @@
  */
 import { Prisma } from "#prisma";
 import { z } from "zod";
+import { RUN_STEPS_LEVELS, loadRunStepsLevel, runStepsAboveCeilingWarning, } from "../../core/run-steps/config.js";
 import { codeProviderOf } from "../../coding/code-host.js";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
 import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
@@ -124,6 +125,27 @@ function withProfileWarnings(agent) {
     const warnings = profileWarnings(profile, now);
     return warnings.length ? { ...shown, warnings } : shown;
 }
+// No JSON-schema enum on purpose: the zod check then refuses a bad value naming off, summary and detail.
+const RUN_STEPS_DESCRIPTION = "Run steps level for this agent's runs (owner only): off records nothing, summary one line per tool call or message " +
+    "(the default), detail also the tool input, the end of each tool's output and the model's text, readable only by the " +
+    "agent's owner and the run's starter. A run records the lower of this and the instance's WARDBY_RUN_STEPS, fixed " +
+    "when it starts. detail stores tool output: secrets the run was given are removed, but a secret that exists only in " +
+    "a file the run read can remain. Null clears it (summary).";
+/** For a warning only: an invalid WARDBY_RUN_STEPS stopped start-up already; never fails the tool call. */
+function runStepsCeiling() {
+    try {
+        return loadRunStepsLevel(process.env);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** An agent as returned to operators: a warning when its runSteps is above the instance's ceiling. */
+function withRunStepsWarning(agent) {
+    const ceiling = runStepsCeiling();
+    const warning = ceiling ? runStepsAboveCeilingWarning(agent.runSteps, ceiling) : undefined;
+    return warning ? { ...agent, warnings: [...(agent.warnings ?? []), warning] } : agent;
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
@@ -140,6 +162,7 @@ const agentFields = {
     budgetGroupId: z.string().min(1).max(128),
     memoryEnabled: z.boolean(),
     effort: z.enum(LLM_EFFORT_LEVELS),
+    runSteps: z.enum(RUN_STEPS_LEVELS),
     nativeExecutionMode: z.enum(NATIVE_EXECUTION_MODES),
     defectProjectKey: z.string().regex(PROJECT_KEY, "must be an upper-case Jira project key"),
     defectIssueType: z.string().trim().min(1).max(100),
@@ -175,6 +198,7 @@ const CreateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.optional(),
     memoryEnabled: agentFields.memoryEnabled.default(false),
     effort: agentFields.effort.optional(),
+    runSteps: agentFields.runSteps.optional(),
     nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.optional(),
     defectIssueType: agentFields.defectIssueType.optional(),
@@ -233,6 +257,7 @@ const UpdateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.nullable().optional(),
     memoryEnabled: agentFields.memoryEnabled.optional(),
     effort: agentFields.effort.nullable().optional(),
+    runSteps: agentFields.runSteps.nullable().optional(),
     nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.nullable().optional(),
     defectIssueType: agentFields.defectIssueType.nullable().optional(),
@@ -510,6 +535,7 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS],
                     description: "Reasoning effort for native agents. Unset uses the provider default.",
                 },
+                runSteps: { type: "string", description: RUN_STEPS_DESCRIPTION },
                 nativeExecutionMode: {
                     type: "string",
                     enum: [...NATIVE_EXECUTION_MODES],
@@ -575,7 +601,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(withProfileWarnings(withOperatorMode(agent)));
+            return textResult(withRunStepsWarning(withProfileWarnings(withOperatorMode(agent))));
         },
     });
     mcp.registerTool({
@@ -616,6 +642,7 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS, null],
                     description: "Reasoning effort for native agents. Null clears it back to the provider default.",
                 },
+                runSteps: { type: ["string", "null"], description: RUN_STEPS_DESCRIPTION },
                 nativeExecutionMode: {
                     type: "string",
                     enum: [...NATIVE_EXECUTION_MODES],
@@ -730,12 +757,14 @@ export function registerAgentTools(mcp) {
             // and budget-group membership direct what runs do with the owner's
             // repository access and money: owner-only, like the repository itself
             // (review I1/M1/M6). Write keeps name, prompt, model, budget amount,
-            // turns, effort, memory and schedule.
+            // turns, effort, memory and schedule. The run steps level is the owner's too:
+            // detail records tool output that only the owner and the run's starter may read.
             const ownerOnlyChange = (existingKind) => args.codingProfile !== undefined ||
                 (args.kind !== undefined && args.kind !== existingKind) ||
-                args.budgetGroupId !== undefined;
+                args.budgetGroupId !== undefined ||
+                args.runSteps !== undefined;
             const refuseOwnerOnly = () => {
-                throw new McpError(403, `Agent "${args.id}": only its owner can change its coding profile, kind or budget group.`);
+                throw new McpError(403, `Agent "${args.id}": only its owner can change its coding profile, kind, budget group or run steps level.`);
             };
             if (!adminEdit && !isOwner && ownerOnlyChange(before.kind))
                 refuseOwnerOnly();
@@ -907,7 +936,7 @@ export function registerAgentTools(mcp) {
                     by: ctx.principal.id,
                 }, "coding package audit mode set");
             }
-            const shown = withProfileWarnings(withOperatorMode(agent));
+            const shown = withRunStepsWarning(withProfileWarnings(withOperatorMode(agent)));
             // Becoming Codex (a provider switch, or a native agent becoming coding) leaves out every attached
             // MCP tool the server doesn't mark read-only: say which, so the owner isn't surprised by a run.
             const wasCodex = before.kind === "coding" && isCodexCoding(before.codingProfile?.provider);
@@ -924,7 +953,7 @@ export function registerAgentTools(mcp) {
         name: "list_agents",
         scope: "agents:read",
         description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column. " +
-            "summary: true returns only id, name, kind, model, codingProvider, budgetUsd, ownerId and access per agent, for listings that don't need the full configuration. " +
+            "summary: true returns only id, name, kind, model, codingProvider, budgetUsd, ownerId, runSteps and access per agent, for listings that don't need the full configuration. " +
             "all: true lists every agent in the deployment (admins only, admin:view); an agent you have no grant on shows access `none`.",
         inputSchema: {
             type: "object",
@@ -948,6 +977,7 @@ export function registerAgentTools(mcp) {
                         model: true,
                         budgetUsd: true,
                         ownerId: true,
+                        runSteps: true,
                         codingProfile: { select: { provider: true } },
                     },
                     orderBy: { name: "asc" },
@@ -980,7 +1010,7 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...withProfileWarnings(withOperatorMode(agent)),
+                ...withRunStepsWarning(withProfileWarnings(withOperatorMode(agent))),
                 access,
                 mcpServers: await agentMcpServerViews(ctx.db, agent.id),
                 // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).

package/dist/mcp/tools/power.js

@@ -31,7 +31,7 @@ export function registerPowerTools(mcp) {
     mcp.registerTool({
         name: "power_status",
         scope: "power:manage",
-        description: "Admins (power:manage): low-power mode state. For the coding proxy and the native gateway: replicas, whether a ready endpoint exists, when it last woke (wokeAt), and blockers (run ids keeping it busy). Returns { enabled: false } when low-power mode is off.",
+        description: "Admins (power:manage): low-power mode state. For the coding proxy and the native gateway: replicas, whether a ready endpoint exists, when it last woke (wokeAt), and blockers (run ids keeping it busy; for the gateway: sandbox runs, coding runs with MCP tools and runs with an active gateway session). Returns { enabled: false } when low-power mode is off.",
         inputSchema: { type: "object", additionalProperties: false, properties: {} },
         handler: async (rawArgs, ctx) => {
             parse(StatusSchema, "power_status arguments", rawArgs);
@@ -41,7 +41,7 @@ export function registerPowerTools(mcp) {
     mcp.registerTool({
         name: "power_sleep",
         scope: "power:manage",
-        description: "Admins (power:manage): scale the coding proxy and/or native gateway to zero now, skipping low-power mode's idle window. It never stops a run: a target is refused while it has active or queued runs (for the gateway, also an active gateway session), and those run ids are returned under blocked. Recently finished runs do not block it. The next run wakes the target again. Fails (409 low_power_disabled) when low-power mode is off.",
+        description: "Admins (power:manage): scale the coding proxy and/or native gateway to zero now, skipping low-power mode's idle window. It never stops a run: a target is refused while it has active or queued runs (for the gateway: sandbox runs and coding runs with MCP tools, and also an active gateway session), and those run ids are returned under blocked. Recently finished runs do not block it. The next run wakes the target again. Fails (409 low_power_disabled) when low-power mode is off.",
         inputSchema: {
             type: "object",
             additionalProperties: false,

package/dist/mcp/tools/run-access.d.ts

@@ -12,5 +12,12 @@ export interface RunReader {
  * agent's owner (or the stdio operator). Read on the agent is not enough.
  */
 export declare function canReadRun(db: GrantDb & Pick<PrismaClient, "agent">, run: Pick<Run, "agentId" | "triggeredById">, reader: RunReader): Promise<boolean>;
+/**
+ * Detail text (the run steps' detail level): only the agent's owner, the run's starter, or the
+ * stdio operator. Today these are exactly canReadRun's readers (no grant reaches owner access, and
+ * run reads consult no admin role); this is defence in depth, so that a way to read runs added
+ * later does not reach detail text without its own decision.
+ */
+export declare function canReadRunDetail(db: Pick<PrismaClient, "agent">, run: Pick<Run, "agentId" | "triggeredById">, reader: RunReader): Promise<boolean>;
 /** The run, when the caller may read it (canReadRun); otherwise the same 404 a missing run gets. */
 export declare function findReadableRun(ctx: McpRequestContext, runId: string): Promise<Run>;

package/dist/mcp/tools/run-access.js

@@ -13,6 +13,20 @@ export async function canReadRun(db, run, reader) {
         return false;
     return ((await effectiveAccess(db, "agent", agent, reader.principalId, { operator: reader.operator === true })) === "owner");
 }
+/**
+ * Detail text (the run steps' detail level): only the agent's owner, the run's starter, or the
+ * stdio operator. Today these are exactly canReadRun's readers (no grant reaches owner access, and
+ * run reads consult no admin role); this is defence in depth, so that a way to read runs added
+ * later does not reach detail text without its own decision.
+ */
+export async function canReadRunDetail(db, run, reader) {
+    if (reader.operator === true)
+        return true;
+    if (run.triggeredById !== null && run.triggeredById === reader.principalId)
+        return true;
+    const agent = await db.agent.findUnique({ where: { id: run.agentId }, select: { ownerId: true } });
+    return agent?.ownerId != null && agent.ownerId === reader.principalId;
+}
 /** The run, when the caller may read it (canReadRun); otherwise the same 404 a missing run gets. */
 export async function findReadableRun(ctx, runId) {
     const run = await ctx.db.run.findUnique({ where: { id: runId } });

package/dist/mcp/tools/run-steps.d.ts

@@ -0,0 +1,16 @@
+/**
+ * get_run_steps: what a run did, one line per step, oldest first. Same access as get_run. Steps
+ * are stored already redacted (src/core/run-steps/writer.ts) and returned as stored; a step's
+ * callId is never returned; its detail text (the detail level) only to the agent's owner, the run's
+ * starter and the stdio operator (canReadRunDetail).
+ */
+import { type RunStepsLevel } from "../../core/run-steps/config.js";
+import type { WardbyMcpServer } from "../server.js";
+export declare const RUN_STEPS_DEFAULT_LIMIT = 50;
+export declare const RUN_STEPS_MAX_LIMIT = 200;
+export interface RunStepsToolOptions {
+    level: RunStepsLevel;
+    retentionDays: number;
+    now?: () => Date;
+}
+export declare function registerRunStepsTool(mcp: WardbyMcpServer, opts: RunStepsToolOptions): void;

package/dist/mcp/tools/run-steps.js

@@ -0,0 +1,85 @@
+/**
+ * get_run_steps: what a run did, one line per step, oldest first. Same access as get_run. Steps
+ * are stored already redacted (src/core/run-steps/writer.ts) and returned as stored; a step's
+ * callId is never returned; its detail text (the detail level) only to the agent's owner, the run's
+ * starter and the stdio operator (canReadRunDetail).
+ */
+import { recordedRunStepsLevel } from "../../core/run-steps/config.js";
+import { canReadRunDetail, findReadableRun } from "./run-access.js";
+import { textResult } from "./text-result.js";
+export const RUN_STEPS_DEFAULT_LIMIT = 50;
+export const RUN_STEPS_MAX_LIMIT = 200;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const EXPIRED_MEANING = "No steps are kept for this run: steps are deleted RUN_STEP_RETENTION_DAYS after they are recorded.";
+export function registerRunStepsTool(mcp, opts) {
+    mcp.registerTool({
+        name: "get_run_steps",
+        scope: "agents:read",
+        description: "What a run did, one line per step, oldest first: each tool call (the tool and its command, file or first " +
+            "argument, cut short) with its status once known (ok, error or exit N), and what the model said, cut short. " +
+            "At the detail level (the instance's WARDBY_RUN_STEPS and the agent's runSteps both detail), the agent's owner " +
+            "and the run's starter also get each step's detail: the tool's input, the end of its output, or the model's " +
+            "text, redacted. Others get the lines only. level is the run's own, fixed when it started. " +
+            "To follow a running run, call again with after set to the last seq you have. " +
+            `next is the after for the next page, or null. limit defaults to ${RUN_STEPS_DEFAULT_LIMIT}, at most ` +
+            `${RUN_STEPS_MAX_LIMIT}. dropped counts steps past the per-run limit. Same access as get_run.`,
+        inputSchema: {
+            type: "object",
+            properties: {
+                runId: { type: "string" },
+                after: { type: "number", description: "Only steps with a larger seq" },
+                limit: {
+                    type: "number",
+                    description: `Steps to return (default ${RUN_STEPS_DEFAULT_LIMIT}, at most ${RUN_STEPS_MAX_LIMIT})`,
+                },
+            },
+            required: ["runId"],
+        },
+        handler: async (args, ctx) => {
+            const run = await findReadableRun(ctx, args.runId);
+            const showDetail = await canReadRunDetail(ctx.db, run, {
+                principalId: ctx.principal.id,
+                operator: ctx.operator,
+            });
+            const after = Number.isFinite(args.after) ? Math.max(0, Math.floor(args.after)) : 0;
+            const requested = Number.isFinite(args.limit) ? Math.floor(args.limit) : RUN_STEPS_DEFAULT_LIMIT;
+            const take = Math.min(Math.max(1, requested), RUN_STEPS_MAX_LIMIT);
+            const rows = await ctx.db.runStep.findMany({
+                where: { runId: run.id, seq: { gt: after } },
+                orderBy: { seq: "asc" },
+                take: take + 1,
+                select: {
+                    seq: true,
+                    at: true,
+                    kind: true,
+                    tool: true,
+                    summary: true,
+                    status: true,
+                    ...(showDetail ? { detail: true } : {}),
+                },
+            });
+            const page = rows.slice(0, take);
+            const now = (opts.now ?? (() => new Date()))();
+            const expired = page.length === 0 &&
+                after === 0 &&
+                run.finishedAt != null &&
+                run.finishedAt.getTime() + opts.retentionDays * DAY_MS < now.getTime();
+            return textResult({
+                runId: run.id,
+                level: recordedRunStepsLevel(run.runStepsLevel, opts.level),
+                steps: page.map((s) => ({
+                    seq: s.seq,
+                    at: s.at.toISOString(),
+                    kind: s.kind,
+                    tool: s.tool,
+                    summary: s.summary,
+                    status: s.status,
+                    ...(showDetail ? { detail: s.detail ?? null } : {}),
+                })),
+                next: rows.length > take ? page[page.length - 1].seq : null,
+                dropped: run.stepsDropped,
+                ...(expired ? { expired: true, meaning: EXPIRED_MEANING } : {}),
+            });
+        },
+    });
+}

package/dist/mcp/tools/runs.js

@@ -12,6 +12,7 @@ import { textResult } from "./text-result.js";
 import { loadBudgetEvents } from "../../core/budget-events.js";
 import { loadAgentSecretValues, maskNamedSecrets } from "../../core/secret-guard.js";
 import { logger } from "../../core/logger.js";
+import { loadLastSteps } from "../../core/run-steps/last-step.js";
 const runsLog = logger.child({ module: "mcp-runs" });
 /**
  * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
@@ -126,6 +127,8 @@ async function listRunsAcrossAgents(ctx, filters, opts) {
         orderBy: { startedAt: "desc" },
     });
     const graph = await runGraphFields(ctx, runs.map((run) => run.id));
+    // The newest step of each run (the runs pane's one line), when it has any.
+    const lastSteps = await loadLastSteps(ctx.db, runs.map((run) => run.id));
     return runs.map((run) => {
         const agent = byId.get(run.agentId);
         return {
@@ -133,6 +136,7 @@ async function listRunsAcrossAgents(ctx, filters, opts) {
             agentName: agent?.name ?? null,
             agentBudgetUsd: agent ? Number(agent.budgetUsd) : null,
             ...(graph.get(run.id) ?? { triggerInfo: null, outcomes: [], serviceReadiness: [] }),
+            ...(lastSteps.has(run.id) ? { lastStep: lastSteps.get(run.id) } : {}),
         };
     });
 }
@@ -156,7 +160,7 @@ export function registerRunTools(mcp) {
         name: "list_runs",
         scope: "agents:read",
         description: "Lists runs, newest first. With agentId, that agent's runs; without it, runs across every agent you can see " +
-            "(each row adds agentName, agentBudgetUsd, triggerInfo, outcomes and serviceReadiness, and leaves out finalText " +
+            "(each row adds agentName, agentBudgetUsd, triggerInfo, outcomes, serviceReadiness and lastStep (the run's newest step as one line, when it has steps; the agentId listing has no lastStep), and leaves out finalText " +
             `and pricingSnapshot; default limit ${ACROSS_AGENTS_DEFAULT_LIMIT}, ` +
             `at most ${ACROSS_AGENTS_MAX_LIMIT}). You see all runs of agents you own and only the runs you triggered on others. ` +
             "active: true keeps pending and running runs; since (ISO time) keeps runs that started or finished then or later, " +
@@ -208,7 +212,8 @@ export function registerRunTools(mcp) {
         scope: "agents:read",
         description: "One run in full: status, cost, request, result, errors and budget events, plus triggerInfo (what started it: " +
             "a pull request review or mention, an issue, a schedule or a lead run), outcomes (pull requests opened, comments, " +
-            "checks) and serviceReadiness. A run's pull-request outcome matching another run's triggerInfo links the two.",
+            "checks) and serviceReadiness. A run's pull-request outcome matching another run's triggerInfo links the two. " +
+            "lastStep is the newest step; get_run_steps lists them all.",
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
             // Its triggerer keeps seeing it even after losing access to the agent;
@@ -279,12 +284,15 @@ export function registerRunTools(mcp) {
             const budgetEvents = await loadBudgetEvents(ctx.db, run.id);
             // What started the run and what it produced, as the admin viewer shows them.
             const graph = (await runGraphFields(ctx, [run.id])).get(run.id);
+            // The newest step (get_run_steps has them all).
+            const lastStep = (await loadLastSteps(ctx.db, [run.id])).get(run.id);
             // What the run was asked to do: the trigger's or lead's task, without the agent's standing instructions.
             const request = codingRun?.request ? await requestForReader(ctx, run, codingRun.request) : {};
             return textResult({
                 ...withOperatorMode(run),
                 ...request,
                 ...(graph ?? {}),
+                ...(lastStep ? { lastStep } : {}),
                 ...(budgetEvents.length > 0 ? { budgetEvents } : {}),
                 ...(codingRun?.budgetReservedUsd != null ? { budgetReservedUsd: Number(codingRun.budgetReservedUsd) } : {}),
                 ...(codingRun?.budgetBaseUsd != null ? { budgetBaseUsd: Number(codingRun.budgetBaseUsd) } : {}),

package/dist/native-worker/gateway-server.d.ts

@@ -10,6 +10,7 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
+import type { RunStepSink } from "../core/run-steps/types.js";
 import { createNativeRunTools, durableDelegate, type NativeRunFinishContext, type NativeRunProviders, type RunnerDb, type SandboxSessionSnapshot } from "../core/runner.js";
 import type { CodingMcpDeps } from "../core/coding-mcp.js";
 import { ReviewReadLedger } from "../core/review-reads.js";
@@ -66,7 +67,9 @@ interface RebuiltRun {
     delegation: Omit<Parameters<typeof durableDelegate>[0], "ledger" | "sessionId">;
 }
 /** Exported for its unit test; the HTTP handler is its only production caller. */
-export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">): AsyncIterable<LlmStreamEvent>;
+export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">, steps?: RunStepSink, 
+/** The request's bearer capability, redacted from the recorded steps like a secret value. */
+capability?: string): AsyncIterable<LlmStreamEvent>;
 /**
  * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
  * be read: without the complete list the line cannot be shown to be free of its secret values, so

package/dist/native-worker/gateway-server.js

@@ -10,6 +10,7 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
+import { NativeStreamSteps, recordStreamSteps } from "../core/run-steps/native.js";
 import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, userToolSecretValues, } from "../core/runner.js";
 import { ReviewReadLedger } from "../core/review-reads.js";
 import { DELEGATE_TOOL_PREFIX } from "../core/tool-names.js";
@@ -129,7 +130,7 @@ async function handle(deps, authorization, body, scope) {
             return {
                 kind: "stream",
                 status: 200,
-                events: checkedEvents(streamModel(ctx, ledger, request.callId, params), scope.secretValues),
+                events: checkedEvents(streamModel(ctx, ledger, request.callId, params, deps.providers.runSteps, token), scope.secretValues),
             };
         case "llm.countTokens": {
             const p = params;
@@ -195,7 +196,9 @@ async function rebuild(deps, session) {
     };
 }
 /** Exported for its unit test; the HTTP handler is its only production caller. */
-export async function* streamModel(ctx, ledger, callId, params) {
+export async function* streamModel(ctx, ledger, callId, params, steps, 
+/** The request's bearer capability, redacted from the recorded steps like a secret value. */
+capability) {
     const req = params.request;
     if (req.model !== ctx.snapshot.input.agent.model)
         throw new GatewayError("not_allowed", "A run may only call its own model.");
@@ -210,6 +213,8 @@ export async function* streamModel(ctx, ledger, callId, params) {
     if (reserved.outcome === "budget_exhausted") {
         throw new GatewayError("budget_exhausted", "This run's budget cannot cover another model call.");
     }
+    // Run steps: what this call streams, and the results its request carries for the last turn.
+    const tap = steps ? new NativeStreamSteps(callId) : undefined;
     let settled = false;
     let sawEvent = false;
     // Set once the provider's response starts: it may bill hidden thinking or reasoning before any event.
@@ -238,6 +243,7 @@ export async function* streamModel(ctx, ledger, callId, params) {
                     costUsd: event.usage.costUsd,
                 });
             }
+            tap?.observe(event);
             yield event;
         }
     }
@@ -284,6 +290,8 @@ export async function* streamModel(ctx, ledger, callId, params) {
                 costUsd: ctx.llm.priceUsd(req.model, { inputTokens, outputTokens: output }),
             });
         }
+        // Recorded before the stream ends (bounded), so the next call's results find these steps.
+        await recordStreamSteps(steps, ctx.session.runId, tap, req.messages, capability ? [capability] : []);
     }
 }
 /** Output tokens of a cut stream's output: counted, else the deliberately high bytes / 3 estimate. */

package/dist/native-worker/gateway.d.ts

@@ -13,6 +13,7 @@
 import type { EngineResult, EngineRunContext } from "../providers/engine/types.js";
 import type { LlmStreamEvent } from "../providers/llm/types.js";
 import pino from "pino";
+import type { RunStepSink } from "../core/run-steps/types.js";
 import { type PrivilegedHost } from "../sandbox/host-functions.js";
 import { logger } from "../core/logger.js";
 import { GatewayError, type WorkerInput } from "./protocol.js";
@@ -67,6 +68,8 @@ export interface SandboxedEngineOptions {
     mcpSecretValues?: () => Promise<string[]>;
     drivability: () => Promise<RunDrivability>;
     launcher: WorkerLauncher;
+    /** Records the run's steps (src/core/run-steps); absent = none. */
+    runSteps?: RunStepSink;
 }
 /** Runs one native run's engine in a worker and returns its result with gateway-metered usage. */
 export declare function runSandboxedEngine(options: SandboxedEngineOptions): Promise<EngineResult>;

package/dist/native-worker/gateway.js

@@ -11,6 +11,7 @@
  * sandbox bridges are served only by name from the run's own surface.
  */
 import pino from "pino";
+import { NativeStreamSteps, recordStreamSteps } from "../core/run-steps/native.js";
 import { isPrivilegedBridgeName, redactExactSecretValues, withEscapedForms, } from "../sandbox/host-functions.js";
 import { logger } from "../core/logger.js";
 import { declaredCodeOf } from "../core/error-code.js";
@@ -134,6 +135,9 @@ export async function runSandboxedEngine(options) {
             const req = params.request;
             let sawDone = false;
             let streamedText = "";
+            // Run steps: what this call streams, and the results its request carries for the last turn.
+            const sink = options.runSteps;
+            const steps = sink ? new NativeStreamSteps(request.callId) : undefined;
             try {
                 for await (const event of llm.stream(req, controller.signal)) {
                     if (event.type === "done") {
@@ -143,6 +147,7 @@ export async function runSandboxedEngine(options) {
                     else if (event.type === "text") {
                         streamedText += event.delta;
                     }
+                    steps?.observe(event);
                     yield event;
                 }
             }
@@ -157,6 +162,9 @@ export async function runSandboxedEngine(options) {
                         : 0;
                     meter({ inputTokens, outputTokens, costUsd: llm.priceUsd(req.model, { inputTokens, outputTokens }) });
                 }
+                // Recorded before the stream ends (bounded), so the next call's results find these steps.
+                // The run's capability (when the worker has one) is redacted like a secret value.
+                await recordStreamSteps(sink, runId, steps, req.messages, input.gateway ? [input.gateway.capability] : []);
             }
         },
         async call(raw) {

package/dist/native-worker/http-server.d.ts

@@ -13,14 +13,12 @@
  *                                  gateway capability. 404 when the listener was started without it.
  */
 import { type Server } from "node:http";
+import { type ListenAddress } from "../core/listen-address.js";
 import { type GatewayServerDeps } from "./gateway-server.js";
 /** The HTTP listener's own log. Exported so tests can watch it. */
 export declare const httpLog: import("pino").Logger<never, boolean>;
 export declare const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
-export interface NativeGatewayListen {
-    host: string;
-    port: number;
-}
+export type NativeGatewayListen = ListenAddress;
 /** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
 export declare function parseGatewayListen(value: string | undefined): NativeGatewayListen | undefined;
 export declare function createGatewayServer(deps: GatewayServerDeps): Server;

package/dist/native-worker/http-server.js

@@ -14,6 +14,7 @@
  */
 import { createServer } from "node:http";
 import { CODING_MCP_PATH, handleCodingMcpRequest } from "../core/coding-mcp.js";
+import { parseListenAddress } from "../core/listen-address.js";
 import { logger } from "../core/logger.js";
 import { HTTP_LIMITS, HttpBoundaryError, readBody as readLimitedBody } from "../mcp/transport/http-limits.js";
 import { logUnexpectedError } from "./gateway.js";
@@ -24,14 +25,7 @@ export const httpLog = logger.child({ module: "native-gateway-http" });
 export const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
 /** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
 export function parseGatewayListen(value) {
-    if (!value)
-        return undefined;
-    const match = /^(.*):(\d{1,5})$/.exec(value.trim());
-    const port = match ? Number(match[2]) : NaN;
-    if (!match || !Number.isInteger(port) || port < 1 || port > 65_535) {
-        throw new Error(`NATIVE_GATEWAY_LISTEN must be host:port or :port (got "${value}").`);
-    }
-    return { host: match[1] || "0.0.0.0", port };
+    return parseListenAddress("NATIVE_GATEWAY_LISTEN", value);
 }
 function readBody(req) {
     return new Promise((resolve, reject) => {

package/dist/providers/coding-proxy/memory-ledger.js

@@ -49,6 +49,7 @@ export class MemoryProxyLedger {
             mcpTools: input.mcpTools ? structuredClone(input.mcpTools) : null,
             mcpTokenHash: input.mcpTokenHash ?? null,
             mcpCallCount: 0,
+            runStepsLevel: input.runStepsLevel ?? null,
         };
         this.sessions.set(session.id, session);
         this.sessionByCapability.set(session.capabilityHash, session.id);

package/dist/providers/coding-proxy/prisma-ledger.js

@@ -1,3 +1,4 @@
+import { RUN_STEPS_LEVELS } from "../../core/run-steps/config.js";
 import { logger } from "../../core/logger.js";
 import { normalizeProxyModelTerms } from "./types.js";
 const log = logger.child({ module: "coding-proxy-ledger" });
@@ -14,6 +15,9 @@ export const LEDGER_TRANSACTION_MAX_WAIT_MS = 5_000;
  *  the model request. The row lock it holds is per session, so a longer
  *  window only delays that run's own next request. */
 export const LEDGER_TRANSACTION_TIMEOUT_MS = 20_000;
+function isRunStepsLevel(value) {
+    return typeof value === "string" && RUN_STEPS_LEVELS.includes(value);
+}
 function sessionFromRow(row) {
     if (!Array.isArray(row.allowedModels) || !row.allowedModels.every((model) => typeof model === "string")) {
         throw new Error("invalid_proxy_session_models");
@@ -38,6 +42,7 @@ function sessionFromRow(row) {
         mcpTools: sessionMcpTools(row),
         mcpTokenHash: row.mcpTokenHash ?? null,
         mcpCallCount: Number(row.mcpCallCount ?? 0),
+        runStepsLevel: isRunStepsLevel(row.runStepsLevel) ? row.runStepsLevel : null,
     };
 }
 /** The session's pinned MCP tools; null when it has none. Anything but a list of pins refuses the session. */
@@ -127,20 +132,21 @@ export class PrismaProxyLedger {
         await this.db.$executeRaw `
       INSERT INTO "CodingProxySession"
         ("id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt",
-         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash",
+         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "runStepsLevel",
          "createdAt", "updatedAt")
       VALUES
         (${input.id}, ${input.runId}, ${input.capabilityHash}, ${input.credentialRef}, ${input.protocol}, ${models}::jsonb,
          ${input.deadlineAt}, ${input.budgetUsd}, 'active', ${input.registryTokenHash},
          ${terms?.version ?? null}, ${terms ? JSON.stringify(terms.entry) : null}::jsonb,
          ${input.mcpTools ? JSON.stringify(input.mcpTools) : null}::jsonb, ${input.mcpTokenHash ?? null},
+         ${input.runStepsLevel ?? null}::"RunStepsLevel",
          CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
     `;
     }
     async findSessionByCapabilityHash(capabilityHash) {
         const rows = await this.db.$queryRaw `
       SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
-             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount"
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount", "runStepsLevel"
       FROM "CodingProxySession" WHERE "capabilityHash" = ${capabilityHash}
     `;
         return rows[0] ? sessionFromRow(rows[0]) : null;
@@ -148,7 +154,7 @@ export class PrismaProxyLedger {
     async findSessionByMcpTokenHash(mcpTokenHash) {
         const rows = await this.db.$queryRaw `
       SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
-             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount"
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry", "mcpTools", "mcpTokenHash", "mcpCallCount", "runStepsLevel"
       FROM "CodingProxySession" WHERE "mcpTokenHash" = ${mcpTokenHash}
     `;
         return rows[0] ? sessionFromRow(rows[0]) : undefined;