@wardby/cli 0.8.0 → 0.9.0

package/dist/providers/coding-proxy/runtime.js

@@ -1,6 +1,7 @@
 import { loadDependencyCacheConfig } from "../../config/dependency-cache.js";
 import { createSimulatorModelFetch, createSimulatorRegistryFetch, startupTestSimulators, } from "../../config/test-simulators.js";
 import { logger } from "../../core/logger.js";
+import { loadRunStepsLevel } from "../../core/run-steps/config.js";
 import { REGISTRY_ADAPTERS } from "../../coding/registry/adapters.js";
 import { CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "../jobs/docker-isolation.js";
 import { createBlobStore } from "../storage/index.js";
@@ -14,6 +15,7 @@ import { createMcpRoute } from "./mcp-route.js";
 import { createMockUpstream, mockUpstreamFromEnv } from "./mock-upstream.js";
 import { CodingProxy } from "./proxy.js";
 import { PrismaProxyLedger } from "./prisma-ledger.js";
+import { RunStepForwarder } from "./run-step-forwarder.js";
 import { OsvAudit } from "./registry/audit.js";
 import { PrismaRegistryStore } from "./registry/prisma-store.js";
 import { DEFAULT_PLAN_MAX_ENTRIES, DEFAULT_PLAN_TIMEOUT_MS } from "./registry/plan.js";
@@ -71,6 +73,34 @@ export function loadMcpGatewayUrl(env) {
     }
     return url.href.replace(/\/+$/, "");
 }
+/**
+ * WARDBY_RUN_STEPS_URL: the control plane's run-steps listener (WARDBY_RUN_STEPS_LISTEN on the
+ * server), which the proxy posts coding runs' steps to. Unset or empty: coding runs record no steps.
+ * Anything but an http(s) origin without credentials, path, query or fragment stops start-up (the
+ * value is not echoed, so a credential in it never reaches a log).
+ */
+export function loadRunStepsUrl(env) {
+    const value = env.WARDBY_RUN_STEPS_URL?.trim();
+    if (!value)
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    if (!url ||
+        (url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash) {
+        throw new Error("WARDBY_RUN_STEPS_URL must be an http(s) URL without credentials, path, query or fragment");
+    }
+    return url.origin;
+}
 /** Starts the trusted proxy with the fixed worker-only Docker endpoint, plus the deny port the enforcement witness probes. */
 export async function startConfiguredCodingProxy(options) {
     const env = options.env ?? process.env;
@@ -86,6 +116,10 @@ export async function startConfiguredCodingProxy(options) {
         : options.audit;
     // Throws on an invalid setting, before anything listens.
     const mcpGatewayUrl = loadMcpGatewayUrl(env);
+    // Throws on an invalid setting, before anything listens.
+    const runStepsUrl = loadRunStepsUrl(env);
+    // Throws on an invalid WARDBY_RUN_STEPS. At off no step text leaves the proxy.
+    const runStepsCeiling = loadRunStepsLevel(env);
     // Throws (test_simulators_refused) on any refusal, before anything listens.
     const simulators = startupTestSimulators("coding-proxy", env);
     const buildPinnedFetch = options.createPinnedFetch ?? createPinnedProxyFetch;
@@ -152,6 +186,10 @@ export async function startConfiguredCodingProxy(options) {
         logger.warn({ module: "coding-proxy-runtime", event: "proxy.dependency_cache_no_blob_store" }, "coding proxy: WARDBY_DEPENDENCY_CACHE=true but no BLOB_STORE is configured; the dependency cache is off");
     }
     const seal = modelRequestSeal;
+    // Coding runs' steps go to the control plane only when WARDBY_RUN_STEPS_URL is set and
+    // WARDBY_RUN_STEPS is not off; otherwise no
+    // submitter is passed and the proxy does no step extraction.
+    const steps = runStepsUrl && runStepsCeiling !== "off" ? new RunStepForwarder({ url: runStepsUrl }) : undefined;
     const ledger = new PrismaProxyLedger(options.db);
     const proxy = new CodingProxy({
         ledger,
@@ -166,6 +204,8 @@ export async function startConfiguredCodingProxy(options) {
                 : {}),
         // The run's first model request closes its dependency cache (no-op for a run with it off).
         ...(seal ? { onModelRequest: (runId) => seal.onModelRequest(runId) } : {}),
+        ...(steps ? { steps } : {}),
+        runStepsCeiling,
     });
     const startServer = options.startServer ?? startCodingProxyServer;
     let server;
@@ -182,6 +222,7 @@ export async function startConfiguredCodingProxy(options) {
     }
     catch (error) {
         eviction?.stop();
+        await steps?.close();
         throw error;
     }
     let deny;
@@ -192,15 +233,26 @@ export async function startConfiguredCodingProxy(options) {
         // A proxy without its witness must not stay up: the launcher's gate would never be able to
         // prove a policy is enforced, and every launch would fail at the gate instead of at startup.
         eviction?.stop();
-        await server.close();
+        try {
+            await server.close();
+        }
+        finally {
+            await steps?.close();
+        }
         throw error;
     }
     return {
         port: server.port,
         close: async () => {
             eviction?.stop();
-            await deny.close();
-            await server.close();
+            try {
+                await deny.close();
+                await server.close();
+            }
+            finally {
+                // Last: requests are done, so this is the final chance to hand over queued steps (bounded).
+                await steps?.close();
+            }
         },
     };
 }

package/dist/providers/coding-proxy/types.d.ts

@@ -1,4 +1,5 @@
 import { type CatalogEntry } from "../llm/catalog-types.js";
+import type { RunStepsLevel } from "../../core/run-steps/config.js";
 import type { ModelPricing } from "../llm/pricing-core.js";
 import type { ProxyRefusalDetails } from "../../core/budget-events.js";
 import type { McpToolPin } from "../../core/mcp-tools.js";
@@ -53,6 +54,8 @@ export interface ProxySession {
     mcpTokenHash: string | null;
     /** The run's MCP tools/call count so far. */
     mcpCallCount: number;
+    /** The run's Run.runStepsLevel, copied at session creation; null on sessions from before run steps detail. */
+    runStepsLevel: RunStepsLevel | null;
 }
 export interface ProxyRequest {
     id: string;
@@ -100,6 +103,8 @@ export interface CreateProxySessionInput {
     mcpTools?: McpToolPin[];
     /** SHA-256 (base64url) of the run's MCP token (mcpTokenHash in src/coding/mcp-token.ts). */
     mcpTokenHash?: string;
+    /** The run's level, fixed at dispatch; absent counts as summary. */
+    runStepsLevel?: RunStepsLevel;
 }
 export interface ReserveProxyRequestInput {
     id: string;

package/dist/providers/engine/types.d.ts

@@ -117,9 +117,35 @@ export interface EngineRunContext {
     onText?: (delta: string) => void;
     /** Called after each model turn that completed without error; the engine awaits it. */
     onProgress?: (progress: EngineProgress) => Promise<void>;
+    /**
+     * Receives each model turn's text and tool calls, then the turn's tool results, as the engine saw
+     * them. The runner turns them into the run's steps (src/core/run-steps); the engine never imports
+     * that code, so the sandbox worker image does not ship it. Synchronous and not awaited. A replay
+     * delivers the same call ids again; the writer drops the repeats.
+     */
+    onTurn?: (event: EngineTurnEvent) => void;
     /** See StepRunner. Optional; the in-process executor leaves it unset. */
     step?: StepRunner;
 }
+/** What EngineRunContext.onTurn receives: a turn's output, then (if it called tools) their results in call order. */
+export type EngineTurnEvent = {
+    kind: "turn";
+    /** 1-based turn number. */
+    turn: number;
+    text: string;
+    toolCalls: readonly {
+        id: string;
+        name: string;
+        argsJson: string;
+    }[];
+} | {
+    kind: "results";
+    turn: number;
+    toolCalls: readonly {
+        id: string;
+    }[];
+    results: readonly string[];
+};
 export type EngineStatus = "succeeded" | "budget_exhausted" | "refused" | "failed";
 export interface EngineResult {
     status: EngineStatus;

package/dist/providers/executor/container.d.ts

@@ -1,3 +1,4 @@
+import type { RunStepsLevel } from "../../core/run-steps/config.js";
 import { type PackageAuditEntry, type PackageAuditMode } from "../../coding/registry/audit-mode.js";
 import type { PrismaClient } from "#prisma";
 import type { RunTranscriptRecorder } from "../../coding/transcript/recorder.js";
@@ -101,6 +102,8 @@ export type StoredDescriptionBaseline = DescriptionBaseline & {
     legacySource?: LegacyDescriptionSource;
 };
 export interface ContainerRunSnapshot {
+    /** Run.runStepsLevel, fixed at dispatch; absent on older snapshots = summary. */
+    runStepsLevel?: RunStepsLevel | null;
     runId: string;
     agentId: string;
     status: string;
@@ -338,6 +341,8 @@ export interface CodingSessionController {
         mcpTools?: McpToolPin[];
         /** The hash of the run's MCP token (src/coding/mcp-token.ts); the token itself stays in the vault. */
         mcpTokenHash?: string;
+        /** The run's run-steps level (Run.runStepsLevel); the proxy reads tool output only at detail. */
+        runStepsLevel?: RunStepsLevel;
     }): Promise<{
         id: string;
         capability: string;
@@ -757,3 +762,12 @@ export declare function describeFailure(error: unknown, depth?: number): string;
 export declare const MCP_PINS_UNAVAILABLE_ERROR = "coding_mcp_pins_unavailable";
 /** Its category: the run's error is coding_failure_mcp_pins_unavailable:<diagnostic id>. */
 export declare const MCP_PINS_UNAVAILABLE_CATEGORY = "mcp_pins_unavailable";
+/** Low-power mode: the native gateway serving a run's MCP tools did not wake; nothing launched. */
+export declare const MCP_GATEWAY_UNAVAILABLE_CATEGORY = "mcp_gateway_unavailable";
+/**
+ * Error-code prefixes that name their category outright, checked before the
+ * substring heuristics below. Those heuristics filed every `github_*` error
+ * (a failed PR lookup or create after the push, a token mint) under
+ * "workspace" because "github" contains "git".
+ */
+export declare const CATEGORY_BY_PREFIX: ReadonlyArray<readonly [prefix: string, category: string]>;

package/dist/providers/executor/container.js

@@ -5,6 +5,7 @@ import { join, resolve, sep } from "node:path";
 import { withBaseCommit } from "../../coding/base-commit.js";
 import { mcpTokenHash, mintMcpToken } from "../../coding/mcp-token.js";
 import { isCodexCoding } from "../../core/mcp-tools.js";
+import { CODING_MCP_GATEWAY_UNAVAILABLE } from "../../core/power.js";
 import { codeProviderOf } from "../../coding/code-host.js";
 import { withPullRequestDescription } from "../../coding/pr-description-note.js";
 import { withLinkedIssue } from "../../coding/linked-issue-note.js";
@@ -185,6 +186,7 @@ export class PrismaContainerExecutionStore {
             : null;
         return {
             runId: row.id,
+            runStepsLevel: row.runStepsLevel,
             agentId: row.agentId,
             status: row.status,
             agentKind: row.agent.kind,
@@ -882,6 +884,7 @@ export class ContainerExecutor {
                     budgetUsd: run.budgetUsd,
                     terms: this.modelTerms(run),
                     ...(mcpToken ? { mcpTools, mcpTokenHash: mcpTokenHash(mcpToken) } : {}),
+                    ...(run.runStepsLevel ? { runStepsLevel: run.runStepsLevel } : {}),
                 });
                 spendEnabled = true;
                 sessionId = session.id;
@@ -2485,13 +2488,15 @@ function safeError(error) {
 export const MCP_PINS_UNAVAILABLE_ERROR = "coding_mcp_pins_unavailable";
 /** Its category: the run's error is coding_failure_mcp_pins_unavailable:<diagnostic id>. */
 export const MCP_PINS_UNAVAILABLE_CATEGORY = "mcp_pins_unavailable";
+/** Low-power mode: the native gateway serving a run's MCP tools did not wake; nothing launched. */
+export const MCP_GATEWAY_UNAVAILABLE_CATEGORY = "mcp_gateway_unavailable";
 /**
  * Error-code prefixes that name their category outright, checked before the
  * substring heuristics below. Those heuristics filed every `github_*` error
  * (a failed PR lookup or create after the push, a token mint) under
  * "workspace" because "github" contains "git".
  */
-const CATEGORY_BY_PREFIX = [
+export const CATEGORY_BY_PREFIX = [
     // Claude Code reached the agent's turn limit (codingProfile.maxTurns) before finishing.
     ["job_coding_turn_limit", "turn_limit"],
     // A service sidecar never became ready (src/providers/jobs/kubernetes.ts).
@@ -2523,6 +2528,8 @@ const CATEGORY_BY_PREFIX = [
     ["vcs_", "workspace"],
     // The agent's MCP tool pins could not be read at launch: nothing was launched.
     [MCP_PINS_UNAVAILABLE_ERROR, MCP_PINS_UNAVAILABLE_CATEGORY],
+    // Low-power mode: the native gateway serving the run's MCP tools did not wake (jobs/kubernetes.ts).
+    [CODING_MCP_GATEWAY_UNAVAILABLE, MCP_GATEWAY_UNAVAILABLE_CATEGORY],
     // Local repositories (LocalRepoError codes): the same family as the vcs_ errors.
     ["local_", "workspace"],
     ["git_", "workspace"],

package/dist/providers/jobs/kubernetes.d.ts

@@ -100,6 +100,14 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
     hasCapacityFor(spec: JobSpec): Promise<boolean>;
     private readonly warnedOnce;
     private warnOnce;
+    /**
+     * Wakes what the run needs before anything is created: the coding proxy always, and the native
+     * gateway too for a run with MCP tools (its MCP calls go proxy -> gateway; without a gateway the
+     * worker would start with its MCP tools missing). Both wake at once, so a cold start waits for
+     * the slower of the two, not their sum. A gateway that does not wake fails the launch with
+     * coding_mcp_gateway_unavailable; the proxy's own wake error is reported first.
+     */
+    private wakeForRun;
     launch(spec: JobSpec): Promise<JobHandle>;
     status(handle: JobHandle): Promise<JobStatus>;
     collect(handle: JobHandle): Promise<JobResult>;

package/dist/providers/jobs/kubernetes.js

@@ -29,7 +29,7 @@ import { finished } from "node:stream/promises";
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
 import { logger } from "../../core/logger.js";
-import { DISABLED_POWER, wakeTimeoutMs } from "../../core/power.js";
+import { CODING_MCP_GATEWAY_UNAVAILABLE, DISABLED_POWER, wakeTimeoutMs } from "../../core/power.js";
 import { MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_DEBUG_TRACE_LINE_BYTES, parseCodingWorkerOutputJson, } from "../../coding/protocol.js";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
 import { parseWorkerDiagnosticLine } from "./docker.js";
@@ -500,6 +500,25 @@ export class KubernetesJobLauncher {
         this.warnedOnce.add(message);
         this.warn(message);
     }
+    /**
+     * Wakes what the run needs before anything is created: the coding proxy always, and the native
+     * gateway too for a run with MCP tools (its MCP calls go proxy -> gateway; without a gateway the
+     * worker would start with its MCP tools missing). Both wake at once, so a cold start waits for
+     * the slower of the two, not their sum. A gateway that does not wake fails the launch with
+     * coding_mcp_gateway_unavailable; the proxy's own wake error is reported first.
+     */
+    async wakeForRun(spec) {
+        const opts = { timeoutMs: wakeTimeoutMs(this.readyTimeoutMs), runId: spec.runId };
+        const [proxy, gateway] = await Promise.allSettled([
+            this.power.ensureAwake("proxy", opts),
+            spec.mcpTools ? this.power.ensureAwake("gateway", opts) : Promise.resolve(),
+        ]);
+        if (proxy.status === "rejected")
+            throw proxy.reason;
+        if (gateway.status === "rejected") {
+            throw new Error(`${CODING_MCP_GATEWAY_UNAVAILABLE}: the native gateway, which serves this run's MCP tools, did not wake.`, { cause: gateway.reason });
+        }
+    }
     async launch(spec) {
         try {
             validateKubernetesSpec(spec);
@@ -516,9 +535,8 @@ export class KubernetesJobLauncher {
         }
         // Low-power mode: the proxy may be scaled to zero; wake it before the preflight reads it. Guarded
         // (not just a no-op await) so mode off keeps launch() joining an in-flight warm-up synchronously.
-        if (this.power.enabled) {
-            await this.power.ensureAwake("proxy", { timeoutMs: wakeTimeoutMs(this.readyTimeoutMs), runId: spec.runId });
-        }
+        if (this.power.enabled)
+            await this.wakeForRun(spec);
         await this.runPreflight();
         const names = kubernetesRunNames(spec.runId);
         const handle = { backend: BACKEND, id: `${this.namespace}/${names.token}` };

package/dist/quickstart-images.json

@@ -1 +1 @@
-{"runtime":"ghcr.io/wardby/wardby/wardby-runtime@sha256:8efd21e571c4da6529494ef1a422f208b3d81764dab83e581abe2e5a2eaf08d3","worker":"ghcr.io/wardby/wardby/wardby-coding-worker@sha256:93c8191a4d89077f0aa60eb698543a9c390bba9cc5319bf814734e2075d39c20","claudeWorker":"ghcr.io/wardby/wardby/wardby-claude-coding-worker@sha256:464176af56a8692ca1d1202d04fc0311ea98cd0ba9d0671433f91912c2699492","claudeToolRunner":"ghcr.io/wardby/wardby/wardby-claude-tool-runner@sha256:e475ef7c7070c4a913bde2665bfe65a65fc0ff0db82a2c58953b9b4a453b277d","workerNodePython":"ghcr.io/wardby/wardby/wardby-coding-worker-node-python@sha256:02b04ccf6348706240c27a28615a3e17b3d8c0f828f20da0ae8d3af75e3eb9e5","claudeToolRunnerNodePython":"ghcr.io/wardby/wardby/wardby-claude-tool-runner-node-python@sha256:868eb258552ac23f17bc275e2bfe0619b9cf70e4bef075f93fa75d085ee735b4","nativeWorker":"ghcr.io/wardby/wardby/wardby-native-worker@sha256:8dd742964dcaea1a6da078b12fd2091d0b6e1783c3deb1f45d691727c63b4dd0","driver":"ghcr.io/wardby/wardby/wardby-coding-worker-driver@sha256:281a7cabc53d6ff1977d1b68c1420b2ef598f90da3995cb13df27395a58a60ef"}
+{"runtime":"ghcr.io/wardby/wardby/wardby-runtime@sha256:d5cb8fcfbfd43c230418374e9a5e203528b7d7fd372c01c8545284bc261edd58","worker":"ghcr.io/wardby/wardby/wardby-coding-worker@sha256:943a4023bcdc86d84fb923ebd97e3b0b0b5c0055ea81542cb9972ddc6ee36e69","claudeWorker":"ghcr.io/wardby/wardby/wardby-claude-coding-worker@sha256:861ef8f23bd70c329cde7013191371737d266b854678942d328906b29242d08f","claudeToolRunner":"ghcr.io/wardby/wardby/wardby-claude-tool-runner@sha256:247a870862a3b20d02b6d0a2a87ef7b3d2ae57a30478b6d517ae58535bf54260","workerNodePython":"ghcr.io/wardby/wardby/wardby-coding-worker-node-python@sha256:9684306a84da26ea057b6ccdaaa73f7377820a74bb30fe1740afb8c734da4300","claudeToolRunnerNodePython":"ghcr.io/wardby/wardby/wardby-claude-tool-runner-node-python@sha256:71bd16fd9635eee62b561771da9568120db25ec259807aa070c2eb7865dbbf0f","nativeWorker":"ghcr.io/wardby/wardby/wardby-native-worker@sha256:33606de7284c11dee354a44b6563cc7999fd135d71545c1e63244d867f1a7b2c","driver":"ghcr.io/wardby/wardby/wardby-coding-worker-driver@sha256:281a7cabc53d6ff1977d1b68c1420b2ef598f90da3995cb13df27395a58a60ef"}

package/dist/serve.js

@@ -1,21 +1,3 @@
-/**
- * `wardby serve`: the complete wardby process. Runs the MCP server, the
- * scheduler, and the reconciler together on ONE provider set and ONE
- * executor, which is what a single-container deployment (Cloud Run, a lone
- * VM) needs - `wardby mcp` alone never fires a schedule.
- *
- * Why one executor: DbosExecutor is a per-process singleton and refuses to
- * launch twice under different ids (providers/executor/dbos.ts), and its
- * recovery decisions key on that id. Building providers once and sharing
- * them is the whole trick; it also gives scheduled native runs the same
- * `providers.executor` wiring MCP-triggered runs get, so sub-agent dispatch
- * from a scheduled run works (it does not from `wardby scheduler`).
- *
- * Why the scheduler and reconciler can run in every replica: the scheduler
- * elects one ticker via a Postgres lease and enforces at-most-once with row
- * locks regardless (core/scheduler.ts); the reconciler is deliberately not
- * lease-gated and is safe under concurrency (core/reconciler.ts).
- */
 import { loadCodingConcurrencyConfig, loadMcpConfig } from "./config/providers.js";
 import { drainCodingQueue } from "./core/coding-queue.js";
 import { prisma } from "./core/db.js";
@@ -28,6 +10,8 @@ import { markRunFailedFromExecutorError } from "./core/dispatch.js";
 import { startScheduler } from "./core/scheduler.js";
 import { drainDeferredRuns } from "./providers/executor/deferred.js";
 import { resolveDeferredCodingRun } from "./core/deferred-coding.js";
+import { RunStepSweeper } from "./core/run-steps/sweep.js";
+import { parseRunStepsListen, startRunStepIngress } from "./core/run-steps/ingress.js";
 import { buildMcpProviders, startMcp } from "./mcp/index.js";
 const serveLog = logger.child({ module: "serve" });
 export async function startServe(options = {}) {
@@ -39,6 +23,8 @@ export async function startServe(options = {}) {
     // Parsed before anything starts, so a malformed CODING_MAX_CONCURRENT or
     // CODING_QUEUE_TIMEOUT_SEC fails fast instead of after HTTP is listening.
     const concurrency = loadCodingConcurrencyConfig();
+    // Run steps from the coding proxy (POST /internal/run-steps); parsed early so a bad value stops start-up.
+    const runStepsListen = parseRunStepsListen(process.env.WARDBY_RUN_STEPS_LISTEN);
     const providers = options.providers ?? buildMcpProviders().providers;
     const power = providers.power ?? DISABLED_POWER;
     if (power.enabled) {
@@ -48,6 +34,21 @@ export async function startServe(options = {}) {
         }, (err) => serveLog.warn({ err }, "low_power_access_check_failed"));
     }
     const mcp = await startMcp({ providers, schedulerAttached: true });
+    // Its own port (not the MCP listener's): only the coding proxy reaches it.
+    let runStepIngress;
+    if (runStepsListen && providers.runSteps) {
+        try {
+            runStepIngress = await startRunStepIngress(runStepsListen, { db: prisma, sink: providers.runSteps });
+        }
+        catch (err) {
+            await mcp.close();
+            throw err;
+        }
+        serveLog.info({ host: runStepsListen.host, port: runStepsListen.port }, "run steps listener started");
+    }
+    else if (runStepsListen) {
+        serveLog.warn("WARDBY_RUN_STEPS_LISTEN is set but this server has no run-steps writer; not listening");
+    }
     const reviewHosts = providers.reviewHosts;
     const reconciler = startReconciler({
         executor: providers.executor,
@@ -67,6 +68,8 @@ export async function startServe(options = {}) {
     });
     const notifications = await startNotifications({ db: prisma, chat: providers.chat ?? {} });
     const selfDefects = { db: prisma, issueTrackers: providers.issueTrackers };
+    // Expired run steps (RUN_STEP_RETENTION_DAYS), from the scheduler leader only.
+    const runStepSweeper = new RunStepSweeper(prisma);
     const scheduler = startScheduler({
         executor: providers.executor,
         scope: options.scope,
@@ -82,6 +85,7 @@ export async function startServe(options = {}) {
             });
             // Scale idle coding-proxy/native-gateway Deployments to zero (no-op unless WARDBY_LOW_POWER=1).
             await power.sleepIfIdle().catch((err) => serveLog.warn({ err }, "power_sleep_failed"));
+            await runStepSweeper.maybeSweep();
         },
     });
     return {
@@ -92,6 +96,10 @@ export async function startServe(options = {}) {
             scheduler.stop();
             reconciler.stop();
             notifications.stop();
+            // Before mcp.close(), which flushes the run-steps writer: no batch arrives after the flush.
+            const ingress = runStepIngress;
+            if (ingress)
+                await new Promise((resolve) => ingress.close(() => resolve()));
             await mcp.close();
         },
     };

package/dist/viewer/api-schema.d.ts

@@ -320,6 +320,21 @@ export declare const GraphSnapshotSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * One recorded run step (docs/viewer-api.md): a tool call or what the model said, one line. Stored
+ * already redacted (src/core/run-steps/writer.ts); a step's call id and detail text are never sent.
+ */
+export declare const RunStepSchema: z.ZodObject<{
+    seq: z.ZodNumber;
+    at: z.ZodString;
+    kind: z.ZodEnum<{
+        tool: "tool";
+        said: "said";
+    }>;
+    tool: z.ZodNullable<z.ZodString>;
+    summary: z.ZodString;
+    status: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
 export declare const RunDetailSchema: z.ZodObject<{
     id: z.ZodString;
     parentRunId: z.ZodNullable<z.ZodString>;
@@ -429,6 +444,19 @@ export declare const RunDetailSchema: z.ZodObject<{
     error: z.ZodNullable<z.ZodString>;
     finalText: z.ZodNullable<z.ZodString>;
     childRunIds: z.ZodArray<z.ZodString>;
+    steps: z.ZodArray<z.ZodObject<{
+        seq: z.ZodNumber;
+        at: z.ZodString;
+        kind: z.ZodEnum<{
+            tool: "tool";
+            said: "said";
+        }>;
+        tool: z.ZodNullable<z.ZodString>;
+        summary: z.ZodString;
+        status: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    stepsOmitted: z.ZodNumber;
+    stepsDropped: z.ZodNumber;
     coding: z.ZodNullable<z.ZodObject<{
         provider: z.ZodString;
         repository: z.ZodString;
@@ -484,6 +512,18 @@ export declare const ViewerEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         issue_status: "issue_status";
         host_check: "host_check";
     }>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"step">;
+    runId: z.ZodString;
+    seq: z.ZodNumber;
+    stepKind: z.ZodEnum<{
+        tool: "tool";
+        said: "said";
+    }>;
+    tool: z.ZodNullable<z.ZodString>;
+    summary: z.ZodString;
+    status: z.ZodNullable<z.ZodString>;
+    at: z.ZodString;
 }, z.core.$strip>], "kind">;
 export type RunTriggerInfo = z.infer<typeof RunTriggerSchema>;
 export type Outcome = z.infer<typeof OutcomeSchema>;
@@ -491,6 +531,7 @@ export type ServiceStatus = z.infer<typeof ServiceStatusSchema>;
 export type GraphRun = z.infer<typeof GraphRunSchema>;
 export type GraphSnapshot = z.infer<typeof GraphSnapshotSchema>;
 export type RunDetail = z.infer<typeof RunDetailSchema>;
+export type RunStepView = z.infer<typeof RunStepSchema>;
 export type ViewerEvent = z.infer<typeof ViewerEventSchema>;
 /** How this deployment runs coding jobs, for the desktop viewer's Infrastructure view (GET /admin/api/infra). */
 export declare const InfraInfoSchema: z.ZodObject<{
@@ -758,6 +799,19 @@ export declare const VIEWER_SCHEMAS: {
         error: z.ZodNullable<z.ZodString>;
         finalText: z.ZodNullable<z.ZodString>;
         childRunIds: z.ZodArray<z.ZodString>;
+        steps: z.ZodArray<z.ZodObject<{
+            seq: z.ZodNumber;
+            at: z.ZodString;
+            kind: z.ZodEnum<{
+                tool: "tool";
+                said: "said";
+            }>;
+            tool: z.ZodNullable<z.ZodString>;
+            summary: z.ZodString;
+            status: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        stepsOmitted: z.ZodNumber;
+        stepsDropped: z.ZodNumber;
         coding: z.ZodNullable<z.ZodObject<{
             provider: z.ZodString;
             repository: z.ZodString;
@@ -813,6 +867,18 @@ export declare const VIEWER_SCHEMAS: {
             issue_status: "issue_status";
             host_check: "host_check";
         }>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"step">;
+        runId: z.ZodString;
+        seq: z.ZodNumber;
+        stepKind: z.ZodEnum<{
+            tool: "tool";
+            said: "said";
+        }>;
+        tool: z.ZodNullable<z.ZodString>;
+        summary: z.ZodString;
+        status: z.ZodNullable<z.ZodString>;
+        at: z.ZodString;
     }, z.core.$strip>], "kind">;
     readonly "infra-info": z.ZodObject<{
         launcher: z.ZodEnum<{

package/dist/viewer/api-schema.js

@@ -123,10 +123,30 @@ export const GraphSnapshotSchema = z.object({
     runs: z.array(GraphRunSchema),
     spend: z.object({ todayUsd: z.number(), groups: z.array(BudgetGroupSpendSchema) }),
 });
+/**
+ * One recorded run step (docs/viewer-api.md): a tool call or what the model said, one line. Stored
+ * already redacted (src/core/run-steps/writer.ts); a step's call id and detail text are never sent.
+ */
+export const RunStepSchema = z.object({
+    seq: z.number().int(),
+    at: z.string(),
+    kind: z.enum(["tool", "said"]),
+    /** The tool's display name (`Bash`, `Edit`, `mcp:<tool>`); null for said. */
+    tool: z.string().nullable(),
+    summary: z.string(),
+    /** `ok`, `error` or `exit N` once the result is back; null until then and for said. */
+    status: z.string().nullable(),
+});
 export const RunDetailSchema = GraphRunSchema.extend({
     error: z.string().nullable(),
     finalText: z.string().nullable(),
     childRunIds: z.array(z.string()),
+    /** The run's newest steps (at most 200), oldest first; see `stepsOmitted` for earlier ones. */
+    steps: z.array(RunStepSchema),
+    /** Earlier recorded steps not included in `steps`. */
+    stepsOmitted: z.number().int(),
+    /** Steps past the per-run limit, never recorded. */
+    stepsDropped: z.number().int(),
     coding: z
         .object({
         provider: z.string(),
@@ -170,6 +190,17 @@ export const ViewerEventSchema = z.discriminatedUnion("kind", [
         /** Which table changed (the viewer NOTIFY trigger names them). */
         source: z.enum(["pull_request", "host_status", "issue_status", "host_check"]),
     }),
+    /** A run recorded a step, or a step's status arrived (the RunStep NOTIFY trigger). */
+    z.object({
+        kind: z.literal("step"),
+        runId: z.string(),
+        seq: RunStepSchema.shape.seq,
+        stepKind: RunStepSchema.shape.kind,
+        tool: RunStepSchema.shape.tool,
+        summary: RunStepSchema.shape.summary,
+        status: RunStepSchema.shape.status,
+        at: RunStepSchema.shape.at,
+    }),
 ]);
 /** How this deployment runs coding jobs, for the desktop viewer's Infrastructure view (GET /admin/api/infra). */
 export const InfraInfoSchema = z.object({

package/dist/viewer/openapi.js

@@ -59,7 +59,7 @@ export const VIEWER_ROUTES = [
         path: "/admin/api/runs/{id}",
         operationId: "getRun",
         summary: "Run detail",
-        description: "Full detail for one run, including final text.",
+        description: "Full detail for one run, including final text and its newest steps.",
         parameters: [{ name: "id", in: "path", required: true, description: "Run id.", schema: { type: "string" } }],
         responses: {
             "200": { description: "The run.", content: { "application/json": { schema: ref("run-detail") } } },
@@ -85,6 +85,7 @@ export const VIEWER_ROUTES = [
             "- `retry: 3000`: suggested client reconnect delay in milliseconds.",
             '- `event: hello`: sent first. Data is `{"connected": <bool>}`, whether the server\'s live-event connection is up.',
             "- `event: run`, `event: service`, `event: outcome`: a run, coding-run service, or outcome changed. Each carries an `id:` line. Payloads match the `viewer-event` schema (see `x-event-schema`).",
+            "- `event: step`: a run recorded a step, or a step's status arrived. Carries an `id:` line. Data: the step's `seq`, `stepKind` (`tool` or `said`), `tool`, `summary` (redacted when it was recorded), `status` and `at`, never tool output.",
             '- `event: status`: the server\'s live-event connection changed. Data is `{"connected": <bool>}`.',
             "- `event: resync`: the live-event connection is up (again). Events may have been missed: refetch the graph.",
             `- \`: ping\`: comment sent every ${SSE_HEARTBEAT_MS / 1000} seconds to keep the connection open.`,

package/dist/viewer/run-detail.d.ts

@@ -2,4 +2,6 @@
 import type { PrismaClient } from "#prisma";
 import type { RunDetail } from "./api-schema.js";
 import { type IssueSites } from "./graph.js";
+/** The most steps a run detail carries: the newest, oldest first. */
+export declare const RUN_DETAIL_STEPS = 200;
 export declare function loadRunDetail(db: PrismaClient, runId: string, issueSites?: IssueSites): Promise<RunDetail | null>;

package/dist/viewer/run-detail.js

@@ -11,16 +11,19 @@ function serviceDetails(snapshot) {
         envNames: isRecord(s.testEnv) ? Object.keys(s.testEnv).sort() : [],
     }));
 }
+/** The most steps a run detail carries: the newest, oldest first. */
+export const RUN_DETAIL_STEPS = 200;
 export async function loadRunDetail(db, runId, issueSites = {}) {
     const [graphRun] = await loadGraphRuns(db, [runId], issueSites);
     if (!graphRun)
         return null;
-    const [row, children] = await Promise.all([
+    const [row, children, newest, stepCount] = await Promise.all([
         db.run.findUniqueOrThrow({
             where: { id: runId },
             select: {
                 error: true,
                 finalText: true,
+                stepsDropped: true,
                 codingRun: {
                     select: {
                         provider: true,
@@ -39,13 +42,35 @@ export async function loadRunDetail(db, runId, issueSites = {}) {
             select: { id: true },
             orderBy: [{ startedAt: "asc" }, { id: "asc" }],
         }),
+        // Stored already redacted; the call id and the detail text are never selected.
+        db.runStep.findMany({
+            where: { runId },
+            orderBy: { seq: "desc" },
+            take: RUN_DETAIL_STEPS,
+            select: { seq: true, at: true, kind: true, tool: true, summary: true, status: true },
+        }),
+        db.runStep.count({ where: { runId } }),
     ]);
+    const steps = newest
+        .reverse()
+        .filter((s) => s.kind === "tool" || s.kind === "said")
+        .map((s) => ({
+        seq: s.seq,
+        at: s.at.toISOString(),
+        kind: s.kind,
+        tool: s.tool,
+        summary: s.summary,
+        status: s.status,
+    }));
     const coding = row.codingRun;
     return {
         ...graphRun,
         error: row.error,
         finalText: row.finalText,
         childRunIds: children.map((c) => c.id),
+        steps,
+        stepsOmitted: Math.max(0, stepCount - newest.length),
+        stepsDropped: row.stepsDropped,
         coding: coding
             ? {
                 provider: coding.provider,