crewforth 3.1.0-rc.2 → 3.1.0-rc.4

package/kit/hooks/guard-schedule.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# guard-schedule.sh - a prompt a tool schedules is not the user's (§4.4).
+#
+# WHY. In `auto` and `dontAsk` the approval for a commit or a push is what the user types: `/crew-approve commit`,
+# recorded by hooks/prompt-approval.sh from UserPromptSubmit. A prompt that a tool SCHEDULES raises the same event
+# when it fires. So a session that scheduled `/crew-approve commit` would be approving its own commit.
+#
+# WHAT. Wired on PreToolUse for the tools that schedule a prompt (CronCreate, ScheduleWakeup, RemoteTrigger, and an
+# MCP tool whose name holds trigger, schedule, cron or later). The call is refused when ANY string in its input is
+# an approval, by the function that reads the user's own prompt: prompt-approval.sh is sourced for it, so there is
+# one definition of what an approval is. An ordinary scheduled prompt holds no such string and passes untouched.
+#
+# COST. One awk on these few tools, to take the strings out of the payload; nothing on any other tool call.
+# HONEST SCOPE. A tool this hook is not wired on, or a prompt put together only when it fires, is past it.
+set -uo pipefail
+# ---- CREW-LOCALE -----------------------------------------------------------------------------------------
+# Everything this gate matches with runs in the C locale, whatever the session's own is. Under a Turkish locale
+# the letters i and I are not each other's other case (their partners are İ and ı), and every case-insensitive
+# match here is written in ASCII. Measured under tr_TR.UTF-8 with the locale left as it came:
+#   GNU grep 3.11 / bash 5.2 on Linux: `grep -i init` does not find INIT (-F, -E and plain alike);
+#     bash's nocasematch does not match GIT against git; `[A-Za-z]` in a regex does not hold I; awk's tolower
+#     turns GIT into gıt. The suite, run whole under that locale, went from 4 failures to 30: a recursive
+#     Remove-Item, a write to a gate file, `git config --remove-section core`, a read of a nested .env and a
+#     staged key all passed.
+#   GNU grep 3.0 in Git Bash on Windows: `grep -iF` with an ASCII pattern aborts (exit 134), and the pre-commit
+#     scan for private strings read that as "no match".
+#   macOS (BSD grep, bash 3.2): none of it; tr_TR.UTF-8 folds i and I the ASCII way there.
+# The cost: a letter outside ASCII has no other case in the C locale. The two git hooks that scan a user's own
+# words look a second time under the session's locale for a pattern that holds such a letter (_CREW_LOCALE).
+# Byte-identical in every gate; the suite pins it.
+_CREW_LOCALE="${LC_ALL:-${LC_CTYPE:-${LANG:-}}}"
+case "$_CREW_LOCALE" in C|POSIX) _CREW_LOCALE="" ;; esac
+export LC_ALL=C
+# ---- /CREW-LOCALE
+# ---- CREW-FAILCLOSED ---------------------------------------------------------------------------------------
+# A gate that stops on an error of its own must refuse the call, not let it through. Claude Code blocks a tool call
+# on exit 2 only; a hook that dies with 1, or runs on past the rule that broke, has allowed it. Both happened in
+# one defect (measured, bash 5): a local array declared and not set is "unbound" under `set -u`, the rule that read
+# it was abandoned in the middle, the script went on with the NEXT top-level command and left with 0, and
+# `rm .claude/hooks/pre-commit` passed. bash does one of two things with such an error, by the kind of error:
+#   * it leaves the shell with a status that is neither 0 nor 2  -> the EXIT trap below turns that into a refusal;
+#   * it abandons the top-level command it was in and continues -> the whole gate IS one top-level command,
+#     _gate_main, which only ever ends by `exit`. If it RETURNS, it was abandoned, and the line after it refuses.
+# Not covered, and said so: an error inside a command substitution (only that subshell ends), and a command
+# that is not found (status 127, the script continues inside the same command).
+# Byte-identical in every PreToolUse gate; the suite pins it. No process is started.
+_crew_stop(){  # $1 = what happened
+  declare -F gatelog >/dev/null 2>&1 && gatelog BLOCK 4.5 "the gate stopped on an error of its own"
+  echo "GUARD (§4.5): this gate stopped on an error of its own ($1) before it finished judging the call, so the call is refused." >&2
+  echo "Nothing about the call itself was found. The error is the line above these two; it is a defect in Crewforth, not in what you ran. Run the doctor (bash .claude/eval/doctor.sh, Bash tool, not PowerShell) and report it." >&2
+  exit 2
+}
+trap '_crew_rc=$?; trap - EXIT; case "$_crew_rc" in 0|2) exit "$_crew_rc" ;; esac; _crew_stop "exit status $_crew_rc"' EXIT
+# ---- /CREW-FAILCLOSED
+_gate_main(){
+local here="${BASH_SOURCE%/*}" strs sv tn sch=0
+[ "$here" = "${BASH_SOURCE}" ] && here=.
+IFS= read -r -d '' INPUT || true
+if [ ! -f "$here/prompt-approval.sh" ]; then
+  echo "GUARD (§4.4): prompt-approval.sh is not beside this gate, so a scheduled prompt cannot be checked for an approval and the call is refused. Update Crewforth." >&2
+  exit 2
+fi
+. "$here/prompt-approval.sh"
+declare -F _crew_appr_op >/dev/null 2>&1 || { echo "GUARD (§4.4): prompt-approval.sh did not give the approval check, so the call is refused. Update Crewforth." >&2; exit 2; }
+_json_slice "$INPUT" tool_name >/dev/null; tn="$_JS"
+shopt -s nocasematch
+case "$tn" in *cron*|*schedul*|*trigger*|*later*|*wakeup*) sch=1 ;; esac
+shopt -u nocasematch
+[ "$sch" = 1 ] || exit 0
+# Every JSON string of at most 120 bytes, still escaped, one per line (a JSON string holds no raw newline). An
+# approval is a few words: a longer string is never one, and is not kept.
+strs="$(printf '%s' "$INPUT" | LC_ALL=C awk '{ buf = buf $0 " " } END { n = length(buf); ins = 0; esc = 0; s = ""; big = 0
+    for (i = 1; i <= n; i++) { c = substr(buf, i, 1)
+      if (!ins) { if (c == "\"") { ins = 1; s = ""; big = 0 }; continue }
+      if (esc) { esc = 0; if (!big) s = s c; continue }
+      if (c == "\\") { esc = 1; if (!big) s = s c; continue }
+      if (c == "\"") { ins = 0; if (!big) print s; continue }
+      if (!big) { s = s c; if (length(s) > 120) big = 1 } } }')" || {
+  echo "GUARD (§4.4): the prompt this call schedules could not be read (awk did not run), so the call is refused." >&2; exit 2; }
+while IFS= read -r sv; do
+  [ -n "$sv" ] || continue
+  _json_unescape "$sv" >/dev/null; _crew_appr_op "$_JU"
+  if [ -n "$OP" ]; then
+    echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
+    echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve $OP when they agree." >&2
+    exit 2
+  fi
+done <<< "$strs"
+exit 0
+}
+_gate_main "$@"
+_crew_stop "a command of the gate was abandoned"

package/kit/hooks/prompt-approval.sh

@@ -8,8 +8,8 @@
 # yes, and this hook is the only thing that turns it into a record.
 #
 # WHAT COUNTS. The WHOLE message, trimmed, is one of (letter case does not matter):
-#     approve: commit      approve: push      approve: commit+push
-#     onay: commit         onay: push         onay: commit+push
+#     /crew-approve commit      /crew-approve push      /crew-approve commit+push
+# and, as the release candidates of 3.1.0 had it, `approve: <what>` or `onay: <what>`.
 # A sentence that contains those words is not an approval, and neither is a message with a second line: text
 # that was pasted, quoted or relayed from somewhere else never has that shape by accident.
 #
@@ -51,8 +51,13 @@ _CREW_LOCALE="${LC_ALL:-${LC_CTYPE:-${LANG:-}}}"
 case "$_CREW_LOCALE" in C|POSIX) _CREW_LOCALE="" ;; esac
 export LC_ALL=C
 # ---- /CREW-LOCALE
-IFS= read -r -d '' INPUT || true
-case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*) ;; *) exit 0 ;; esac
+# guard-schedule.sh SOURCES this file for one thing, _crew_appr_op: which text is an approval is decided here and
+# nowhere else. Sourced, the file defines its functions and returns before anything is read or written.
+_PA_LIB=0; [ "${BASH_SOURCE[0]}" != "$0" ] && _PA_LIB=1
+if [ "$_PA_LIB" = 0 ]; then
+  IFS= read -r -d '' INPUT || true
+  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*) ;; *) exit 0 ;; esac
+fi
 # ---- CREW-JSON-PARSE ------------------------------------------------------------------------------------
 _json_find(){  # $1 = text, $2 = a literal -> _JF = the offset of its first occurrence, -1 when there is none
   # `${text%%"$literal"*}` gives the same offset and costs the DISTANCE to the occurrence times the length of the
@@ -351,6 +356,38 @@ _crew_appr_path(){  # $1 = a directory -> _AP: the record's path in that worktre
 }
 # ---- /CREW-APPROVAL-PATH ---------------------------------------------------------------------------------
 
+# ---- WHICH TEXT IS AN APPROVAL: one function, asked here of the user's prompt and by guard-schedule.sh of a
+# prompt a tool is about to schedule ---------------------------------------------------------------------------
+_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push, or "" when the text is not an approval
+  local P="$1" _k _v LC_ALL=C
+  OP=""
+  P="${P//$'\r'/}"
+  while :; do case "$P" in [$' \t\n']*) P="${P:1}" ;; *) break ;; esac; done
+  while :; do case "$P" in *[$' \t\n']) P="${P%?}" ;; *) break ;; esac; done
+  [ "${#P}" -le 40 ] || return 0
+  case "$P" in
+    *$'\n'*) return 0 ;;
+    # THE COMMAND: `/crew-approve <what>`, or `/<plugin>:crew-approve <what>` as a plugin names its commands. Measured
+    # on Claude Code 2.1.284: a command the user types reaches UserPromptSubmit with `prompt` as typed, and a skill
+    # the model starts with the Skill tool raises PreToolUse and PostToolUse only, never that event.
+    /*) _k="${P%%[$' \t']*}"; [ "$_k" != "$P" ] || return 0
+        _v="${P:${#_k}}"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
+    # The text form of 3.1.0's release candidates, kept: `approve: <what>` and `onay: <what>`.
+    *:*) _k="${P%%:*}"; _v="${P#*:}" ;;
+    *) return 0 ;;
+  esac
+  _k="${_k//[$' \t']/}"; _v="${_v//[$' \t']/}"
+  # In the C locale: under tr_TR an upper-case I does not fold to i, and `ONAY: COMMIT` was not an approval (review).
+  shopt -s nocasematch
+  case "$_k" in
+    @crew-approve|approve|onay)
+      case "$_v" in commit) OP=commit ;; push) OP=push ;; commit+push) OP=commit+push ;; esac ;;
+  esac
+  shopt -u nocasematch
+}
+
+[ "$_PA_LIB" = 1 ] && return 0
+
 # A second "prompt" key cannot come from the text of a prompt (inside a JSON string every quote is escaped), so
 # more than one means the payload is not the shape this hook knows, and nothing is read from it.
 _json_keycount "$INPUT" prompt; _n_prompt=$_KC
@@ -384,23 +421,8 @@ if [ -n "$REC" ] && [ -s "$REC" ]; then : > "$REC" 2>/dev/null || true; fi
 # ---- is this message an approval? ------------------------------------------------------------------------
 [ "$_n_prompt" = 1 ] || exit 0
 [ "${#RAW}" -le 120 ] || exit 0        # an approval is a few words; a pasted page is not decoded to find that out
-_json_unescape "$RAW" >/dev/null; P="$_JU"
-P="${P//$'\r'/}"
-while :; do case "$P" in [$' \t\n']*) P="${P:1}" ;; *) break ;; esac; done
-while :; do case "$P" in *[$' \t\n']) P="${P%?}" ;; *) break ;; esac; done
-[ "${#P}" -le 40 ] || exit 0
-case "$P" in *$'\n'*) exit 0 ;; *:*) ;; *) exit 0 ;; esac
-_k="${P%%:*}"; _v="${P#*:}"
-_k="${_k//[$' \t']/}"; _v="${_v//[$' \t']/}"
-OP=""
-# In the C locale: under tr_TR an upper-case I does not fold to i, and `ONAY: COMMIT` was not an approval (review).
-_pa_match(){ local LC_ALL=C; shopt -s nocasematch
-  case "$_k" in
-    approve|onay)
-      case "$_v" in commit) OP=commit ;; push) OP=push ;; commit+push) OP=commit+push ;; esac ;;
-  esac
-  shopt -u nocasematch; }
-_pa_match
+_json_unescape "$RAW" >/dev/null
+_crew_appr_op "$_JU"
 [ -n "$OP" ] || exit 0
 
 # From here on the message IS an approval, so every way of not recording it says why - to the user and to the
@@ -420,6 +442,31 @@ case "$PM" in
 esac
 [ -n "$REC" ] || no "this directory is not inside a git repository."
 
+# A PERSON, IN A SESSION THAT HAS SHOWN THEM SOMETHING. A session can start another one and hand it the approval as
+# its prompt: `claude -p "/crew-approve commit"`, or an interactive one driven through a pseudo-terminal. That
+# session's only message is the approval, this hook would record it, and the session would then commit: the first
+# session has approved for the user. Measured on Claude Code 2.1.294 (macOS), from a hook that printed what it saw:
+#   started how                                CLAUDE_CODE_SESSION_ATTENDED   the transcript file when this hook runs
+#   claude -p, from a session's Bash           0 (set to 1 by the caller: still 0)   not there (first message)
+#   claude -p, from an emptied environment     0                               not there (first message)
+#   interactive, in a pty, from a session      1                               not there, and never written: a
+#                                                                              session started inside another keeps none
+#   interactive, in a pty, emptied environment 1                               not there at the first message; there after
+#   the desktop app, a conversation under way  1                               there
+# Nothing else told them apart: the payload has the same fields, CLAUDECODE and CLAUDE_CODE_CHILD_SESSION are 1 in
+# all of them, CLAUDE_CODE_ENTRYPOINT is inherited from the outer session, and no hook has a terminal on stdin.
+# So two things are asked. Neither is a documented contract, and both fail towards NOT recording:
+#   1. the session is not a headless one;
+#   2. the session's transcript is already on disk when the approval arrives, so the approval is not the session's
+#      first message and the session is not one that keeps no transcript.
+# HONEST SCOPE: a session started with an emptied environment and driven through a pseudo-terminal for a second
+# message passes both. guard-bash.sh refuses the forms of that it can read; a program that types is past it.
+case "${CLAUDE_CODE_SESSION_ATTENDED-}" in
+  0) no "this session has nobody in front of it (it was started with -p, or by a program), and an approval is what a person types into their own session." ;;
+esac
+_json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+{ [ -n "$TP" ] && [ -s "$TP" ]; } || no "this is the first message of this session, or the session keeps no transcript (one started from inside another session keeps none). An approval answers a commit message the session has shown: have it shown, then approve."
+
 # The session the user is writing in. guard-bash.sh accepts the record only from that one: a session started by a
 # command can be handed any prompt.
 _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"

package/kit/settings.json

@@ -86,6 +86,17 @@
             "timeout": 600
           }
         ]
+      },
+      {
+        "matcher": "CronCreate|ScheduleWakeup|RemoteTrigger|mcp__.*([Tt]rigger|[Ss]chedul|[Cc]ron|[Ll]ater).*",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/guard-schedule.sh",
+            "timeout": 600
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/kit/skills/crew-approve/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: crew-approve
+description: Approve the commit or push Claude just showed you (auto and dontAsk modes).
+argument-hint: "[commit | push | commit+push]"
+disable-model-invocation: true
+metadata:
+  kind: command
+---
+# /crew-approve
+Argument: $ARGUMENTS
+
+The user typed this command. Typing it is the approval: `hooks/prompt-approval.sh` read the message itself and
+recorded it, tied to what is staged, to `HEAD` and to this session, for 30 minutes or until the user's next
+message. Nothing in this text records anything, and you cannot give this approval for the user.
+
+Read the line Crewforth added to this turn and do what it says:
+
+- **"approval recorded"**: run exactly what it names, each command alone in its call. A commit is
+  `git commit -m '…'` with the message you showed (single-quoted, or from a here-document with a quoted delimiter);
+  a push is `git push <remote> <branch>`. The review record of §4.6 is still required.
+- **"approval NOT recorded"**: tell the user the reason it gives, and run nothing.
+- **No such line**: the session is in a mode where the gate asks the user itself (`default`, `acceptEdits`), or
+  the argument was not `commit`, `push` or `commit+push`. Say which, and in the first case run the command and let
+  the gate's own prompt ask.
+
+Force-push and the rest of §4.5 are not opened by this.

package/kit/studio/server/index.js

@@ -19,6 +19,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { getFleet, measureSpawnCost } from './lib/fleet.js';
 import { projectDir, listSessions, findSession, listProjects, sessionCwd } from './lib/projects.js';
 import { buildGraph, agentDetail, conversation, STALE_MS } from './lib/graph.js';
+import { cachedUsage } from './lib/usage.js';
+
+const USAGE_BATCH = 12;
 import { palette } from './lib/palette.js';
 import { latestVersion, latestVersionCached, kitStatus } from './lib/kit.js';
 import { parsePeers, askAll, ask } from './lib/peers.js';
@@ -192,6 +195,21 @@ async function handle(req, res) {
     });
   }
 
+  // What a handful of sessions spent, for the navigator's rows. Asked for a few at a time and answered from a
+  // cache that lasts until a transcript grows: reading every transcript on the machine to draw a list is not
+  // something a page load should do.
+  if (url.pathname === '/api/usage') {
+    const ids = (url.searchParams.get('ids') ?? '').split(',').filter(Boolean).slice(0, USAGE_BATCH);
+    const usage = {};
+    for (const id of ids) {
+      const session = await findSession(id);
+      if (!session) continue;                 // a session on another machine: not read here, and not guessed
+      const u = await cachedUsage(session);
+      usage[id] = { durationMs: u.durationMs, workedMs: u.workedMs, tokens: u.tokens.total, cost: u.cost, unpriced: u.unpriced };
+    }
+    return sendJson(res, 200, { measured: true, usage });
+  }
+
   if (url.pathname === '/api/fleet') {
     const local = await getFleet();
     const mine = (local.sessions ?? []).map((sn) => ({ ...sn, origin: SELF_NAME, local: true }));

package/kit/studio/server/lib/graph.js

@@ -19,6 +19,8 @@ import path from 'node:path';
 
 import { readAll, contextFill } from './transcript.js';
 import { agentMetaFiles } from './projects.js';
+import { Usage, timesOf } from './usage.js';
+import { detailOf } from './permissions.js';
 
 const SESSION_NODE = 'session';
 
@@ -37,8 +39,12 @@ function textOf(content) {
  * pairs the first id with the status swallows the rest; measured on this
  * machine, one notice carried six ids and five were being dropped. Every id
  * seen since the previous status takes that status.
+ *
+ * `at` is when the record carrying the notice was written. A notice is not the end of an agent: Claude Code sends
+ * one each time a background agent stops, and the agent can be sent another message and work again. Whether a
+ * notice still stands is decided by comparing `at` with what the agent wrote afterwards.
  */
-function harvestCompletions(text, into) {
+function harvestCompletions(text, into, at = null) {
   if (!text || !text.includes('<task-id>')) return;
   const token = /<task-id>([^<]+)<\/task-id>|<status>([^<]+)<\/status>/g;
   let pending = [];
@@ -48,7 +54,7 @@ function harvestCompletions(text, into) {
       pending.push(m[1].trim());
     } else {
       const status = m[2].trim();
-      for (const id of pending) into.set(id, status);
+      for (const id of pending) into.set(id, { status, at });
       pending = [];
     }
   }
@@ -60,7 +66,10 @@ function scanMain(records) {
     startedAt: null, updatedAt: null,
     agentCalls: new Map(),   // toolUseId -> { subagentType, description }
     links: new Map(),        // toolUseId -> { agentId, status, model }
-    completions: new Map(),  // agentId  -> status
+    completions: new Map(),  // task id (an agent's, or a background command's) -> { status, at }
+    waves: new Map(),        // assistant message id -> wave number, in the order the messages were written
+    commands: new Map(),     // toolUseId -> the command a Bash call ran
+    background: new Map(),   // background task id -> { toolUseId, startedAt }
     owners: new Map(),       // toolUseId -> owner node id
     userTurns: 0,
   };
@@ -71,9 +80,11 @@ function scanMain(records) {
     if (r?.cwd && !out.cwd) out.cwd = r.cwd;
     if (r?.gitBranch && !out.gitBranch) out.gitBranch = r.gitBranch;
     if (r?.version && !out.version) out.version = r.version;
+    let at = null;
     if (r?.timestamp) {
       const t = Date.parse(r.timestamp);
       if (Number.isFinite(t)) {
+        at = t;
         if (out.startedAt === null || t < out.startedAt) out.startedAt = t;
         if (out.updatedAt === null || t > out.updatedAt) out.updatedAt = t;
       }
@@ -86,21 +97,30 @@ function scanMain(records) {
         for (const c of content) {
           if (c?.type === 'tool_use' && c.id) {
             out.owners.set(c.id, SESSION_NODE);
-            if (c.name === 'Agent') {
+            if (typeof c.input?.command === 'string') out.commands.set(c.id, c.input.command);
+            if (c.name === 'Agent' || c.name === 'Task') {
+              // The order the session called its agents in, and which calls were made together: the calls of one
+              // assistant message are one wave. A message is written as several records, one per block, and they
+              // share its id — so the wave is the message id, not the record.
+              const mid = r.message?.id ?? `record:${out.agentCalls.size}`;
+              if (!out.waves.has(mid)) out.waves.set(mid, out.waves.size + 1);
               out.agentCalls.set(c.id, {
                 subagentType: c.input?.subagent_type ?? null,
                 description: c.input?.description ?? null,
+                order: out.agentCalls.size + 1,
+                wave: out.waves.get(mid),
+                calledAt: at,
               });
             }
           }
         }
       }
-      harvestCompletions(textOf(content), out.completions);
+      harvestCompletions(textOf(content), out.completions, at);
     }
 
     if (r?.type === 'user') {
       out.userTurns += 1;
-      harvestCompletions(textOf(r.message?.content), out.completions);
+      harvestCompletions(textOf(r.message?.content), out.completions, at);
     }
 
     // Present on the record that carries a subagent's result, whatever its type.
@@ -108,19 +128,86 @@ function scanMain(records) {
     if (tur && typeof tur === 'object' && tur.agentId) {
       const id = r.message?.content?.find?.((c) => c?.type === 'tool_result')?.tool_use_id
         ?? r.toolUseID ?? null;
-      const entry = { agentId: tur.agentId, status: tur.status ?? null, model: tur.resolvedModel ?? null };
+      // `at` is when the answer was written: for a call the session waited on, that is when the agent reported.
+      const entry = { agentId: tur.agentId, status: tur.status ?? null, model: tur.resolvedModel ?? null, at };
       if (id) out.links.set(id, entry);
       else out.links.set(`agent:${tur.agentId}`, entry);
     }
-    if (r?.type === 'attachment') harvestCompletions(JSON.stringify(r.attachment ?? ''), out.completions);
+    // A command sent to the background answers at once with the id it runs under; its end comes later, as a notice.
+    if (tur && typeof tur === 'object' && typeof tur.backgroundTaskId === 'string') {
+      const id = r.message?.content?.find?.((c) => c?.type === 'tool_result')?.tool_use_id ?? null;
+      out.background.set(tur.backgroundTaskId, { toolUseId: id, startedAt: at });
+    }
+    if (r?.type === 'attachment') harvestCompletions(JSON.stringify(r.attachment ?? ''), out.completions, at);
   }
 
   return out;
 }
 
+/**
+ * Does a transcript stop in the middle of a turn? It does when the last thing in it is a tool call with no answer,
+ * or an answer the agent has not replied to. A turn that is over ends on the agent's own words.
+ */
+export function midTurn(records) {
+  for (let i = records.length - 1; i >= 0; i -= 1) {
+    const r = records[i];
+    if (r?.type !== 'assistant' && r?.type !== 'user') continue;
+    const content = r.message?.content;
+    if (r.type === 'user') return true;
+    return Array.isArray(content) && content.some((c) => c?.type === 'tool_use');
+  }
+  return false;
+}
+
+// How long after a notice an agent's own last record may be and still belong to the turn the notice ended. The
+// notice is written after the agent's last record, so anything later than this is the agent working again.
+const NOTICE_SLACK_MS = 5000;
+
+/**
+ * Does a completion notice still say how the agent stands? Not when the agent wrote to its transcript after it:
+ * it was sent another message and is working, or has worked, again.
+ */
+export function noticeStands(notice, lastOwnAt) {
+  if (!notice) return false;
+  if (notice.at == null || lastOwnAt == null) return true;
+  return lastOwnAt <= notice.at + NOTICE_SLACK_MS;
+}
+
+// A call that hands work to an agent is open for as long as that agent runs; it is not a call anyone is asked about.
+const DELEGATES = new Set(['Agent', 'Task']);
+const OPEN_DETAIL_MAX = 2000;
+
+/**
+ * The tool calls a transcript has asked for and has no result for yet, oldest first.
+ *
+ * A call is open while it runs and while it waits for someone to allow it; the transcript does not say which. It
+ * is what a session started in a terminal is asking about when the machine reports it as waiting for its user —
+ * the panel has no hook in such a session, so this is the only place the question can be read from.
+ */
+export function openCalls(records) {
+  const open = new Map();
+  for (const r of records) {
+    const content = r?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const c of content) {
+      if (r.type === 'assistant' && c?.type === 'tool_use' && c.id && !DELEGATES.has(c.name)) {
+        const at = Date.parse(r.timestamp ?? '');
+        const detail = detailOf(c.input);
+        open.set(c.id, {
+          toolUseId: c.id, toolName: c.name ?? 'unknown',
+          detail: detail === null ? null : detail.slice(0, OPEN_DETAIL_MAX),
+          at: Number.isFinite(at) ? at : null,
+        });
+      } else if (r.type === 'user' && c?.type === 'tool_result' && c.tool_use_id) open.delete(c.tool_use_id);
+    }
+  }
+  return [...open.values()];
+}
+
 /** Roll one agent's own transcript into the numbers its node shows. */
-async function scanAgent(file) {
+async function scanAgent(file, usage = null) {
   const { records } = await readAll(file);
+  usage?.add(records);
   const stats = {
     tools: {}, toolCount: 0, lastTool: null, errors: 0,
     tokens: null, startedAt: null, endedAt: null, turns: 0,
@@ -164,10 +251,12 @@ async function scanAgent(file) {
   stats.durationMs = stats.startedAt !== null && stats.endedAt !== null
     ? stats.endedAt - stats.startedAt
     : null;
+  stats.midTurn = midTurn(records);
+  stats.open = openCalls(records);
   return stats;
 }
 
-async function readAgentDir(subagentsDir) {
+async function readAgentDir(subagentsDir, usage = null) {
   const out = [];
   // Nested too: a workflow puts its agents under subagents/workflows/<id>/.
   for (const metaPath of await agentMetaFiles(subagentsDir)) {
@@ -185,7 +274,7 @@ async function readAgentDir(subagentsDir) {
     // `stats` needs the transcript read; a missing file is a normal state (the
     // agent has not written yet), so absence is a null rather than a throw.
     let stats = null;
-    if (mtime !== null) stats = await scanAgent(jsonl);
+    if (mtime !== null) stats = await scanAgent(jsonl, usage);
 
     out.push({
       agentId,
@@ -220,7 +309,9 @@ export const STALE_MS = 120000;
 export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
   const { records, malformed } = await readAll(session.file);
   const main = scanMain(records);
-  const agents = await readAgentDir(session.subagentsDir);
+  // What the session spent, its agents' tokens included and each response counted once.
+  const usage = new Usage().add(records);
+  const agents = await readAgentDir(session.subagentsDir, usage);
   const now = Date.now();
 
   // Ownership: session first, then every agent's own tool_use ids, so a nested
@@ -233,6 +324,8 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
   // toolUseId -> agentId, from the returning result record.
   const byToolUse = new Map();
   for (const [k, v] of main.links) if (!k.startsWith('agent:')) byToolUse.set(k, v);
+  const callOf = new Map();
+  for (const [k, v] of byToolUse) callOf.set(v.agentId, k);
 
   const nodes = [{
     id: SESSION_NODE,
@@ -248,13 +341,28 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
     tokens: contextFill(records),
     startedAt: main.startedAt,
     endedAt: main.updatedAt,
+    usage: { ...usage.result(), ...timesOf(records) },
+    // Commands sent to the background that no notice has ended, oldest first. A session that is over has none
+    // running whatever this says: the page shows them only while the session is live.
+    backgroundCommands: [...main.background]
+      .filter(([id]) => !main.completions.has(id))
+      .map(([id, b]) => ({ id, toolName: 'Bash', detail: main.commands.get(b.toolUseId) ?? null, startedAt: b.startedAt }))
+      .sort((x, y) => (x.startedAt ?? 0) - (y.startedAt ?? 0)),
+    // The newest call nothing has answered, the session's own or an agent's. Null when every call has its result.
+    openCall: [
+      ...openCalls(records).map((c) => ({ ...c, agentId: null, agentType: null })),
+      ...agents.flatMap((a) => (a.stats?.open ?? []).map((c) => ({ ...c, agentId: a.agentId, agentType: a.agentType ?? null }))),
+    ].sort((a, b) => (b.at ?? 0) - (a.at ?? 0))[0] ?? null,
   }];
   const edges = [];
 
   for (const a of agents) {
-    const call = a.toolUseId ? main.agentCalls.get(a.toolUseId) : null;
-    const link = a.toolUseId ? byToolUse.get(a.toolUseId) : null;
-    const completion = main.completions.get(a.agentId) ?? null;
+    // The call that started it: named by its own meta file, or found from the answer that named the agent.
+    const callId = a.toolUseId ?? callOf.get(a.agentId) ?? null;
+    const call = callId ? main.agentCalls.get(callId) : null;
+    const link = callId ? byToolUse.get(callId) : null;
+    const notice = main.completions.get(a.agentId) ?? null;
+    const completion = noticeStands(notice, a.stats?.endedAt ?? null) ? notice.status : null;
 
     // Order matters. A synchronous Agent call never produces a task
     // notification — it reports through toolUseResult.status instead. Reading
@@ -288,6 +396,11 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
       toolUseId: a.toolUseId,
       model: link?.model ?? null,
       launchStatus: link?.status ?? null,
+      // Started in the background, and its transcript stops in the middle of a turn. Such an agent can be quiet
+      // for a long time inside one tool call; whether it is still working is the live session's to say, so the
+      // page decides (graph-plan.js `settle`), not this file.
+      background: link?.status === 'async_launched',
+      midTurn: a.stats?.midTurn ?? false,
       parentId,
       tools: a.stats?.tools ?? {},
       toolCount: a.stats?.toolCount ?? 0,
@@ -299,6 +412,15 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
       endedAt: a.stats?.endedAt ?? null,
       durationMs: a.stats?.durationMs ?? null,
       updatedAt: a.mtime,
+      // Where it stands among the agents the session called: its place in the order of the calls, the wave it
+      // was called in, and when. Null for an agent the session's own transcript did not call (one a workflow
+      // started): nothing is known about its place from here.
+      order: call?.order ?? null,
+      wave: call?.wave ?? null,
+      calledAt: call?.calledAt ?? null,
+      // When it handed its result back: the answer to a call the session waited on, or the notice that ended a
+      // background agent. Null while it has not, and when no time was recorded.
+      reportedAt: link?.status === 'completed' ? (link.at ?? null) : (completion ? (notice.at ?? null) : null),
     });
 
     edges.push({ id: `${parentId}->${a.agentId}`, source: parentId, target: a.agentId, kind: 'spawn' });

package/kit/studio/server/lib/permissions.js

@@ -74,6 +74,16 @@ function gateMode(mode) {
   return typeof mode === 'string' && /^[A-Za-z]+$/.test(mode) ? `CREW_GATE_MODE=${mode} ` : '';
 }
 
+/**
+ * The most identifying field each tool has. Showing "Bash" alone would ask someone to approve a command they
+ * cannot see.
+ */
+export function detailOf(input) {
+  const i = input && typeof input === 'object' ? input : {};
+  const d = i.command ?? i.file_path ?? i.pattern ?? i.query ?? i.description ?? null;
+  return typeof d === 'string' ? d : null;
+}
+
 /** One pending request, as the panel needs to show it. */
 function readRequest(spool, file) {
   const toolUseId = file.replace(/\.json$/, '');
@@ -87,9 +97,7 @@ function readRequest(spool, file) {
   return {
     toolUseId,
     toolName: payload.tool_name ?? 'unknown',
-    // The most identifying field each tool has. Showing "Bash" alone would ask
-    // someone to approve a command they cannot see.
-    detail: input.command ?? input.file_path ?? input.pattern ?? input.query ?? input.description ?? null,
+    detail: detailOf(input),
     input,
     cwd: payload.cwd ?? null,
     // Who asked. Claude Code puts these in the hook's input only when the call comes from inside a subagent, so