feat(programs): B3 plumbing and tests — runProgram, adapter wiring, detection via runAgent

src/agent/gateway-session.ts

@@ -73,9 +73,9 @@ export function configureGatewayCredentialsForCI(
   };
 }
 
-// TODO(B2): CI credential loading belongs to the headless provider, not the
-// agent. Leaves with the rest of this module once RunInput carries resolved
-// inference auth.
+// TODO: CI credential loading belongs outside the agent. It leaves with the rest
+// of this module once RunInput carries resolved inference auth, later in the
+// refactor.
 export function configureGatewayFromCIEnvironment(
   projectId: number,
   region: CloudRegion,

src/agent/index.ts

@@ -30,22 +30,12 @@ export { resolveBinding, shouldDisableAsk } from './runner';
 export { LONGER_ASK_TIMEOUT_MS } from './wizard-ask-bridge';
 
 /**
- * Leaves in B2. Programs own credentials and the legacy adapter dies.
- * initializeAgent, executeAgent and buildRunTags are the pre-runAgent surface
- * that detection/agentic.ts and run-agent-legacy.ts still call; they go
- * through runAgent or leave with detection, and AgentErrorType, which
- * classifies executeAgent's failures, goes with them.
- * configureGatewayFromCIEnvironment is CI inference auth the headless provider
- * owns. flushScanReport becomes a progress event rather than a call.
- * downloadSkill leaves once the skill scan runs at load and skill install
- * becomes shared.
+ * Leaves later in the refactor. buildRunTags builds the trace tags runProgram
+ * and agentic detection send. configureGatewayFromCIEnvironment loads the CI
+ * gateway token. flushScanReport becomes a progress event rather than a call.
+ * downloadSkill leaves once skill install becomes shared.
  */
-export {
-  AgentErrorType,
-  buildRunTags,
-  initializeAgent,
-  runAgent as executeAgent,
-} from './agent-interface';
+export { buildRunTags } from './agent-interface';
 export { configureGatewayFromCIEnvironment } from './gateway-session';
 export { flushScanReport } from './yara-hooks';
 export { downloadSkill } from './tools';

src/agent/progress.ts

@@ -156,7 +156,7 @@ export interface SpinnerHandle {
 }
 
 /**
- * Context the agent attaches to a 401 so the host can pick the right copy.
+ * Context the agent attaches to a 401 so the caller can pick the right copy.
  *
  * `hasSettingsConflict` is true when a Claude Code settings file (project,
  * project-local, the user's global config, or managed) actually overrides the
@@ -185,7 +185,7 @@ export interface AuthErrorDetail {
   logFilePath: string;
 }
 
-/** One task as the host renders it. The same shape `WizardUI.syncTodos` takes. */
+/** One task as the caller renders it. The same shape `WizardUI.syncTodos` takes. */
 export interface TaskSnapshot {
   id?: string;
   source?: string;
@@ -207,7 +207,7 @@ export type ProgressLogLevel = 'info' | 'warn' | 'error' | 'success' | 'step';
 export type AgentProgress =
   /** The run's main work has started (`WizardUI.startRun`). */
   | { kind: 'lifecycle'; phase: 'started' }
-  /** The run finished and the host may show its outro (`WizardUI.outro`). */
+  /** The run finished and the caller may show its outro (`WizardUI.outro`). */
   | { kind: 'lifecycle'; phase: 'completed'; message: string }
   /** The run spinner (`WizardUI.spinner()`), one handle per run. */
   | {
@@ -246,7 +246,7 @@ export type ProgressEmitter = (event: AgentProgress) => void;
  * so `wizard_ask` returns its existing "not available" error, and an optional
  * task notice is declined — the same path a `--ci` run takes today.
  * Each request's `signal` aborts when that request times out, the run's
- * signal aborts, or another task fails the run. On that abort the host
+ * signal aborts, or another task fails the run. On that abort the caller
  * dismisses that request alone, and that dismissal must not throw: abort
  * listeners run where the agent cannot catch them, so Node would rethrow the
  * error as an uncaught exception.

src/agent/runner/harness/anthropic/index.ts

@@ -90,6 +90,7 @@ export const anthropicBackend: AgentHarness = {
         abortCases: config.abortCases,
         emitStepEvents: config.trackStepProgress ?? false,
         resolveStepKey: config.resolveStepKey,
+        requestRemark: config.requestRemark,
         triageProvider: boot.triageProvider,
       },
       middleware,

src/agent/runner/index.ts

@@ -36,6 +36,10 @@ import type {
 } from './shared/types';
 import { prepareRun } from './shared/bootstrap';
 import { createProgressCollector } from './shared/progress-collector';
+import {
+  createTranscriptTail,
+  type TranscriptTail,
+} from './shared/transcript-tail';
 import { getSequence } from './switchboard';
 import { flushScanReport } from '@agent/yara-hooks';
 
@@ -80,9 +84,15 @@ export async function runAgent(
   options: RunAgentOptions = {},
 ): Promise<RunResult> {
   let collector: ReturnType<typeof createProgressCollector> | undefined;
+  let transcript: TranscriptTail | undefined;
   const snapshot = (): RunResult['snapshot'] => {
     try {
-      if (collector) return collector.snapshot();
+      if (collector) {
+        const collected = collector.snapshot();
+        return transcript
+          ? { ...collected, transcriptTail: transcript.text() }
+          : collected;
+      }
     } catch {
       // A partial snapshot must not replace the run's primary failure.
     }
@@ -98,6 +108,8 @@ export async function runAgent(
     };
   };
   const flushReport = (): void => {
+    // A deferred report keeps counting this run's scans toward the program run's.
+    if (config.scanReport === 'defer') return;
     try {
       const report = flushScanReport({ yaraReport: input.flags.yaraReport });
       if (report)
@@ -110,6 +122,7 @@ export async function runAgent(
   try {
     collector = createProgressCollector(options.onProgress);
     const { emit } = collector;
+    if (config.run.collectTranscript) transcript = createTranscriptTail(emit);
     const log = (message: string) =>
       emit({ kind: 'log', level: 'info', message });
     if (options.signal?.aborted) {
@@ -143,6 +156,7 @@ export async function runAgent(
       emit,
       interaction: options.interaction,
       signal: options.signal,
+      transcript,
     });
     result = {
       ...(options.signal?.aborted &&

src/agent/runner/sequence/linear.ts

@@ -19,19 +19,20 @@ import { AGENT_ERROR_CODE } from '@agent/error-map';
 import { analytics } from '@utils/analytics';
 import { formatYaraAbortMessage } from '@agent/yara-hooks';
 import { installSkillById } from '@agent/tools';
-import { assemblePrompt } from '../../agent-prompt';
+import { assemblePrompt, type PromptContext } from '../../agent-prompt';
 import type { SequenceResult, SequenceContext } from '../shared/types';
 import { failed, installFailure } from '../shared/errors';
 import { RunOutcome } from '../shared/types';
 import { shouldDisableAsk, runOptions } from '../shared/bootstrap';
 import { createEmitSpinner } from '../shared/progress-collector';
 import { createAskBridge } from '../shared/ask';
+import { withTranscript } from '../shared/transcript-tail';
 import { getHarness } from '../switchboard';
 
 export async function runLinearProgram(
   context: SequenceContext,
 ): Promise<SequenceResult> {
-  // Aborts on the host's signal or when the run ends, so no ask outlives it.
+  // Aborts on the caller's signal or when the run ends, so no ask outlives it.
   const controller = new AbortController();
   const abortFromHost = () => controller.abort();
   context.signal?.addEventListener('abort', abortFromHost, { once: true });
@@ -44,9 +45,17 @@ export async function runLinearProgram(
   }
 }
 
-/** The host's `signal` decides the outcome; `runSignal` also ends with the run. */
+/** The caller's `signal` decides the outcome; `runSignal` also ends with the run. */
 async function executeLinear(
-  { config, input, boot, emit, interaction, signal }: SequenceContext,
+  {
+    config,
+    input,
+    boot,
+    emit,
+    interaction,
+    signal,
+    transcript,
+  }: SequenceContext,
   runSignal: AbortSignal,
 ): Promise<SequenceResult> {
   const { run, composed } = config;
@@ -96,12 +105,15 @@ async function executeLinear(
         signal: runSignal,
       });
 
-  const middleware = input.flags.benchmark
-    ? createBenchmarkPipeline(emit, spinner, runOptions(input))
-    : undefined;
+  const middleware = withTranscript(
+    input.flags.benchmark
+      ? createBenchmarkPipeline(emit, spinner, runOptions(input))
+      : undefined,
+    transcript,
+  );
 
   // 7. Build prompt
-  const prompt = assemblePrompt(run, {
+  const promptContext: PromptContext = {
     projectId,
     projectApiKey,
     host,
@@ -115,7 +127,10 @@ async function executeLinear(
           surveys: project.surveys_opt_in ?? null,
         }
       : null,
-  });
+  };
+  const prompt = run.prompt
+    ? run.prompt(promptContext)
+    : assemblePrompt(run, promptContext);
   logToFile(`[agent-runner] prompt assembled (${prompt.length} chars)`);
   if (signal?.aborted) return aborted();
 
@@ -178,7 +193,7 @@ async function executeLinear(
       matched: matched?.message ?? null,
     });
     return {
-      // An agent that stops itself failed the run; only the host's signal cancels it.
+      // An agent that stops itself failed the run; only the caller's signal cancels it.
       outcome: signal?.aborted ? RunOutcome.Aborted : RunOutcome.Failed,
       failure: {
         message: matched?.message ?? `${run.integrationLabel} aborted`,

src/agent/runner/shared/bootstrap.ts

@@ -85,7 +85,7 @@ export async function prepareRun(
   // readers re-resolve through the cache, which re-mints past the refresh
   // point.
   const currentGatewayAuth = () =>
-    // TODO(B2): the agent must not mint inference auth. It receives the
+    // TODO: the agent must not mint inference auth. It receives the
     // PostHog token here and derives a gateway token from it, re-minting near
     // expiry. Programs own credentials (stack plan 4.5): pass a resolved
     // inference-auth provider on RunInput.credentials and move

src/agent/runner/shared/transcript-tail.ts

@@ -0,0 +1,89 @@
+/** The SDK message observer behind `collectTranscript`: a capped text tail plus one `activity` line per step. */
+
+import type { ProgressEmitter } from '@agent/progress';
+import type { RunMiddleware } from '../harness/types';
+
+/** Only the tail is kept: a caller's report is the run's last output. */
+export const TRANSCRIPT_TAIL_CHARS = 256 * 1024;
+const ACTIVITY_LINE_CHARS = 100;
+
+export interface TranscriptTail extends RunMiddleware {
+  /** The kept assistant text, one block per line, then the final result. */
+  text(): string;
+}
+
+export function createTranscriptTail(emit: ProgressEmitter): TranscriptTail {
+  const collected: string[] = [];
+  let collectedChars = 0;
+  let resultText = '';
+
+  const collect = (text: string): void => {
+    collected.push(text);
+    collectedChars += text.length;
+    while (collectedChars > TRANSCRIPT_TAIL_CHARS && collected.length > 1) {
+      collectedChars -= collected.shift()?.length ?? 0;
+    }
+  };
+  const activity = (line: string): void => emit({ kind: 'activity', line });
+
+  return {
+    onMessage(message: any): void {
+      if (message?.type === 'assistant') {
+        const content = message.message?.content;
+        if (!Array.isArray(content)) return;
+        for (const block of content) {
+          if (block?.type === 'text' && typeof block.text === 'string') {
+            collect(block.text);
+            const line = block.text.trim();
+            if (line) {
+              activity(
+                line.length > ACTIVITY_LINE_CHARS
+                  ? `${line.slice(0, ACTIVITY_LINE_CHARS)}…`
+                  : line,
+              );
+            }
+          } else if (block?.type === 'tool_use') {
+            activity(formatToolUse(block));
+          }
+        }
+      } else if (
+        message?.type === 'result' &&
+        typeof message.result === 'string'
+      ) {
+        resultText = message.result;
+      }
+    },
+    finalize: () => undefined,
+    text: () => `${collected.join('\n')}\n${resultText}`,
+  };
+}
+
+/** Put the tail in front of any other middleware, so both see every message. */
+export function withTranscript(
+  middleware: RunMiddleware | undefined,
+  transcript: TranscriptTail | undefined,
+): RunMiddleware | undefined {
+  if (!transcript) return middleware;
+  if (!middleware) return transcript;
+  return {
+    onMessage(message) {
+      transcript.onMessage(message);
+      middleware.onMessage(message);
+    },
+    finalize(resultMessage, totalDurationMs) {
+      transcript.finalize(resultMessage, totalDurationMs);
+      return middleware.finalize(resultMessage, totalDurationMs);
+    },
+  };
+}
+
+function formatToolUse(block: any): string {
+  const name = typeof block?.name === 'string' ? block.name : 'tool';
+  const input = (block?.input ?? {}) as Record<string, unknown>;
+  const detail =
+    (input.file_path as string) ||
+    (input.pattern as string) ||
+    (input.path as string) ||
+    '';
+  return detail ? `${name} ${detail}` : name;
+}

src/agent/runner/shared/types.ts

@@ -21,6 +21,7 @@ import type { LLMProvider } from '@posthog/warlock';
 import type { AgentInteraction, ProgressEmitter } from '@agent/progress';
 import type { EffortLevel } from '../switchboard/models';
 import type { SwitchboardCtx } from '../switchboard';
+import type { TranscriptTail } from './transcript-tail';
 
 export type { PromptContext, Credentials };
 
@@ -152,7 +153,7 @@ export interface RunConfig {
   programId: string;
   /** The run definition. A program's session-taking hooks are the caller's, see `hooks`. */
   run: AgentRunDefinition;
-  /** A composed sub-run leaves the terminal outro to its host. */
+  /** A composed sub-run leaves the terminal outro to its caller. */
   composed: boolean;
   /** Run-level sequence, harness and model. */
   binding: ResolvedBinding;
@@ -332,4 +333,6 @@ export interface SequenceContext {
   emit: ProgressEmitter;
   interaction: AgentInteraction | undefined;
   signal?: AbortSignal;
+  /** Present when the run definition sets `collectTranscript`. */
+  transcript?: TranscriptTail;
 }

src/agent/types.ts

@@ -33,10 +33,10 @@ export type {
 /** Leaves when the bindings table moves to programs. */
 export type { ProgramBinding, SwitchboardCtx } from './runner';
 
-/** Leaves in B2 with downloadSkill. */
+/** Leaves with downloadSkill, later in the refactor. */
 export type { InstallSkillResult } from './tools';
 
-/** Leaves in B2 with the legacy adapter that records it. */
+/** Leaves with the legacy adapter that records it. */
 export type { TaskOutcome } from './runner';
 
 /** Leaves in C2 with runMcpPromptViaSdk. */

src/lib/wizard-session.ts

@@ -26,7 +26,7 @@ import type {
 } from '@agent/types';
 // Leaf module on purpose: shared analytics imports this file, so the agent
 // entry would form a module cycle here.
-// eslint-disable-next-line @typescript-eslint/no-restricted-imports -- B2: the session becomes a TUI projection
+// eslint-disable-next-line @typescript-eslint/no-restricted-imports -- the session becomes a TUI projection later in the refactor
 import { OutroKind } from '@agent/progress';
 import { DiscoveredFeature } from '@shared/discovered-feature';