feat: append agent stats to 6 safe output write actions

Append a collapsible markdown stats block to safe outputs that produce
human-readable content. Each tool reads include_stats from its typed
config struct (deserialized via ctx.get_tool_config), matching the
existing config pattern used for all other tool options.

Safe outputs with stats:
- create-pull-request (PR description)
- create-work-item (work item description)
- comment-on-work-item (comment body)
- add-pr-comment (PR comment body)
- create-wiki-page (wiki page content)
- update-wiki-page (wiki page content)

Per-tool opt-out via front matter:
  safe-outputs:
    create-pull-request:
      include-stats: false

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jamesadevine

src/agent_stats.rs

@@ -147,7 +147,25 @@ impl AgentStats {
     }
 }
 
-/// Compute duration from OTel span startTime/endTime.
+/// Append agent stats markdown to a body string if stats are available
+/// and stats are not opted out.
+///
+/// Used by safe output executors after they read their typed config
+/// (which contains the `include_stats` field).
+pub fn append_stats_to_body(
+    body: &str,
+    ctx: &crate::safeoutputs::ExecutionContext,
+    include_stats: bool,
+) -> String {
+    if !include_stats {
+        return body.to_string();
+    }
+
+    match &ctx.agent_stats {
+        Some(stats) => format!("{}{}", body, stats.to_markdown()),
+        None => body.to_string(),
+    }
+}
 ///
 /// Times are `[seconds, nanoseconds]` arrays.
 fn compute_duration(span: &Value) -> f64 {

src/safeoutputs/add_pr_comment.rs

@@ -150,6 +150,9 @@ pub struct AddPrCommentConfig {
     /// If empty, all valid statuses are allowed.
     #[serde(default, rename = "allowed-statuses")]
     pub allowed_statuses: Vec<String>,
+    /// Whether to include agent execution stats in the output (default: true).
+    #[serde(default = "default_include_stats", rename = "include-stats")]
+    pub include_stats: bool,
 }
 
 impl Default for AddPrCommentConfig {
@@ -158,6 +161,7 @@ impl Default for AddPrCommentConfig {
             comment_prefix: None,
             allowed_repositories: Vec::new(),
             allowed_statuses: Vec::new(),
+            include_stats: true,
         }
     }
 }
@@ -286,6 +290,11 @@ impl Executor for AddPrCommentResult {
             Some(prefix) => format!("{}{}", prefix, self.content),
             None => self.content.clone(),
         };
+        let comment_body = crate::agent_stats::append_stats_to_body(
+            &comment_body,
+            ctx,
+            config.include_stats,
+        );
 
         // Build the API URL
         let url = format!(
@@ -578,6 +587,7 @@ allowed-statuses:
             comment_prefix: None,
             allowed_repositories: Vec::new(),
             allowed_statuses: vec!["Active".to_string(), "Closed".to_string()],
+            include_stats: true,
         };
         // Test the exact comparison logic extracted from execute_impl
         let status = "active";
@@ -598,6 +608,7 @@ allowed-statuses:
             comment_prefix: None,
             allowed_repositories: Vec::new(),
             allowed_statuses: vec!["active".to_string()],
+            include_stats: true,
         };
         let status = "Active";
         let matched = config
@@ -610,3 +621,7 @@ allowed-statuses:
         );
     }
 }
+
+fn default_include_stats() -> bool {
+    true
+}

src/safeoutputs/comment_on_work_item.rs

@@ -100,6 +100,10 @@ pub struct CommentOnWorkItemConfig {
     /// Target scope — which work items can be commented on.
     /// `None` means no target was configured; execution must reject this.
     pub target: Option<CommentTarget>,
+
+    /// Whether to include agent execution stats in the comment (default: true).
+    #[serde(default = "default_include_stats", rename = "include-stats")]
+    pub include_stats: bool,
 }
 
 /// Fetch a work item's area path from the ADO API
@@ -258,8 +262,13 @@ impl Executor for CommentOnWorkItemResult {
         );
         debug!("API URL: {}", url);
 
+        let body_with_stats = crate::agent_stats::append_stats_to_body(
+            &self.body,
+            ctx,
+            config.include_stats,
+        );
         let comment_body = serde_json::json!({
-            "text": self.body,
+            "text": body_with_stats,
         });
 
         info!("Sending comment to work item #{}", self.work_item_id);
@@ -472,3 +481,7 @@ target: "*"
         assert!(config.target.is_some());
     }
 }
+
+fn default_include_stats() -> bool {
+    true
+}

src/safeoutputs/create_pr.rs

@@ -456,6 +456,10 @@ pub struct CreatePrConfig {
     /// so operators can manually create the PR. No work item is created automatically.
     #[serde(default = "default_true", rename = "fallback-record-branch")]
     pub fallback_record_branch: bool,
+
+    /// Whether to include agent execution stats in the PR description (default: true).
+    #[serde(default = "default_true", rename = "include-stats")]
+    pub include_stats: bool,
 }
 
 fn default_target_branch() -> String {
@@ -500,6 +504,7 @@ impl Default for CreatePrConfig {
             labels: Vec::new(),
             work_items: Vec::new(),
             fallback_record_branch: true,
+            include_stats: true,
         }
     }
 }
@@ -1255,8 +1260,13 @@ impl Executor for CreatePrResult {
         }
         debug!("Changes pushed successfully");
 
-        // Append provenance footer to description
+        // Append provenance footer and agent stats to description
         let description_with_footer = format!("{}{}", self.description, generate_pr_footer());
+        let description_with_stats = crate::agent_stats::append_stats_to_body(
+            &description_with_footer,
+            ctx,
+            config.include_stats,
+        );
 
         // Create the pull request via REST API
         info!("Creating pull request");
@@ -1270,7 +1280,7 @@ impl Executor for CreatePrResult {
             "sourceRefName": source_ref,
             "targetRefName": target_ref,
             "title": effective_title,
-            "description": description_with_footer,
+            "description": description_with_stats,
             "isDraft": config.draft,
         });
 

src/safeoutputs/create_wiki_page.rs

@@ -132,9 +132,11 @@ pub struct CreateWikiPageConfig {
     /// Default commit comment used when the agent does not supply one.
     #[serde(default)]
     pub comment: Option<String>,
-}
 
-// ============================================================================
+    /// Whether to include agent execution stats in the output (default: true).
+    #[serde(default = "default_include_stats", rename = "include-stats")]
+    pub include_stats: bool,
+}
 // Path helpers
 // ============================================================================
 
@@ -321,7 +323,13 @@ impl Executor for CreateWikiPageResult {
             .header("Content-Type", "application/json")
             .header("If-Match", "")
             .basic_auth("", Some(token))
-            .json(&serde_json::json!({ "content": self.content }))
+            .json(&serde_json::json!({
+                "content": crate::agent_stats::append_stats_to_body(
+                    &self.content,
+                    ctx,
+                    config.include_stats,
+                )
+            }))
             .send()
             .await
             .context("Failed to create wiki page")?;
@@ -896,3 +904,7 @@ wiki-name: "MyProject.wiki"
         assert_eq!(encoded, "MyProject.wiki");
     }
 }
+
+fn default_include_stats() -> bool {
+    true
+}

src/safeoutputs/create_work_item.rs

@@ -98,6 +98,10 @@ pub struct CreateWorkItemConfig {
     #[serde(default, rename = "artifact-link")]
     #[sanitize_config(nested)]
     pub artifact_link: ArtifactLinkConfig,
+
+    /// Whether to include agent execution stats in the output (default: true).
+    #[serde(default = "default_include_stats", rename = "include-stats")]
+    pub include_stats: bool,
 }
 
 /// Configuration for artifact links (repository linking for GitHub Copilot)
@@ -141,6 +145,7 @@ impl Default for CreateWorkItemConfig {
             tags: Vec::new(),
             custom_fields: std::collections::HashMap::new(),
             artifact_link: ArtifactLinkConfig::default(),
+            include_stats: true,
         }
     }
 }
@@ -269,9 +274,14 @@ impl Executor for CreateWorkItemResult {
         debug!("API URL: {}", url);
 
         // Build the patch document for work item creation
+        let description_with_stats = crate::agent_stats::append_stats_to_body(
+            &self.description,
+            ctx,
+            config.include_stats,
+        );
         let mut patch_doc = vec![
             field_op("System.Title", &self.title),
-            field_op("System.Description", &self.description),
+            field_op("System.Description", &description_with_stats),
             // Tell Azure DevOps the description is markdown
             serde_json::json!({
                 "op": "add",
@@ -524,3 +534,7 @@ tags:
         assert_eq!(config.tags, vec!["my-tag"]);
     }
 }
+
+fn default_include_stats() -> bool {
+    true
+}

src/safeoutputs/update_wiki_page.rs

@@ -128,6 +128,10 @@ pub struct UpdateWikiPageConfig {
     /// Default commit comment used when the agent does not supply one.
     #[serde(default)]
     pub comment: Option<String>,
+
+    /// Whether to include agent execution stats in the output (default: true).
+    #[serde(default = "default_include_stats", rename = "include-stats")]
+    pub include_stats: bool,
 }
 
 // ============================================================================
@@ -316,7 +320,13 @@ impl Executor for UpdateWikiPageResult {
             .query(&put_query)
             .header("Content-Type", "application/json")
             .basic_auth("", Some(token))
-            .json(&serde_json::json!({ "content": self.content }));
+            .json(&serde_json::json!({
+                "content": crate::agent_stats::append_stats_to_body(
+                    &self.content,
+                    ctx,
+                    config.include_stats,
+                )
+            }));
 
         // Provide the ETag for optimistic concurrency when updating an existing page.
         if let Some(etag) = &etag {
@@ -857,3 +867,7 @@ wiki-name: "MyProject.wiki"
         assert_eq!(encoded, "MyProject.wiki");
     }
 }
+
+fn default_include_stats() -> bool {
+    true
+}