humanish 0.106.0 → 0.107.0

package/dist/routes/computer-use/plan.js

@@ -6,15 +6,15 @@ import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { actorRegistry, isCuaActorDescriptor, } from "../../actors/registry.js";
 import { isHttpUrl, isLoopbackUrl } from "../../lab/parse/subject.js";
 import { subjectStateInvalidReason } from "../../lab/parse/subject-state.js";
-import { brainOf, capsOf, desktopRequirements, planBase, provisionedSubject, } from "../../lab/plan-base.js";
+import { brainOf, callerBrainOf, capsOf, desktopRequirements, planBase, provisionedSubject, } from "../../lab/plan-base.js";
 import { computerUseParticipants, declaredTargets } from "../../lab/plan-participants.js";
 import { MAX_CUA_LANES } from "../../lab/routing.js";
 import { cloneTargetValidationReason, cuaLaneValidationReason, desktopMediaValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, scenarioCapsValidationReason, taskProtocolValidationReason, } from "../../lab/validation.js";
+import { desktopCliProductReason } from "../../lab/composition-rules.js";
 import { isLocalBrowserLab } from "../../substrates/local/runtime-config.js";
 import { boundedConcurrency, defaultSessionTimeoutMs, resolveParticipantSandboxMs, } from "./participant-runs.js";
 import { MAX_SANDBOX_MS } from "../../substrates/e2b/lifetime.js";
 import {} from "./types.js";
-import { participantDesktopOf } from "./participant-desktop.js";
 /** The registered descriptor for a planned actor id; planComputerUseLab checked the registry. */
 export function cuaDescriptorOf(actor) {
     const descriptor = actorRegistry[actor];
@@ -22,7 +22,7 @@ export function cuaDescriptorOf(actor) {
         throw new Error(`planned actor "${actor}" is not a registered computer-use actor`);
     return descriptor;
 }
-export function cuaSubjectRoute(config, hooks) {
+function declaredSubjectRoute(config, driving) {
     const cloneRoute = config.subject.source === "clone";
     const localTreeRoute = config.subject.source === "local-tree";
     const provisionedRoute = cloneRoute || localTreeRoute;
@@ -33,34 +33,36 @@ export function cuaSubjectRoute(config, hooks) {
         localTreeRoute,
         provisionedRoute,
         localAppSubject: config.subject.source === "local-app",
-        inProcessRoute: hooks.buildExecutor !== undefined,
+        inProcessRoute: driving.inProcess,
         serve,
         appUrl: (provisionedRoute ? serve?.url : config.subject.appUrl) ?? "",
         subjectRepo: cloneRoute ? (config.subject.repos?.[0] ?? "") : undefined,
         subjectEnvNames: provisionedRoute ? (config.subject.env ?? []) : [],
     };
 }
+/** The driving a computer-use run's options carry. */
+export function callerDrivingOf(options) {
+    return {
+        inProcess: options.inProcess !== undefined,
+        createProvider: options.createProvider !== undefined,
+    };
+}
 /** The state a planned run's provisioned subject declares. Other subjects declare none. */
 export function cuaDeclaredState(plan) {
     const { subject } = plan.runner;
     return subject.kind === "clone" || subject.kind === "local-tree" ? subject.state : undefined;
 }
-/** The route facts a planned run takes: its runner's desktop and subject. */
-export function cuaSubjectRouteOf(plan) {
-    const { desktop, subject } = plan.runner;
-    const provisioned = subject.kind === "clone" || subject.kind === "local-tree" ? subject : undefined;
-    return {
-        cloneRoute: subject.kind === "clone",
-        desktopCliRoute: subject.kind === "desktop-cli",
-        localTreeRoute: subject.kind === "local-tree",
-        provisionedRoute: provisioned !== undefined,
-        localAppSubject: subject.kind === "local-app",
-        inProcessRoute: desktop === "in-process",
-        serve: provisioned?.serve,
-        appUrl: provisioned?.serve.url ?? ("appUrl" in subject ? subject.appUrl : ""),
-        subjectRepo: subject.kind === "clone" ? subject.repo : undefined,
-        subjectEnvNames: [...(provisioned?.env ?? [])],
-    };
+/** The URL a refused lab's result names, from its declaration: a provisioned subject's serve URL. */
+export function declaredAppUrl(config) {
+    const { subject } = config;
+    const provisioned = subject.source === "clone" || subject.source === "local-tree";
+    return (provisioned ? subject.serve?.url : subject.appUrl) ?? "";
+}
+/** The URL a planned run's participants open: a provisioned subject's served URL, else its own. */
+export function plannedAppUrl(subject) {
+    if (subject.kind === "clone" || subject.kind === "local-tree")
+        return subject.serve.url;
+    return "appUrl" in subject ? subject.appUrl : "";
 }
 const invalid = (message) => ({
     code: "HUMANISH_CUA_LAB_SUBJECT_INVALID",
@@ -71,22 +73,22 @@ const invalid = (message) => ({
  * is touched. The parser enforces most of these too; the engine repeats them for library callers
  * that hand it a config directly. The groups run in this order, and each returns its first reason.
  */
-function cuaLabRejection(config, hooks, subjectRoute) {
-    return (unsupportedDeclarationReason(config, hooks, subjectRoute) ??
+function cuaLabRejection(config, hasRunSession, driving, subjectRoute) {
+    return (unsupportedDeclarationReason(config, hasRunSession, driving, subjectRoute) ??
         subjectStructureReason(config, subjectRoute) ??
         entryTargetReason(config, subjectRoute) ??
-        driverReason(config, hooks, subjectRoute) ??
+        driverReason(driving, subjectRoute) ??
         rosterShapeReason(config));
 }
 /** A declaration this route cannot honor, for any subject or with the caller's own driver. */
-function unsupportedDeclarationReason(config, hooks, { inProcessRoute }) {
+function unsupportedDeclarationReason(config, hasRunSession, driving, { inProcessRoute }) {
     const reason = desktopMediaValidationReason(config) ||
         outputTokenLimitValidationReason(config) ||
         scenarioCapsValidationReason(config);
     if (reason)
         return invalid(reason);
     if (config.actors[0]?.maxOutputTokens !== undefined &&
-        (hooks.runSession || hooks.buildProvider || hooks.buildExecutor))
+        (hasRunSession || driving.createProvider || driving.inProcess))
         return invalid("maxOutputTokens cannot be enforced by a custom runSession/provider/executor route.");
     const receivingReason = receivingEmailValidationReason(config);
     if (receivingReason)
@@ -150,14 +152,14 @@ function entryTargetReason(config, subjectRoute) {
             : "subject.appUrl and actors[0].lanes[].target entries must be valid http(s) URLs.",
     };
 }
-/** Something to drive the subject: the caller's executor with its provider, or a local desktop. */
-function driverReason(config, hooks, { localAppSubject, inProcessRoute }) {
+/** Something to drive the subject: the caller's executor with its provider. */
+function driverReason(driving, { localAppSubject, inProcessRoute }) {
     // A custom executor needs a custom provider too: the default OpenAI provider is vision-based
     // and would fail closed against an executor that returns no screenshot.
-    if (hooks.buildExecutor !== undefined && hooks.buildProvider === undefined)
+    if (driving.inProcess && !driving.createProvider)
         return {
             code: "HUMANISH_CUA_LAB_EXECUTOR_NO_PROVIDER",
-            message: "cuaHooks.buildExecutor requires cuaHooks.buildProvider — a state-driven executor returns no screenshot, so it must be paired with a NON-vision provider (the default OpenAI computer-use provider is vision-based and would fail closed).",
+            message: "RunLabOptions.inProcess requires RunLabOptions.createProvider — a state-driven executor returns no screenshot, so it must be paired with a NON-vision provider (the default OpenAI computer-use provider is vision-based and would fail closed).",
         };
     // There is no built-in in-process driver for a local app.
     if (localAppSubject && !inProcessRoute)
@@ -165,21 +167,12 @@ function driverReason(config, hooks, { localAppSubject, inProcessRoute }) {
             code: "HUMANISH_CUA_LAB_LOCAL_APP_NO_EXECUTOR",
             message: "subject.source: local-app has no built-in driver. Supply one through runLab(config, { inProcess: { executor }, createProvider }); a state-driven executor needs a non-vision provider.",
         };
-    // runLab gives a local browser study its desktop lane; a direct route call or an in-process
-    // executor on the same lab has none.
-    if (config.subject.source === "app-url" &&
-        config.execution?.target === "local" &&
-        participantDesktopOf(hooks) === undefined)
-        return {
-            code: "HUMANISH_CUA_LAB_LOCAL_DESKTOP_MISSING",
-            message: "An app-url lab with execution.target: local needs a local desktop. runLab starts one; a direct route call or an in-process executor does not.",
-        };
     return undefined;
 }
-/** The lane roster, then the sandbox deadline its session budget derives. */
+/** The participant roster, then the sandbox deadline its session budget derives. */
 function rosterShapeReason(config) {
-    // Lanes XOR count/laneFocus, device XOR raw resolution, cap, unique ids,
-    // allowPublicTargets with more than one lane, clone.fanout.
+    // `lanes` XOR `count`/`laneFocus`, device XOR raw resolution, cap, unique ids,
+    // allowPublicTargets with more than one participant, clone.fanout.
     const fanoutReason = cuaLaneValidationReason(config);
     if (fanoutReason)
         return { code: "HUMANISH_CUA_LAB_FANOUT_INVALID", message: fanoutReason };
@@ -194,12 +187,17 @@ function rosterShapeReason(config) {
     const headroomMs = derivedSandboxMs - sessionMs;
     return invalid(`execution.timeoutMs ${Math.round(sessionMs / 60_000)}m derives a ${Math.round(derivedSandboxMs / 60_000)}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is the session budget plus ${Math.round(headroomMs / 60_000)}m of provisioning and teardown headroom${provisionedRoute ? " (this route clones, installs, builds and serves the subject before the actor starts)" : ""}. Lower execution.timeoutMs to at most ${Math.round((MAX_SANDBOX_MS - headroomMs) / 60_000)}m, or set execution.desktop.sandboxTimeoutMs explicitly.`);
 }
+/** The plan's rerun: the source run and, when given, the participants to rerun. */
+function rerunPlan({ sourceRunId, participantIds, }) {
+    return { sourceRunId, ...(participantIds === undefined ? {} : { participantIds }) };
+}
 /**
  * Plan a computer-use lab. It is called for any config handed to the computer-use runner, not only
  * one routeOf sends here, so a config for another route gets this route's refusal.
  */
 export function planComputerUseLab(config, input) {
-    const hooks = input.hooks ?? {};
+    const hasRunSession = input.hasRunSession === true;
+    const driving = input.driving ?? { inProcess: false, createProvider: false };
     const refuse = (stage, code, message, actor) => ({
         ok: false,
         refusal: {
@@ -222,10 +220,10 @@ export function planComputerUseLab(config, input) {
     if (!descriptor || !isCuaActorDescriptor(descriptor))
         return refuse("in-scope", "HUMANISH_CUA_LAB_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered computer-use actor.`);
     const actor = descriptor.id;
-    const rejection = cuaLabRejection(config, hooks, cuaSubjectRoute(config, hooks));
+    const rejection = cuaLabRejection(config, hasRunSession, driving, declaredSubjectRoute(config, driving));
     if (rejection)
         return refuse("in-scope", rejection.code, rejection.message, actor);
-    // A shared world runs every seat against one app; this route would run them as separate lanes.
+    // A shared world runs every seat against one app; this route would run them as separate participants.
     // It comes after the rules above, so a shared-world config that breaks one of them, which runLab
     // sends here, still gets that rule's message.
     if (config.subject.topology === "shared-world")
@@ -233,35 +231,39 @@ export function planComputerUseLab(config, input) {
     // The in-process route drives subject.appUrl on this machine and creates no desktop, so it would
     // skip the subject a clone, local-tree or desktop-cli lab declares.
     const source = config.subject.source;
-    if (hooks.buildExecutor !== undefined &&
+    if (driving.inProcess &&
         (source === "clone" || source === "local-tree" || source === "desktop-cli"))
-        return refuse("in-scope", "HUMANISH_CUA_LAB_SUBJECT_INVALID", `cuaHooks.buildExecutor drives subject.appUrl in this process, and a ${source} subject needs the hosted desktop the in-process route never creates. Use an app-url or local-app subject with buildExecutor, or remove buildExecutor to run on a hosted desktop.`, actor);
-    // The parser refuses this too; without a product the desktop study fails later.
-    if (source === "desktop-cli" && config.subject.product?.name === undefined)
-        return refuse("in-scope", "HUMANISH_CUA_LAB_SUBJECT_INVALID", "desktop-cli subjects need `subject.product.name` — the CLI the participant is being asked to use.", actor);
+        return refuse("in-scope", "HUMANISH_CUA_LAB_SUBJECT_INVALID", `RunLabOptions.inProcess drives subject.appUrl in this process, and a ${source} subject needs the hosted desktop the in-process route never creates. Use an app-url or local-app subject with inProcess, or remove inProcess to run on a hosted desktop.`, actor);
+    // The parser's rule; without a product the desktop study fails later.
+    const productReason = desktopCliProductReason(config);
+    if (productReason)
+        return refuse("in-scope", "HUMANISH_CUA_LAB_SUBJECT_INVALID", productReason, actor);
     const participants = computerUseParticipants(config, input.countOverride);
     if (participants.length > MAX_CUA_LANES)
         return refuse("after-personas", "HUMANISH_CUA_LAB_FANOUT_INVALID", `Computer-use fan-out is capped at ${MAX_CUA_LANES} participants (resolved ${participants.length}); N concurrent paid desktops is real spend.`, actor);
     const [first, ...rest] = participants;
-    if (hooks.buildExecutor !== undefined && rest.length > 0)
-        return refuse("after-personas", "HUMANISH_CUA_LAB_FANOUT_INVALID", "Fan-out to more than one participant is not supported on the in-process route (RunLabOptions.inProcess, or the deprecated cuaHooks.buildExecutor): fan-out provisions one independent E2B desktop per participant, which the in-process route deliberately skips. Run a single in-process participant, or fan out on the E2B route.", actor);
+    if (driving.inProcess && rest.length > 0)
+        return refuse("after-personas", "HUMANISH_CUA_LAB_FANOUT_INVALID", "Fan-out to more than one participant is not supported on the in-process route (RunLabOptions.inProcess): fan-out provisions one independent E2B desktop per participant, which the in-process route deliberately skips. Run a single in-process participant, or fan out on the E2B route.", actor);
     if (first === undefined)
         throw new Error("computerUseParticipants returned no participant");
     const appUrl = config.subject.appUrl ?? "";
+    const declaredServeUrl = config.subject.serve?.url;
+    const serveUrl = declaredServeUrl === undefined ? {} : { serveUrl: declaredServeUrl };
     const appUrlSubject = {
         kind: "app-url",
         appUrl,
         publicTargets: config.policies?.allowPublicTargets === true,
+        ...serveUrl,
     };
     const product = config.subject.product;
     const hosted = source === "desktop-cli" && product !== undefined
-        ? { kind: "desktop-cli", product }
+        ? { kind: "desktop-cli", product, ...serveUrl }
         : (provisionedSubject(config) ?? appUrlSubject);
-    const brain = brainOf(config, hooks.buildProvider !== undefined);
-    const runner = hooks.buildExecutor !== undefined
+    const brain = brainOf(config, driving.createProvider);
+    const runner = driving.inProcess
         ? {
             desktop: "in-process",
-            brain: { kind: "caller" },
+            brain: callerBrainOf(config),
             participants: [first],
             subject: source === "local-app" ? { kind: "local-app", appUrl } : appUrlSubject,
         }
@@ -273,7 +275,6 @@ export function planComputerUseLab(config, input) {
     const provisioned = source === "clone" || source === "local-tree";
     const base = planBase(config, {
         dryRun: input.dryRun,
-        ...(input.lab === undefined ? {} : { lab: input.lab }),
         analysis,
     });
     return {
@@ -287,18 +288,11 @@ export function planComputerUseLab(config, input) {
             sessionBudgetMs: config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config),
             sandboxMs: resolveParticipantSandboxMs(config),
             caps: capsOf(config),
-            ...(input.rerun === undefined
-                ? {}
-                : {
-                    rerun: {
-                        sourceRunId: input.rerun.sourceRunId,
-                        ...(input.rerun.laneIds === undefined ? {} : { participantIds: input.rerun.laneIds }),
-                    },
-                }),
+            ...(input.rerun === undefined ? {} : { rerun: rerunPlan(input.rerun) }),
             requirements: base.dryRun || runner.desktop === "in-process"
                 ? []
                 : desktopRequirements(config, {
-                    e2b: runner.desktop === "e2b-desktop" && hooks.createDesktopLane === undefined,
+                    e2b: runner.desktop === "e2b-desktop",
                     brain,
                     localVm: runner.desktop === "local-vm",
                     externalCatch: !provisioned,

package/dist/routes/computer-use/preflight.d.ts

@@ -1,7 +1,6 @@
-import type { ComputerUsePlan } from "../../lab/plan-types.js";
+import type { Brain, ComputerUsePlan } from "../../lab/plan-types.js";
 import type { LabCommsExternal } from "../../lab/types.js";
-import { type LocalAgentId } from "../../actors/local-agent/cli.js";
-import type { CuaActorLabErrorCode, CuaActorLabHooks } from "./types.js";
+import type { CuaActorLabErrorCode } from "./types.js";
 /**
  * The first reason a live computer-use run cannot start on this machine: missing keys, a missing
  * or signed-out local agent, missing subject env, a spend cap with no price, or an unreachable
@@ -10,15 +9,11 @@ import type { CuaActorLabErrorCode, CuaActorLabHooks } from "./types.js";
  */
 export declare function liveCuaRejection(args: {
     caps: ComputerUsePlan["caps"];
-    /** The declared participant model; a spend cap needs its price. */
-    model: string | undefined;
-    hooks: CuaActorLabHooks;
+    /** The plan's brain: whether a local agent drives the participant, and the model a cap prices. */
+    brain: Brain;
     env: Record<string, string | undefined>;
-    openaiApiKey: string;
-    e2bApiKey: string;
-    localAgentRoute: boolean;
-    preferredLocalAgent: LocalAgentId;
-    subjectEnvNames: string[];
+    /** The plan's requirements: which keys and subject env names this run needs. */
+    requirements: ComputerUsePlan["requirements"];
     externalCommsConfig: LabCommsExternal | undefined;
 }): Promise<{
     code: CuaActorLabErrorCode;

package/dist/routes/computer-use/preflight.js

@@ -1,10 +1,11 @@
-import { DEFAULT_OPENAI_CU_MODEL } from "../../actors/computer-use/openai-provider.js";
+import { pricedModel } from "../../lab/plan-base.js";
+import { missingKeys, missingSubjectEnv } from "../../lab/requirements.js";
 import { detectLocalAgents } from "../../actors/local-agent/cli.js";
 import { localAgentRefusal } from "../../actors/local-agent/readiness.js";
 import { describeMissingKeys } from "../../keys/key-resolution.js";
+import { catchTokenOf, catchTokenRefusal } from "../../comms/external-evidence.js";
 import { externalCatchHealthy } from "../../comms/sandbox-catch.js";
 import { MODEL_RATES } from "../../run/pricing.js";
-import { participantDesktopOf } from "./participant-desktop.js";
 /** The computer-use code for each local-agent refusal; shared-world keeps the same kinds. */
 const LOCAL_AGENT_REFUSAL_CODES = {
     "agent-missing": "HUMANISH_CUA_LAB_AGENT_MISSING",
@@ -19,16 +20,16 @@ const LOCAL_AGENT_REFUSAL_CODES = {
  * already paid for a desktop.
  */
 export async function liveCuaRejection(args) {
-    const { caps, model, hooks, env, openaiApiKey, e2bApiKey, localAgentRoute, preferredLocalAgent, subjectEnvNames, externalCommsConfig, } = args;
-    const missingKeys = [
-        ...(openaiApiKey || localAgentRoute || hooks.buildProvider ? [] : ["OPENAI_API_KEY"]),
-        ...(e2bApiKey || participantDesktopOf(hooks) !== undefined ? [] : ["E2B_API_KEY"]),
-    ];
-    if (missingKeys.length > 0) {
+    const { caps, brain, env, requirements, externalCommsConfig } = args;
+    // The plan lists OPENAI_API_KEY only for an openai brain (a signed-in local agent or the
+    // caller's provider needs none) and E2B_API_KEY only when this run creates hosted desktops.
+    const localAgent = brain.kind === "local-agent" ? brain.agent : undefined;
+    const missing = missingKeys(requirements, env);
+    if (missing.length > 0) {
         // The moment someone new actually hits the wall. If a signed-in coding agent is sitting
         // right there, say so HERE rather than making them go and find an API key — that detour is
         // where most people trying humanish stop.
-        const suggestion = missingKeys.includes("OPENAI_API_KEY")
+        const suggestion = missing.includes("OPENAI_API_KEY")
             ? await (async () => {
                 const ready = (await detectLocalAgents({ env })).filter((agent) => agent.authStatus === "authenticated");
                 return ready.length === 0
@@ -39,21 +40,22 @@ export async function liveCuaRejection(args) {
             : "";
         return {
             code: "HUMANISH_CUA_LAB_KEYS_MISSING",
-            message: `Live computer-use labs need ${missingKeys.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missingKeys, env)}${suggestion}`,
+            message: `Live computer-use labs need ${missing.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missing, env)}${suggestion}`,
         };
     }
-    if (localAgentRoute && !hooks.buildProvider) {
+    // A caller's createProvider makes the brain `caller`, so only the lab's own local agent is checked.
+    if (localAgent) {
         // Refuse HERE, before a sandbox exists. "codex is not installed" discovered after the
         // machine is paid for is the same information delivered at the worst possible moment.
-        const refusal = await localAgentRefusal({ agent: preferredLocalAgent, env, caps });
+        const refusal = await localAgentRefusal({ agent: localAgent, env, caps });
         if (refusal)
             return { code: LOCAL_AGENT_REFUSAL_CODES[refusal.kind], message: refusal.message };
     }
-    const missingSubjectEnv = subjectEnvNames.filter((name) => !env[name]?.trim());
-    if (missingSubjectEnv.length > 0) {
+    const unsetSubjectEnv = missingSubjectEnv(requirements, env);
+    if (unsetSubjectEnv.length > 0) {
         return {
             code: "HUMANISH_CUA_LAB_SUBJECT_ENV_MISSING",
-            message: `subject.env declares ${missingSubjectEnv.join(", ")} but the environment does not provide ${missingSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`,
+            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`,
         };
     }
     // FAIL-CLOSED CAP TENSION (discipline #3): a maxUsd cap needs a MEASURABLE per-turn estimate.
@@ -63,18 +65,24 @@ export async function liveCuaRejection(args) {
     // uncapped: an unenforceable cap is more dangerous than none. The operator adds a rate to
     // src/run/pricing.ts (the honest place) or removes the cap.
     if (caps.maxUsd !== undefined || caps.maxTotalUsd !== undefined) {
-        const capModelId = (model ?? DEFAULT_OPENAI_CU_MODEL).trim().toLowerCase();
+        const model = pricedModel(brain);
+        const capModelId = model.trim().toLowerCase();
         if (!MODEL_RATES[capModelId]) {
             return {
                 code: "HUMANISH_CUA_LAB_UNPRICED_CAP",
-                message: `execution.caps declares a spend cap (maxUsd/maxTotalUsd) but src/run/pricing.ts has no rate for model "${model ?? DEFAULT_OPENAI_CU_MODEL}"; add a rate or remove the cap — an unenforceable cap is refused rather than run uncapped.`,
+                message: `execution.caps declares a spend cap (maxUsd/maxTotalUsd) but src/run/pricing.ts has no rate for model "${model}"; add a rate or remove the cap — an unenforceable cap is refused rather than run uncapped.`,
             };
         }
     }
     // Adopter-hosted comms catch (#380): fail closed BEFORE any sandbox is created — a comms lab
-    // whose catch is unreachable collects nothing while every lane still spends. The probe asserts
+    // whose catch is unreachable collects nothing while every participant still spends. The probe asserts
     // OUR service marker in /health, so an adopter's proxy answering 200 for everything cannot
     // pass for a catch.
+    const tokenRefusal = externalCommsConfig === undefined
+        ? undefined
+        : catchTokenRefusal(catchTokenOf(externalCommsConfig, env));
+    if (tokenRefusal !== undefined)
+        return { code: "HUMANISH_CUA_LAB_COMMS_TOKEN_INVALID", message: tokenRefusal };
     if (externalCommsConfig && !(await externalCatchHealthy(externalCommsConfig))) {
         return {
             code: "HUMANISH_CUA_LAB_COMMS_CATCH_UNREACHABLE",

package/dist/routes/computer-use/rerun-selection.js

@@ -99,13 +99,17 @@ function snapshotPriorParticipant(stream) {
     const reason = stream.ui?.state ?? stream.actor?.reason;
     const actions = stream.actor?.counts.actions ?? 0;
     const messages = stream.actor?.counts.messages ?? 0;
+    // The judge's status decides, so a participant the review counts as blocked is rerunnable. A
+    // bundle written before streams carried it falls back to the trace status and counts.
     const hollow = completionReason === "goal_satisfied" && actions === 0 && messages === 0;
-    const rerunnable = stream.status !== "passed" ||
-        actorStatus === "failed" ||
-        actorStatus === "blocked" ||
-        actorStatus === "timed_out" ||
-        completionReason === "harness_error" ||
-        hollow;
+    const rerunnable = stream.judgedStatus !== undefined
+        ? stream.judgedStatus !== "passed"
+        : stream.status !== "passed" ||
+            actorStatus === "failed" ||
+            actorStatus === "blocked" ||
+            actorStatus === "timed_out" ||
+            completionReason === "harness_error" ||
+            hollow;
     return {
         participantId: stream.laneId,
         previous: {

package/dist/routes/computer-use/result.d.ts

@@ -1,4 +1,4 @@
-import type { runLabParticipants } from "./run-lanes.js";
+import type { runLabParticipants } from "./live-phase.js";
 import type { CuaFinishFacts, CuaRunSetup } from "./setup.js";
 import { type CuaActorLabResult } from "./types.js";
 /** Builds and publishes the final bundle, runs the adapter hooks, renders the Observer and returns the result. */

package/dist/routes/computer-use/result.js

@@ -1,13 +1,14 @@
-import { adapterScoreFailureMessage, applyBrowserAdapterHooks, } from "../../lab/adapter-extension.js";
+import { adapterScoreFailureMessage, applyBrowserScorer } from "../../lab/adapter-extension.js";
 import { redactText } from "../../evidence/redaction.js";
 import { round6 } from "../../run/pricing.js";
 import { foldScorerFailures, judgeExecution, OUTCOME_POLICIES, participantHarnessFailed, resultOk, } from "../../run/judge.js";
-import { participantFactsOf, participantOutcomeOk } from "./participant-facts.js";
+import { participantFactsOf, participantOutcomeOk, unreleasedSandboxFailures, } from "./participant-facts.js";
 import { summarizeCuaDiagnostics } from "./diagnostics.js";
-import { toParticipantResult } from "./lanes.js";
+import { toParticipantResult } from "./participant-execution.js";
 import { buildCuaRunBundle, judgeComputerUseRun } from "./bundle.js";
 import { aggregateCuaSubject, projectParticipantSubjects, subjectProvenanceArg, } from "./subject-projection.js";
-import { CUA_ACTOR_LAB_SCHEMA, CUA_FANOUT_STRATEGY, } from "./types.js";
+import { CUA_ACTOR_LAB_SCHEMA, CUA_FANOUT_STRATEGY, participantSubjectEnv, } from "./types.js";
+import { plannedAppUrl } from "./plan.js";
 /** Aggregate participant counts for the result projection. */
 function buildParticipantSummary(outcomes, participantCount, participantPlan, dryRun) {
     if (dryRun || !outcomes) {
@@ -51,13 +52,14 @@ function buildParticipantSummary(outcomes, participantCount, participantPlan, dr
 }
 /**
  * The computer-use lab result for a finished run. The run passes only when the Observer rendered,
- * every lane passed (dry-run lanes pass as contracts), and no adapter score or declared scorer
+ * every participant passed (dry-run participants pass as contracts), and no adapter score or declared scorer
  * verdict failed; otherwise the error names the first reason.
  */
 function cuaLabResult(args) {
     const { labId, cwd, runId, appUrl, dryRun, participantRuns, outcomes, subjects, aggregateSubject, participantPlan, rerunLineage, bundle, observer, receivingWarnings, aggregateWarnings, adapterWarnings, } = args;
     const participantCount = participantRuns.length;
-    // Lane-level pass: dry-run lanes are contract-ok; live lanes need a passed, engaged session.
+    // Participant-level pass: dry-run participants are contract-ok; live ones need a passed,
+    // engaged session.
     const participantOk = (outcome) => participantOutcomeOk(outcome, dryRun);
     const adapterFailure = adapterScoreFailureMessage(bundle);
     const ok = resultOk({
@@ -81,10 +83,7 @@ function cuaLabResult(args) {
         if (ok)
             return undefined;
         if (adapterFailure !== undefined) {
-            return {
-                code: "HUMANISH_CUA_LAB_FAILED",
-                message: adapterFailure,
-            };
+            return { code: "HUMANISH_CUA_LAB_FAILED", message: adapterFailure };
         }
         if (participantCount === 1) {
             const outcome = firstOutcome;
@@ -92,9 +91,10 @@ function cuaLabResult(args) {
                 code: outcome?.failureCode ?? "HUMANISH_CUA_LAB_FAILED",
                 message: outcome?.sessionError ??
                     outcome?.providerCleanupError ??
+                    outcome?.providerPolicyError ??
                     (outcome?.noEngagement
                         ? "Actor took no actions and produced no message (likely a blank/still-loading screen); not a credible goal_satisfied."
-                        : // The lane result (toParticipantResult) named this refusal; the N=1 envelope fell through to
+                        : // The participant result (toParticipantResult) named this refusal; the N=1 envelope fell through to
                             // "did not produce a terminal session", which is false — it produced one and refused it.
                             outcome?.selfReportedBlocker
                                 ? "Actor reported goal_satisfied while its final message described a blocker or asked for missing instructions; not a credible pass."
@@ -164,10 +164,11 @@ function cuaLabResult(args) {
     };
 }
 /**
- * The run's execution failures: each lane whose session failed in the harness, and an Observer
- * that failed.
+ * The run's execution failures: each participant whose session failed in the harness, each provider whose
+ * cleanup is unconfirmed or that reported a disallowed item after its last request, each sandbox
+ * whose release is unconfirmed, and an Observer that failed.
  */
-function computerUseExecutionFailures(outcomes, observer) {
+function computerUseExecutionFailures(outcomes, observer, runId) {
     return [
         ...(outcomes ?? [])
             .filter((outcome) => participantHarnessFailed(participantFactsOf(outcome)))
@@ -183,6 +184,15 @@ function computerUseExecutionFailures(outcomes, observer) {
                     message: `${outcome.spec.planned.id}: ${outcome.providerCleanupError}`,
                 },
             ]),
+        ...(outcomes ?? []).flatMap((outcome) => outcome.providerPolicyError === undefined
+            ? []
+            : [
+                {
+                    kind: "provider-policy",
+                    message: `${outcome.spec.planned.id}: ${outcome.providerPolicyError}`,
+                },
+            ]),
+        ...unreleasedSandboxFailures(outcomes, runId),
         ...(observer.ok
             ? []
             : [
@@ -194,33 +204,34 @@ function computerUseExecutionFailures(outcomes, observer) {
     ];
 }
 /**
- * execution.caps.maxUsd is enforced inside each lane's loop independently, so an N-lane fan-out can
- * spend up to N × maxUsd before any lane aborts, while the run cost summary reports the larger
+ * execution.caps.maxUsd is enforced inside each participant's loop independently, so an
+ * N-participant fan-out can spend up to N × maxUsd before any participant aborts, while the run cost summary reports the larger
  * aggregate. The warning names that ceiling, unless the study declared a shared maxTotalUsd budget.
  */
-function participantCapWarning(config, participantCount) {
-    const capUsd = config.execution?.caps?.maxUsd;
+function participantCapWarning(caps, participantCount) {
+    const capUsd = caps.maxUsd;
     if (capUsd === undefined || participantCount <= 1)
         return undefined;
-    if (config.execution?.caps?.maxTotalUsd !== undefined)
+    if (caps.maxTotalUsd !== undefined)
         return undefined;
     return `execution.caps.maxUsd ($${capUsd}) is a PER-PARTICIPANT cap; ${participantCount} participants may spend up to ${participantCount} × $${capUsd} (~$${round6(capUsd * participantCount)} total) before any participant aborts. Set execution.caps.maxTotalUsd for a shared study budget.`;
 }
 /** Builds and publishes the final bundle, runs the adapter hooks, renders the Observer and returns the result. */
 export async function finishCuaRun(setup, finish, ran) {
-    const { plan, input, config, cwd, streams, descriptor, subjectRoute, run } = setup;
+    const { plan, input, cwd, streams, descriptor, run } = setup;
     const { participantRuns, participantPlan, scrubKnownValues, bundleBase } = setup;
-    const { hooks, rerunLineage, publicRepo, subjectArgs } = finish;
+    const { rerunLineage, publicRepo, subjectArgs } = finish;
     const { dryRun } = plan;
-    const { appUrl, subjectEnvNames } = subjectRoute;
+    const appUrl = plannedAppUrl(plan.runner.subject);
+    const subjectEnvNames = [...participantSubjectEnv(plan.runner.subject)];
     const { runId } = run;
     const participantCount = participantRuns.length;
     const { outcomes, failFastReason, receiving, receivingWarnings, externalCommsWarnings } = ran;
-    // Per-lane subject projections (invariant 5).
+    // Per-participant subject projections (invariant 5).
     const subjects = projectParticipantSubjects({ ...subjectArgs, outcomes, dryRun });
     const aggregate = aggregateCuaSubject({ subjects, outcomes, participantCount, dryRun });
     const aggregateSubject = aggregate.subject;
-    const capWarning = participantCapWarning(config, participantCount);
+    const capWarning = participantCapWarning(plan.caps, participantCount);
     const aggregateWarnings = [
         ...externalCommsWarnings,
         ...(capWarning === undefined ? [] : [capWarning]),
@@ -239,8 +250,8 @@ export async function finishCuaRun(setup, finish, ran) {
         ...(failFastReason === undefined ? {} : { failFastReason }),
     });
     const adapterWarnings = [];
-    const scorerResult = await applyBrowserAdapterHooks({
-        hooks,
+    const scorerResult = await applyBrowserScorer({
+        scorer: input.scorer,
         bundle,
         context: {
             bundle,
@@ -248,13 +259,12 @@ export async function finishCuaRun(setup, finish, ran) {
             labId: plan.labId,
             runId,
             actor: descriptor.id,
-            backend: "cua",
+            route: "computer-use",
             dryRun,
-            laneCount: participantCount,
+            participantCount,
         },
         sanitize: (text) => redactText(scrubKnownValues(text)),
         warnings: adapterWarnings,
-        hookLabel: "cuaHooks",
         ...(input.scorerProvenance === undefined ? {} : { scorerProvenance: input.scorerProvenance }),
     });
     // The one final verdict fold: scoring can only make the judged verdict stricter.
@@ -264,7 +274,7 @@ export async function finishCuaRun(setup, finish, ran) {
     const finished = await run.finish(bundle);
     const observer = await finished.renderObserver();
     streams.attachFinal(observer);
-    const execution = judgeExecution(computerUseExecutionFailures(outcomes, observer), OUTCOME_POLICIES["computer-use"]);
+    const execution = judgeExecution(computerUseExecutionFailures(outcomes, observer, runId), OUTCOME_POLICIES["computer-use"]);
     const result = cuaLabResult({
         labId: plan.labId,
         cwd,

package/dist/routes/computer-use/route.d.ts

@@ -11,7 +11,7 @@ import { type ComputerUseRunInput, type CuaActorLabResult, type RunCuaActorLabOp
 export declare function runCuaActorLab(options: RunCuaActorLabOptions): Promise<CuaActorLabResult>;
 /**
  * A refused computer-use lab's result, at the refusal's stage: a before-scope refusal has its own
- * envelope and no analysis record; the others come after the cwd checks, and the lane cap after
+ * envelope and no analysis record; the others come after the cwd checks, and the participant cap after
  * the personas are read.
  */
 export declare function computerUseLabRefusal(options: RunCuaActorLabOptions, refusal: ComputerUseRefusal): Promise<CuaActorLabResult>;
@@ -26,8 +26,7 @@ export declare function admitComputerUsePlan(plan: ComputerUsePlan, input: Compu
  * Run a computer-use plan: its local checks, then the run. The run scope in runAdmittedCuaRun
  * finalizes any status record the run opened, on every exit, so a test or library caller does not
  * leave the 5 s status cadence writing into a directory something else is deleting (an unrelated
- * ENOTEMPTY). Participants come from the plan. `config` is still read for values the plan does not
- * carry yet (the actor's model and local agent, persona ids, comms settings, the per-participant
- * cap) and by the compatibility hooks, which take the whole config.
+ * ENOTEMPTY). Participants, the brain, the subject, the caps and the residual config come from the
+ * plan. `config` is what the caller's createProvider and inProcess executor receive.
  */
 export declare function runComputerUsePlan(plan: ComputerUsePlan, input: ComputerUseRunInput, config: LabConfig): Promise<CuaActorLabResult>;