humanish 0.106.0 → 0.107.0

package/dist/routes/shared-world/external-public.js

@@ -1,8 +1,8 @@
-// EXTERNAL-PUBLIC plane (#164 phase 2): NO subject sandbox, NO getHost, NO prober. The shared plane
+// External-public plane (#164 phase 2): no subject sandbox, no getHost, no prober. The shared plane
 // is the operator-declared public deployment (publicAppUrl); each seat opens it directly and reaches
 // the shared session through the real UI. A host-first barrier extracts the /lobby/CODE from the host
 // seat's CDP-observed URL (onObservedUrl) and threads it into the follower missions; a follower fails
-// closed WITHOUT opening if the host never yields a code within the handoff deadline.
+// closed without opening if the host never yields a code within the handoff deadline.
 import { liveObserverResult } from "../../observer/live.js";
 import { redactText, toErrorMessage } from "../../evidence/redaction.js";
 import { mapWithConcurrency } from "../../run/concurrency.js";
@@ -11,37 +11,37 @@ import { drainExternalComms } from "./comms.js";
 import { LobbyHandoff, runFollower, runHost } from "./handoff.js";
 import { readLobbyCodeFromFrame } from "./lobby-code.js";
 import { hostOriginDigest } from "./provenance.js";
-import { participantRunDeps, startParticipantFlush } from "./seats.js";
+import { participantRunDeps, startParticipantFlush } from "./participant-specs.js";
 /**
- * The operator-DECLARED origin (from subject.appUrl) — recorded for evidence/reference ONLY. The
- * operator-OWNERSHIP claim rests on the subject.publicTarget.authorized attestation + this declared
- * appUrl, NOT on digest equality (blocker 2): a normal cross-origin redirect (apex->www, http->https;
- * lobby-trivia.example.test 307-redirects) makes the seats' OBSERVED origin differ from the declared one, which
- * is expected and MUST NOT fail the run. Persisted digest-only (never the raw origin).
+ * The operator-declared origin (from subject.appUrl), recorded for evidence and reference only. The
+ * operator-ownership claim rests on the subject.publicTarget.authorized attestation + this declared
+ * appUrl; digest equality plays no part (blocker 2): a normal cross-origin redirect (apex->www, http->https;
+ * lobby-trivia.example.test 307-redirects) makes the seats' observed origin differ from the declared one, which
+ * is expected and must not fail the run. Persisted digest-only (never the raw origin).
  */
 export function declaredOriginDigestOf(publicAppUrl) {
     return publicAppUrl ? hostOriginDigest(publicAppUrl) : undefined;
 }
 export async function runExternalPublicPlane(ctx, live, inbox) {
-    const { plan, hooks, actorSpecs, concurrency, warnings } = ctx;
+    const { plan, deps: seams, actorSpecs, concurrency, warnings } = ctx;
     const participants = plan.plane.participants;
-    // publicAppUrl is the operator-declared shared plane; its ORIGIN is persisted digest-only
-    // (publicOriginDigest), never raw (the raw URL + the runtime observed lobby CODE never land —
-    // TENSION 3). The latch code is scrubbed from all narration.
+    // publicAppUrl is the operator-declared shared plane; its origin is persisted digest-only
+    // (publicOriginDigest), never raw (the raw URL and the runtime observed lobby code never land in
+    // the bundle). The latch code is scrubbed from all narration.
     const publicAppUrl = plan.plane.kind === "external-public" ? plan.plane.appUrl : "";
     const declaredOriginDigest = declaredOriginDigestOf(publicAppUrl);
     const handoff = new LobbyHandoff({
         participantCount: participants.length,
         timeoutMs: ctx.timeoutMs,
-        deadlineMs: hooks.handoffDeadlineMs,
+        deadlineMs: seams.handoffDeadlineMs,
         scrubKnownValues: ctx.scrubKnownValues,
         // The per-seat vision lobby-code reader (default: the real single-frame OpenAI read). Injectable
         // so the barrier's handoff + convergence proof are testable without a live vision call.
-        readLobbyCode: hooks.readLobbyCodeFromFrame ?? readLobbyCodeFromFrame,
+        readLobbyCode: seams.readLobbyCodeFromFrame ?? readLobbyCodeFromFrame,
         openaiApiKey: ctx.openaiApiKey,
     });
     const deps = {
-        // Scrub the latched lobby CODE (known once the host resolves it) from ALL narration.
+        // Scrub the latched lobby code (known once the host resolves it) from all narration.
         runDeps: participantRunDeps(ctx, live, handoff.scrub),
         publicAppUrl,
         inbox,
@@ -51,11 +51,10 @@ export async function runExternalPublicPlane(ctx, live, inbox) {
     // provisioned path.
     const snapshotArgs = {
         plan,
+        run: ctx.run,
         descriptor: ctx.descriptor,
-        createdAt: ctx.createdAt,
         dryRun: false,
         inProgress: true,
-        runId: ctx.runId,
         source: ctx.source,
         actorSpecs,
         actorResults: [],
@@ -63,8 +62,8 @@ export async function runExternalPublicPlane(ctx, live, inbox) {
         subject: { source: "app-url", envNames: [], state: { provenance: "external-public" } },
         seedDigest: ctx.seedDigest,
         planeClass: "external-public",
-        // Pre-fan-out snapshot: no seat has observed an origin yet, so the OBSERVED publicOriginDigest
-        // is not available; surface the DECLARED origin for the live Observer's reference.
+        // Pre-fan-out snapshot: no seat has observed an origin yet, so the observed publicOriginDigest
+        // is not available; surface the declared origin for the live Observer's reference.
         ...(declaredOriginDigest === undefined ? {} : { declaredOriginDigest }),
     };
     const inProgressBundle = buildConcurrentSharedWorldBundle({
@@ -85,7 +84,7 @@ export async function runExternalPublicPlane(ctx, live, inbox) {
     let runError;
     let commsArtifactPath;
     // Split the roster into the designated host and the followers, preserving each follower's
-    // ORIGINAL plan index so results land back in plan order (validation guarantees EXACTLY ONE host).
+    // original plan index so results land back in plan order (validation allows exactly one host).
     const hostIndex = participants.findIndex((participant) => participant.host === true);
     const followerEntries = actorSpecs
         .map((spec, index) => ({ spec, index }))

package/dist/routes/shared-world/handoff.d.ts

@@ -1,7 +1,7 @@
 import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
-import { type ParticipantRunDeps } from "./seats.js";
+import { type ParticipantRunDeps } from "./participant-specs.js";
 import type { ActorRunResult, ExternalCommsWiring } from "./types.js";
-/** What the host and follower lanes need besides the handoff. */
+/** What the host and follower participants need besides the handoff. */
 export interface HandoffParticipantDeps {
     runDeps: ParticipantRunDeps;
     publicAppUrl: string;
@@ -10,7 +10,7 @@ export interface HandoffParticipantDeps {
 }
 /**
  * The handoff latch, its deadline and what each seat observed. The latched code and observed URLs
- * are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
+ * are runtime-only and land in persisted metadata only as digests (origin + convergence). (The code
  * is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
  * full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
  */
@@ -38,7 +38,7 @@ export declare class LobbyHandoff {
         openaiApiKey: string;
     });
     /**
-     * Scrubs the latched lobby CODE from ANY persisted narration once the host resolves it (the
+     * Scrubs the latched lobby code from any persisted narration once the host resolves it (the
      * 6-char code has no detectable secret shape, so shape-only redaction cannot catch it).
      */
     readonly scrub: (text: string) => string;

package/dist/routes/shared-world/handoff.js

@@ -2,38 +2,38 @@
 // for the host's lobby code, read from the host's URL, narration or screen, and then joins with it.
 // A follower fails closed without opening if the host never yields a code within the deadline.
 //
-// TEMPORARY SHIM (tracked by #296): this CDP URL-relay handoff — reading the host's /lobby/CODE off
-// its own browser and threading it into the follower missions — is a temporary coordination shim.
+// Temporary shim (tracked by #296): this CDP URL-relay handoff reads the host's /lobby/CODE off its
+// own browser and threads it into the follower missions.
 // It is to be augmented/replaced by the actor message bus (fake SMS/email invite) in #297: the
-// human-realistic version is the HOST SENDING the invite link and followers RECEIVING and tapping
+// human-realistic version is the host sending the invite link and followers receiving and tapping
 // it, rather than the orchestrator relaying the code out-of-band.
 import { commandDigestOf } from "../../subject/state.js";
 import { toErrorMessage } from "../../evidence/redaction.js";
 import { inboxRecipientFor, participantHasInboxRecipient, } from "../computer-use/participant-desktop.js";
 import { withInboxMission } from "../computer-use/participant-prompt.js";
-import { runCuaParticipant } from "../computer-use/lanes.js";
+import { runCuaParticipant } from "../computer-use/participant-execution.js";
 import { extractLobbyCode, extractLobbyCodeFromNarration } from "./lobby-code.js";
 import { hostOriginDigest } from "./provenance.js";
-import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./seats.js";
-// The FLOOR for the host-first handoff barrier deadline (ms). The host seat must surface a
+import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./participant-specs.js";
+// The floor for the host-first handoff barrier deadline (ms). The host seat must surface a
 // shared-session (/lobby/CODE) URL within the deadline or the run fails closed and no follower
-// opens. The effective deadline SCALES with the per-seat run budget (execution.timeoutMs): a fixed
+// opens. The effective deadline scales with the per-seat run budget (execution.timeoutMs): a fixed
 // 2 min is too tight for a real create-a-lobby flow on a mobile-layout seat once you subtract the
 // seat's own desktop provisioning — the host reaches /lobby/CODE, but after the followers already
-// gave up. So use max(FLOOR, 40% of the budget), capped at the budget. The latch resolves the
+// gave up. So use max(floor, 40% of the budget), capped at the budget. The latch resolves the
 // instant the host actually reaches /lobby, so a generous ceiling only affects the fail-closed case.
 const DEFAULT_HANDOFF_DEADLINE_MS = 120_000;
 const HANDOFF_DEADLINE_BUDGET_FRACTION = 0.4;
-// Per-seat runaway backstop for the vision-off-frame lobby-code read (used by the host to LATCH the
-// handoff code, and by each follower to independently OBSERVE its own code for the convergence proof):
+// Per-seat runaway backstop for the vision-off-frame lobby-code read (used by the host to latch the
+// handoff code, and by each follower to independently observe its own code for the convergence proof):
 // at most this many single-frame reads before the seat is assumed to be somewhere without a code. Each
 // reader stops the instant it has what it needs, so in practice only a handful fire (a seat reaches its
 // /lobby within a few turns). NOTE: these reads are out-of-band OpenAI calls (external-public route
-// only) and are NOT counted against execution.caps.maxUsd — this hard cap is what bounds their spend
-// instead (each read is one cheap single-frame OCR call). If this route ever runs under a strict
+// only) and are left out of execution.caps.maxUsd, so this hard cap is what bounds their spend
+// (each read is one cheap single-frame OCR call). If this route ever runs under a strict
 // budget, fold the estimate in.
 const MAX_LOBBY_CODE_VISION_READS = 30;
-// Idle/no-progress backstop for the HOST lane specifically (default is 6/8). The host legitimately sits
+// Idle/no-progress backstop for the host participant specifically (default is 6/8). The host legitimately sits
 // on an unchanging waiting-room screen while followers provision and join; it must not give up first.
 const HOST_WAIT_IDLE_STEPS = 80;
 const FOLLOWER_WAIT_IDLE_STEPS = 40;
@@ -67,13 +67,13 @@ class HandoffTimeoutError extends Error {
 }
 /**
  * The handoff latch, its deadline and what each seat observed. The latched code and observed URLs
- * are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
+ * are runtime-only and land in persisted metadata only as digests (origin + convergence). (The code
  * is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
  * full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
  */
 export class LobbyHandoff {
-    // Per-lane runtime-only observed state (never persisted raw): the last observed URL and the last
-    // observed /lobby/CODE per seat, fed by onObservedUrl. The URL is digested to ORIGIN for each seat's
+    // Per-participant runtime-only observed state (never persisted raw): the last observed URL and the last
+    // observed /lobby/CODE per seat, fed by onObservedUrl. The URL is digested to its origin for each seat's
     // routeHostDigest (no code leaks); the codes drive the cross-seat lobby-convergence digest.
     observedFinalUrls;
     observedLobbyCodes;
@@ -100,7 +100,7 @@ export class LobbyHandoff {
         this.openaiApiKey = options.openaiApiKey;
     }
     /**
-     * Scrubs the latched lobby CODE from ANY persisted narration once the host resolves it (the
+     * Scrubs the latched lobby code from any persisted narration once the host resolves it (the
      * 6-char code has no detectable secret shape, so shape-only redaction cannot catch it).
      */
     scrub = (text) => {
@@ -122,7 +122,7 @@ export class LobbyHandoff {
             this.deadlineTimer = undefined;
         }
     }
-    // Resolve the host->follower handoff latch from WHICHEVER path sees the code first (CDP url-read,
+    // Resolve the host->follower handoff latch from whichever path sees the code first (CDP url-read,
     // host narration, or vision-off-frame). Idempotent: only the first code wins, and it is also stashed
     // as latchedLobbyCode so it gets scrubbed from any later narration.
     latchLobbyCode(code, participantIndex) {
@@ -133,7 +133,7 @@ export class LobbyHandoff {
         this.stopDeadline();
         this.lobbyCodeLatch.resolve(code);
     }
-    // Build an onScreenshot handler that vision-reads the lobby code off THIS seat's own frame (the
+    // Build an onScreenshot handler that vision-reads the lobby code off this seat's own frame (the
     // CDP-independent observation). `done()` short-circuits once this seat has what it needs (the host
     // once latched; a follower once it has recorded its own observed code), `onCode` records/latches the
     // result. One read in flight at a time, bounded by MAX_LOBBY_CODE_VISION_READS so a seat that never
@@ -187,10 +187,10 @@ export class LobbyHandoff {
     /** The digest-only convergence proofs over what the seats observed. */
     convergence(declaredOriginDigest) {
         // Observed-origin convergence proof (blocker 2): the convergence claim is about what the seats
-        // OBSERVED, not what was DECLARED. Digest each observing seat's origin and require they AGREE on
-        // ONE — that agreement IS the convergence proof and becomes plane.publicOriginDigest. A normal
+        // observed. Digest each observing seat's origin and require one shared origin; that agreement is
+        // the convergence proof and becomes plane.publicOriginDigest. A normal
         // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the seats still
-        // converge on ONE observed origin. Leave it undefined (verify fails closed) only if the seats did
+        // converge on one observed origin. Leave it undefined (verify fails closed) only if the seats did
         // not converge on a single observed origin (or none observed one).
         const observedOriginDigests = this.observedFinalUrls
             .filter((url) => typeof url === "string" && url.length > 0)
@@ -198,18 +198,18 @@ export class LobbyHandoff {
         const distinctObservedOrigins = new Set(observedOriginDigests);
         const publicOriginDigest = distinctObservedOrigins.size === 1
             ? [...distinctObservedOrigins][0]
-            : // NOTHING observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
-                // DECLARED origin so a FAILED run's bundle stays structurally valid (every seat's route then
-                // digests to the declared origin too). The run still fails closed for its own reason (HANDOFF_
-                // TIMEOUT / no lobby convergence / no overlap-on-pass). GENUINE divergence (≥2 distinct observed
+            : // Nothing observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
+                // declared origin so a failed run's bundle stays structurally valid (every seat's route then
+                // digests to the declared origin too). The run still fails closed for its own reason
+                // (`HANDOFF_TIMEOUT`, no lobby convergence, no overlap-on-pass). Real divergence (≥2 distinct observed
                 // origins) leaves it undefined so verify fails closed on the non-convergence.
                 distinctObservedOrigins.size === 0
                     ? declaredOriginDigest
                     : undefined;
-        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff EVERY seat converged on the
-        // SAME code (a follower stuck on "/" yields no code → no false convergence). Digest-only. NOTE:
-        // observedLobbyCodes may be a SPARSE array (a seat that never observed a code leaves a hole), and
-        // Array.prototype.every SKIPS holes — so count the DEFINED codes explicitly, never rely on every().
+        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff every seat converged on the
+        // same code (a follower stuck on "/" yields no code, so no false convergence). Digest-only.
+        // observedLobbyCodes may be a sparse array (a seat that never observed a code leaves a hole), and
+        // Array.prototype.every skips holes, so count the defined codes explicitly instead of every().
         const definedCodes = this.observedLobbyCodes.filter((code) => code !== undefined);
         const distinctCodes = new Set(definedCodes);
         const lobbyConvergenceDigest = distinctCodes.size === 1 && definedCodes.length === this.observedLobbyCodes.length
@@ -218,30 +218,30 @@ export class LobbyHandoff {
         return { publicOriginDigest, lobbyConvergenceDigest };
     }
 }
-// Adopter-hosted inbox (#387): the persona is told its address and inbox URL on THIS plane.
+// Adopter-hosted inbox (#387): the persona is told its address and inbox URL on this plane.
 function withParticipantInbox(spec, inbox) {
     return inbox && participantHasInboxRecipient(inbox.email, spec.planned.id)
         ? withInboxMission(spec, inbox.inboxUrl, inboxRecipientFor(inbox.email, spec.planned.id)?.address)
         : spec;
 }
-// The HOST lane (which yields the /lobby/CODE the followers wait on) runs on its OWN dedicated
-// slot, and the FOLLOWERS run through a bounded pool of size concurrency-1 (blockers 1 & 4):
-// followers block on the host's code while holding a worker slot, so if the host lane were
-// scheduled INSIDE the same bounded pool it could be starved (never scheduled among the first
-// `concurrency` workers) and the run would die with a spurious HANDOFF_TIMEOUT (e.g. lanes
-// [p2,p3,host] with concurrency 2). Giving the host its own slot, started IMMEDIATELY and OUTSIDE
-// the follower pool, guarantees it is ALWAYS schedulable regardless of its roster position or of
-// concurrency vs lane count — while total in-flight paid desktops stay ≤ the declared concurrency
+// The host participant (which yields the /lobby/CODE the followers wait on) runs on its own dedicated
+// slot, and the followers run through a bounded pool of size concurrency-1 (blockers 1 & 4):
+// followers block on the host's code while holding a worker slot, so if the host participant were
+// scheduled inside the same bounded pool it could be starved (never scheduled among the first
+// `concurrency` workers) and the run would die with a spurious HANDOFF_TIMEOUT (e.g. participants
+// [p2,p3,host] with concurrency 2). Giving the host its own slot, started immediately and outside
+// the follower pool, keeps it schedulable regardless of its roster position or of concurrency vs
+// participant count, while total in-flight paid desktops stay ≤ the declared concurrency
 // (host + up to concurrency-1 followers), preserving the spend cap.
 export async function runHost(handoff, deps, spec, participantIndex) {
     const onObservedUrl = handoff.makeObservedUrl(participantIndex, true);
     // CDP-INDEPENDENT handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
-    // unreliable in practice). Two backups, both resolving the SAME latch; whichever sees the code first
+    // unreliable in practice). Two backups, both resolving the same latch; whichever sees the code first
     // wins, all digest-only:
-    //   (1) onMessage — scan the host's own narration IF it happens to state the lobby URL; and
+    //   (1) onMessage: scan the host's own narration if it happens to state the lobby URL; and
     //   (2) onScreenshot — vision-read the code straight off the host's waiting-room frame. This is the
-    //       robust one: the code is rendered on screen even when CDP fails AND when the host never
-    //       narrates it, and — crucially — the host is NOT asked to announce anything, so it keeps
+    //       robust one: the code is rendered on screen even when CDP fails and when the host never
+    //       narrates it, and the host is never asked to announce anything, so it keeps
     //       running (create -> wait for players -> Start -> play) instead of ending on a stray message.
     const onMessage = (text) => {
         if (handoff.latchedLobbyCode !== undefined)
@@ -250,9 +250,9 @@ export async function runHost(handoff, deps, spec, participantIndex) {
         if (code !== undefined)
             handoff.latchLobbyCode(code, participantIndex);
     };
-    // Vision-read the host's waiting-room frame and LATCH the code for the followers (stops once latched).
+    // Vision-read the host's waiting-room frame and latch the code for the followers (stops once latched).
     const onScreenshot = handoff.makeLobbyCodeVisionReader(() => handoff.latchedLobbyCode !== undefined, (code) => handoff.latchLobbyCode(code, participantIndex));
-    // The host's job includes a long LEGITIMATE idle wait — sitting in the waiting room while the
+    // The host's job includes a long, legitimate idle wait: sitting in the waiting room while the
     // followers provision their own desktops and walk the Join flow (easily 15-30 turns of an
     // unchanging "waiting for players" screen). At the default idle backstop (6) the host would give up
     // before anyone arrives, orphaning the lobby (exactly the earlier failure). Raise the host's idle /
@@ -291,7 +291,7 @@ export async function runHost(handoff, deps, spec, participantIndex) {
 }
 export async function runFollower(handoff, deps, spec, participantIndex) {
     const onObservedUrl = handoff.makeObservedUrl(participantIndex, false);
-    // FOLLOWER: do NOT compose a mission or open the target until the host yields a lobby code.
+    // Follower: compose no mission and open no target until the host yields a lobby code.
     let code;
     try {
         code = await handoff.waitForHostCode();
@@ -320,11 +320,11 @@ export async function runFollower(handoff, deps, spec, participantIndex) {
             noProgressSteps: spec.backstop?.noProgressSteps ?? FOLLOWER_WAIT_IDLE_STEPS,
         },
     };
-    // Independently OBSERVE this follower's own lobby code by vision-reading its waiting-room frame,
-    // and record it for the cross-seat convergence proof. This does NOT latch anything (followers gate
-    // on the HOST's code, not their own) — it just fills this seat's observedLobbyCodes slot from a
+    // Independently observe this follower's own lobby code by vision-reading its waiting-room frame,
+    // and record it for the cross-seat convergence proof. This latches nothing (followers gate on the
+    // host's code). It fills this seat's observedLobbyCodes slot from a
     // reliable signal instead of the flaky CDP url-read, so lobbyConvergenceDigest can prove all seats
-    // reached the SAME /lobby/CODE. If a follower somehow joined a DIFFERENT lobby, it reads a different
+    // reached the same /lobby/CODE. If a follower somehow joined another lobby, it reads a different
     // code and convergence correctly fails (no false proof); if it never reads one, the seat stays a
     // hole and convergence is honestly "not observed" for that seat.
     const onScreenshot = handoff.makeLobbyCodeVisionReader(() => handoff.observedLobbyCodes[participantIndex] !== undefined, (observed) => {

package/dist/routes/shared-world/lobby-code.d.ts

@@ -1,14 +1,14 @@
-/** Extract the shared-session CODE from a (runtime-only) observed URL, or undefined. Exported for the
+/** Extract the shared-session code from a (runtime-only) observed URL, or undefined. Exported for the
  *  handoff regex table test — pure, no side effects, never persists its input. */
 export declare function extractLobbyCode(url: string | undefined): string | undefined;
 export declare function extractLobbyCodeFromNarration(text: string | undefined): string | undefined;
 /** Pull the assistant's plain text out of an OpenAI Responses API body (`output_text` convenience
  *  field, else the concatenated `output[].content[].text`). Tolerant of shape drift; pure. */
 export declare function extractResponsesOutputText(parsed: unknown): string | undefined;
-/** Parse a vision reply into a lobby CODE. PRECISION-FIRST: accept ONLY when the whole reply IS the
+/** Parse a vision reply into a lobby code. Precision-first: accept only when the whole reply is the
  *  six-character code, or when it echoes an explicit /lobby/CODE — never a bare 6-letter token buried in
- *  prose (e.g. "I see a home SCREEN"), because a wrong latch fails the entire run, whereas a miss just
- *  retries on the next frame while the host keeps waiting. NONE (the instructed "no code" reply) is
+ *  prose (e.g. "I see a home `SCREEN`"), because a wrong latch fails the entire run, whereas a miss just
+ *  retries on the next frame while the host keeps waiting. `NONE` (the instructed "no code" reply) is
  *  rejected. Pure. */
 export declare function parseLobbyCodeReply(reply: string | undefined): string | undefined;
 export interface ReadLobbyCodeOptions {
@@ -18,7 +18,7 @@ export interface ReadLobbyCodeOptions {
     signal?: AbortSignal;
 }
 /**
- * Vision-read a lobby CODE straight off a host waiting-room FRAME (the robust, CDP-independent handoff
+ * Vision-read a lobby code straight off a host waiting-room frame (the robust, CDP-independent handoff
  * relay). Fail-soft: any network/HTTP/parse problem returns undefined so the caller simply retries on
  * the next frame. The frame is runtime-only; only the extracted code is used (as a digest downstream).
  */

package/dist/routes/shared-world/lobby-code.js

@@ -5,10 +5,10 @@ import { OPENAI_RESPONSES_URL } from "../../actors/openai-endpoint.js";
 /**
  * The lobby-trivia (and general "/lobby/CODE") shared-session URL matcher. A code is exactly 6 chars of
  * the [A-Z2-9] class; a locale prefix (/en/lobby/…) and a query/hash suffix are tolerated. RUNTIME-ONLY
- * input (a live location.href); only the extracted CODE is used, and it lands only as a digest.
+ * input (a live location.href); only the extracted code is used, and it lands only as a digest.
  */
 const LOBBY_CODE_PATTERN = /\/lobby\/([A-Z2-9]{6})(?:$|[/?#])/;
-/** Extract the shared-session CODE from a (runtime-only) observed URL, or undefined. Exported for the
+/** Extract the shared-session code from a (runtime-only) observed URL, or undefined. Exported for the
  *  handoff regex table test — pure, no side effects, never persists its input. */
 export function extractLobbyCode(url) {
     if (typeof url !== "string")
@@ -17,7 +17,7 @@ export function extractLobbyCode(url) {
     return match ? match[1] : undefined;
 }
 /**
- * Extract a lobby CODE from free-form ACTOR NARRATION (the host's reasoning/message where it states
+ * Extract a lobby code from free-form actor narration (the host's reasoning/message where it states
  * the lobby URL it sees), where the /lobby/CODE is followed by arbitrary prose (a space, backtick,
  * newline) rather than end-of-string or /?# — so the strict LOBBY_CODE_PATTERN would miss it. Uses a
  * negative-lookahead boundary (exactly 6 code chars). This is the CDP-INDEPENDENT handoff path: the
@@ -32,10 +32,10 @@ export function extractLobbyCodeFromNarration(text) {
     if (inUrl)
         return inUrl[1];
     // Fallback: an explicitly-labeled bare code (e.g. "LOBBY_CODE=ABC123"), which the host may state
-    // if it copied the code rather than the URL. The label is matched case-insensitively, but the CODE
-    // itself must be UPPERCASE [A-Z2-9] — a real lobby code always renders uppercase, whereas an /i match
+    // if it copied the code rather than the URL. The label is matched case-insensitively, but the code
+    // itself must be uppercase [A-Z2-9]: a real lobby code always renders uppercase, whereas an /i match
     // on the code class would also grab an ordinary lowercase word after "lobby code " (e.g. "the lobby
-    // code screen") and latch a WRONG code. Precision-first, matching parseLobbyCodeReply's rationale.
+    // code screen") and latch a wrong code. Precision-first, matching parseLobbyCodeReply's rationale.
     const labeled = text.match(/lobby[ _-]?code[=:\s]+([A-Z2-9]{6})(?![A-Za-z2-9])/i);
     return labeled && labeled[1] && /^[A-Z2-9]{6}$/.test(labeled[1]) ? labeled[1] : undefined;
 }
@@ -67,10 +67,10 @@ export function extractResponsesOutputText(parsed) {
     }
     return parts.length > 0 ? parts.join("\n") : undefined;
 }
-/** Parse a vision reply into a lobby CODE. PRECISION-FIRST: accept ONLY when the whole reply IS the
+/** Parse a vision reply into a lobby code. Precision-first: accept only when the whole reply is the
  *  six-character code, or when it echoes an explicit /lobby/CODE — never a bare 6-letter token buried in
- *  prose (e.g. "I see a home SCREEN"), because a wrong latch fails the entire run, whereas a miss just
- *  retries on the next frame while the host keeps waiting. NONE (the instructed "no code" reply) is
+ *  prose (e.g. "I see a home `SCREEN`"), because a wrong latch fails the entire run, whereas a miss just
+ *  retries on the next frame while the host keeps waiting. `NONE` (the instructed "no code" reply) is
  *  rejected. Pure. */
 export function parseLobbyCodeReply(reply) {
     if (typeof reply !== "string")
@@ -88,11 +88,11 @@ const LOBBY_CODE_VISION_PROMPT = "This is a screenshot of a the example multipla
     "code'/'room code' label or inside an invite link of the form /lobby/CODE. Your entire reply MUST be " +
     "exactly those 6 characters in uppercase and NOTHING else (no words, no punctuation). If no lobby " +
     "code is visible on this screen (e.g. it is the home screen or a game round), reply exactly NONE.";
-// A single-frame OCR-style read. gpt-5.5 (the CU default) is used deliberately: it reliably reads the
+// A single-frame OCR-style read. gpt-5.5 (the computer-use default) is used deliberately: it reliably reads the
 // 6-char code off a dense MOBILE-viewport waiting room — a smaller/cheaper model (gpt-4.1-mini) was
-// tried and could NOT read it. reasoning.effort stays "low" (minimal) and the output budget is small
+// tried and could not read it. reasoning.effort stays "low" (minimal) and the output budget is small
 // but comfortably clear of the "incomplete on reasoning overflow" edge. Kept on the same account/key
-// as the actor; the same full-fidelity frame is already sent to this API by the CU provider, so this
+// as the actor; the same full-fidelity frame is already sent to this API by the computer-use provider, so this
 // adds no new data-exposure surface. See onScreenshot in runHost.
 const LOBBY_CODE_VISION_MODEL = "gpt-5.5";
 // Output-token budget for the read. The answer is 6 chars, but leave clear margin over any low-effort
@@ -102,7 +102,7 @@ const LOBBY_CODE_VISION_MAX_OUTPUT_TOKENS = 64;
 // visionInFlight pinned true and silently kill the relay for the rest of the host run.
 const LOBBY_CODE_VISION_TIMEOUT_MS = 15_000;
 /**
- * Vision-read a lobby CODE straight off a host waiting-room FRAME (the robust, CDP-independent handoff
+ * Vision-read a lobby code straight off a host waiting-room frame (the robust, CDP-independent handoff
  * relay). Fail-soft: any network/HTTP/parse problem returns undefined so the caller simply retries on
  * the next frame. The frame is runtime-only; only the extracted code is used (as a digest downstream).
  */

package/dist/routes/shared-world/{seats.d.ts → participant-specs.d.ts}

@@ -8,9 +8,9 @@ export declare function defaultSessionTimeoutMs(plan: SharedWorldPlan): number;
  *  relative path, validated at parse against serve.url). */
 export declare function resolveActorEntryUrl(baseUrl: string, entry: string | undefined): string;
 export declare function participantTaxonomyLabel(labels: Participant["labels"]): string;
-/** Thread the host-yielded lobby CODE into a follower's mission at runtime (external-public route).
- *  The CODE flows into the follower's join instruction; it is persisted only as the composed prompt
- *  the model reads (never a raw bundle field), and the lab scrubs the CODE from all narration. The
+/** Thread the host-yielded lobby code into a follower's mission at runtime (external-public route).
+ *  The code flows into the follower's join instruction; it is persisted only as the composed prompt
+ *  the model reads (never a raw bundle field), and the lab scrubs the code from all narration. The
  *  follower joins through the real UI (a direct /lobby/CODE visit does not auto-join a non-member). */
 export declare function withLobbyCodeMission(spec: DesktopParticipantRun, code: string): DesktopParticipantRun;
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
@@ -25,9 +25,11 @@ export type ParticipantRunDeps = Omit<CuaParticipantDeps, "signalProvisioned" |
  */
 export declare function startParticipantFlush(ctx: PlaneContext, live: LiveParticipants, bundle: RunBundle): void;
 /**
- * The runner deps both planes give every participant. cloneRoute=false + subjectEnvNames=[] keep subject
- * creds out of every actor sandbox (FIX-10). `scrubKnownValues` is the plane's scrub: the
- * external-public plane also scrubs the latched lobby code.
+ * The runner deps both planes give every participant. The `shared-app` subject keeps three things
+ * out of every actor sandbox: the subject env names' values, the GitHub token, and clone
+ * or local-tree provisioning. The committed subject.envValues still reach it, non-secret by parse.
+ * `scrubKnownValues` is the plane's scrub: the external-public plane also scrubs the latched lobby
+ * code.
  */
 export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): ParticipantRunDeps;
 /**