humanish 0.106.0 → 0.107.0

package/dist/routes/terminal/live-sandbox.js

@@ -38,6 +38,7 @@ export class LiveTerminalSandbox {
     module;
     allocation;
     startupCleanup;
+    startupCleanupDetail;
     // The sandbox's billed span (acquired to cleanup) and size price its compute time.
     createdAtMs;
     tornDownAtMs;
@@ -51,13 +52,13 @@ export class LiveTerminalSandbox {
         });
     }
     async acquire() {
-        const { plan, hooks, now, sanitize, runtimeEnv, e2bApiKey, runPaths, metadata } = this.inputs;
+        const { plan, deps, now, sanitize, runtimeEnv, e2bApiKey, runPaths, metadata } = this.inputs;
         const { warnings } = this.inputs;
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs, sandboxTimeoutMs } = this;
         // Declared egress allowlist, or undefined for the historical unrestricted default (#538).
         const egressAllow = plan.egressAllow;
-        const sandboxModule = await (hooks.loadModule ?? loadE2BDesktopModule)();
+        const sandboxModule = await (deps.desktopModule ?? loadE2BDesktopModule)();
         this.module = sandboxModule;
         await validatePreparedRunArtifactPaths(runPaths);
         // No sandbox-global env in either mode. In openai-egress, only this host-side SDK request
@@ -129,7 +130,7 @@ export class LiveTerminalSandbox {
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs } = this;
         // --- Runtime bootstrap: no runtime env; openai-egress proxy capability is already available. ---
-        // The stock desktop needs Node/npm on PATH before npx can run Codex. Reuse a working
+        // The stock desktop needs Node/npm on `PATH` before npx can run Codex. Reuse a working
         // installation or install the pinned official binary after checksum verification (#674).
         // No raw runtime key touches this step; the egress proxy, when selected, is already available.
         const bootstrapStartedAt = now();
@@ -151,7 +152,7 @@ export class LiveTerminalSandbox {
             ? `Runtime bootstrap FAILED after ${bootstrapDurationMs}ms: ${bootstrapError}. codex exec runs via npx and needs Node/npm present; the participant fails closed rather than attempting an exec with no runtime.`
             : `Runtime bootstrap ensured Node/npm present in ${bootstrapDurationMs}ms (codex exec runs via npx).`);
         if (bootstrapError) {
-            // Fail closed as a structured lane status (never a raw throw): no codex exec is attempted
+            // Fail closed as a structured route status (never a raw throw): no codex exec is attempted
             // without a proven runtime; this mirrors the exec-error status assignment below so the
             // bundle and verify surface the failure the same way.
             this.status = "failed";
@@ -184,7 +185,7 @@ export class LiveTerminalSandbox {
                 throw new Error(`Codex version mismatch: requested ${requested}, observed ${observed}.`);
             }
             runtime.versionStatus = "verified";
-            recordLifecycle("terminal-lab.runtime.version", `Codex requested ${runtime.requestedVersion}, observed ${observed}; exact version selected for execution. Model ${runtime.requestedModel ?? "runtime default (unobserved)"}; reasoning effort ${runtime.requestedReasoningEffort ?? "runtime default (unobserved)"}.`);
+            recordLifecycle("terminal-lab.runtime.version", `Codex requested ${runtime.requestedVersion}, observed ${observed}; exact version selected for execution. Model ${runtime.requestedModel ?? "unrecorded"} (${runtime.modelStatus}); reasoning effort ${runtime.requestedReasoningEffort ?? "runtime default (unobserved)"}.`);
         }
         catch (error) {
             runtime.versionStatus = "failed";
@@ -204,15 +205,15 @@ export class LiveTerminalSandbox {
         const { requestTimeoutMs } = this;
         // --- Optional product setup (no runtime env), before the Codex exec. ---
         // Same channel and same guarantees as the runtime bootstrap above: no runtime key touches it,
-        // and a failure fails the lane closed rather than handing the agent a half-built world. It
-        // exists so a study can put the participant IN a prepared project — asking an agent what
+        // and a failure fails the run closed rather than handing the agent a half-built world. It
+        // exists so a study can put the participant in a prepared project: asking an agent what
         // studies a project contains, in an empty directory, measures the lab and not the product
-        // (learned the hard way on the desktop lane, labs/tui-self-study.yaml).
+        // (learned the hard way on the desktop route, labs/tui-self-study.yaml).
         const install = plan.product.install;
         if (install === undefined)
             return true;
         // An optional local file, put on the machine before the install runs, so a study can meet a
-        // build that is not published yet. Read and checked HERE rather than trusted from the
+        // build that is not published yet. It is read and checked here, so nothing is trusted from the
         // manifest: this puts a file from the operator's disk onto a machine an autonomous agent is
         // about to drive, so it stays inside the project, must be a regular file, and is size-capped.
         let uploadAssignment = "";
@@ -238,8 +239,8 @@ export class LiveTerminalSandbox {
                 });
                 const bytes = await readFile(real);
                 await this.sandbox.files.write(destination, bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
-                // Inlined into the command string rather than passed as `envs`: the ONLY call in this
-                // lane that carries envs is the keyed codex exec, and that invariant is worth more than
+                // Inlined into the command string rather than passed as `envs`: the only call on this
+                // route that carries envs is the keyed codex exec, and that invariant is worth more than
                 // the convenience of a second envs channel.
                 uploadAssignment = `export HUMANISH_PRODUCT_UPLOAD=${shellQuote(destination)}; `;
                 recordLifecycle("terminal-lab.product.uploaded", `Uploaded ${info.size} bytes to the sandbox in ${Math.max(0, now() - uploadStartedAt)}ms (no runtime env; declared egress auth may already be available).`);
@@ -299,7 +300,7 @@ export class LiveTerminalSandbox {
             prompt: composedPrompt,
             runtimeAuth: runtimeEnv.mode,
             version: runtime.observedVersion,
-            ...(model === undefined ? {} : { model }),
+            model,
             ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
         });
         const commandDigest = digestText(codexCommand);
@@ -341,13 +342,13 @@ export class LiveTerminalSandbox {
             at: nowIso(),
             label: "codex-exec",
             commandDigest,
-            envNames: Object.keys(runtimeEnv.envs), // NAMES only — the credential evidence (item 4).
+            envNames: Object.keys(runtimeEnv.envs), // Names only: the credential evidence (item 4).
             ...(exitCode === undefined ? {} : { exitCode }),
             ...(this.timedOut ? { timedOut: true } : {}),
             durationMs,
         });
-        // Score by the verdict-nonce marker over the SCRUBBED+REDACTED, NORMALIZED transcript — the
-        // exact same logic the local-actor lanes use (extractLocalActorVerdict/normalizeLocalActorTranscript).
+        // Score by the verdict-nonce marker over the scrubbed, redacted and normalized transcript, with
+        // the exact same logic the local-actor routes use (extractLocalActorVerdict/normalizeLocalActorTranscript).
         const rawTranscript = terminalEvents.map((e) => e.chunk).join("");
         const normalizedTranscript = normalizeLocalActorTranscript(rawTranscript);
         const markerStatus = extractLocalActorVerdict(normalizedTranscript, verdictNonce);
@@ -377,8 +378,8 @@ export class LiveTerminalSandbox {
         }
         else {
             // No nonce-verified verdict: the agent did not (credibly) report a terminal status. A run
-            // that exited 0 but printed no verified marker is BLOCKED evidence (the failure IS the
-            // evidence — still structurally verifiable), not a silent pass.
+            // that exited 0 but printed no verified marker is blocked evidence: the failure is the
+            // evidence, and it stays structurally verifiable.
             this.status = "blocked";
             this.completionReason = "gave_up";
             this.reason = `codex exec exit=${exitCode ?? "null"} but no nonce-verified HUMANISH_ACTOR_VERDICT marker was emitted; recorded as blocked (the missing verdict is the evidence).`;
@@ -389,8 +390,10 @@ export class LiveTerminalSandbox {
     recordSessionError(error) {
         const { sanitize } = this.inputs;
         const { recordLifecycle } = this.inputs.recorder;
-        if (error instanceof E2BDesktopStartupError)
+        if (error instanceof E2BDesktopStartupError) {
             this.startupCleanup = error.cleanup;
+            this.startupCleanupDetail = error.cleanupDetail;
+        }
         this.error = sanitize(toErrorMessage(error));
         this.status = "failed";
         this.completionReason = "harness_error";
@@ -401,11 +404,12 @@ export class LiveTerminalSandbox {
         const { now, sanitize, warnings } = this.inputs;
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs } = this;
-        // --- Safety contract item 8: PROVEN cleanup, BY EXACT ID, never Sandbox.list. ---
+        // --- Safety contract item 8: proven cleanup, by exact id, never Sandbox.list. ---
         this.cleanup = await teardownSandbox({
             allocation: this.allocation,
             sandboxModule: this.module,
             ...(this.startupCleanup === undefined ? {} : { startupCleanup: this.startupCleanup }),
+            startupCleanupDetail: this.startupCleanupDetail,
             requestTimeoutMs,
             sanitize,
             recordLifecycle,
@@ -431,14 +435,14 @@ export class LiveTerminalSandbox {
 }
 /** Build the in-sandbox `codex exec` command (non-interactive, JSON, stdin disabled by mechanism). */
 function buildCodexExecCommand(args) {
-    // The prompt is passed via a heredoc on stdin of a wrapper? NO, stdin is DISABLED (item 7), so
+    // stdin is disabled (item 7), so no heredoc on a wrapper's stdin carries the prompt;
     // the prompt rides as the final positional arg, shell-quoted. codex exec --json runs once and
     // exits (no interactive loop). --skip-git-repo-check: the workdir is a fresh scratch dir.
     // Pinned via npx (never an ambient/preinstalled `codex` binary, which the stock @e2b/desktop
     // image does not ship, per issue #159); npm_config_update_notifier=false silences npx's own
     // update check so it cannot leak into the captured stdout the scorer/redactor parse.
     const quotedPrompt = shellQuote(args.prompt);
-    // --dangerously-bypass-approvals-and-sandbox: codex's OWN inner sandbox is
+    // --dangerously-bypass-approvals-and-sandbox: codex's own inner sandbox is
     // redundant here and blocks the network/file access the study mission needs.
     // The E2B sandbox is the trust boundary (the disposable machine), and exec mode has no
     // interactive approval channel at all.

package/dist/routes/terminal/participant-text.d.ts

@@ -0,0 +1,23 @@
+import type { ActorTraceItem } from "../../actors/contract.js";
+/** What the reader found in the agent's Codex JSON stdout. */
+export interface TerminalParticipantText {
+    /** Message and reasoning items, the most recent kept under the aggregate limits, then a notice
+     *  when older ones were left out. */
+    items: ActorTraceItem[];
+    /** Distinct agent_message items in the stream, kept or not. */
+    messages: number;
+    /** Distinct participant items: messages, reasoning, commands, web searches and file changes.
+     *  Lifecycle, usage, launcher diagnostics and nested command output are not activity. Zero
+     *  means no recognized item was retained, not that the participant succeeded. */
+    participantItems: number;
+}
+/**
+ * Read participant text from the raw stdout as the recorder receives it. Source redaction runs on
+ * the stored stream and can cut through JSON framing (a redacted URL takes the closing quote with
+ * it), so each line is parsed here, in memory, and only decoded text that has passed `sanitize`
+ * is kept. The raw bytes are never stored.
+ */
+export declare function createTerminalParticipantReader(sanitize: (text: string) => string): {
+    append(raw: string): void;
+    finish(): TerminalParticipantText;
+};

package/dist/routes/terminal/participant-text.js

@@ -0,0 +1,165 @@
+import { normalizeLocalActorTranscript } from "../../run/terminal-contract.js";
+import { MESSAGE_CHARS, PENDING_LINE_CHARS, TEXT_ITEMS_BYTES, TEXT_ITEMS_MAX } from "./types.js";
+const itemEvents = new Set(["item.started", "item.updated", "item.completed"]);
+const nonempty = (value) => typeof value === "string" && value.trim().length > 0;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Each Codex item event in a run of complete JSON lines, in stream order. */
+function* codexStreamItems(lines) {
+    for (const line of lines.split("\n")) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!object(event) ||
+            typeof event.type !== "string" ||
+            !itemEvents.has(event.type) ||
+            !object(event.item) ||
+            !nonempty(event.item.id))
+            continue;
+        yield { event: event.type, id: event.item.id, item: event.item };
+    }
+}
+function isParticipantItem(item) {
+    return (((item.type === "agent_message" || item.type === "reasoning") && nonempty(item.text)) ||
+        (item.type === "command_execution" && nonempty(item.command)) ||
+        (item.type === "web_search" &&
+            (nonempty(item.query) || (object(item.action) && nonempty(item.action.type)))) ||
+        (item.type === "file_change" &&
+            Array.isArray(item.changes) &&
+            item.changes.some((change) => object(change) && nonempty(change.path) && nonempty(change.kind))));
+}
+// The verdict parser removes all whitespace before matching, so a line is a marker line when its
+// whitespace-free form names either marker. The parser reads the stored stream, not these items.
+const MARKER = /HUMANISH_ACTOR_(?:VERDICT|NONCE)=/i;
+const withoutMarkerLines = (text) => text
+    .split("\n")
+    .filter((line) => !MARKER.test(line.replace(/\s+/g, "")))
+    .join("\n");
+/**
+ * Read participant text from the raw stdout as the recorder receives it. Source redaction runs on
+ * the stored stream and can cut through JSON framing (a redacted URL takes the closing quote with
+ * it), so each line is parsed here, in memory, and only decoded text that has passed `sanitize`
+ * is kept. The raw bytes are never stored.
+ */
+export function createTerminalParticipantReader(sanitize) {
+    let pending = "";
+    // Set while the rest of an over-long line is skipped, up to its newline.
+    let skipping = false;
+    let droppedLines = 0;
+    const participantIds = new Set();
+    const messageIds = new Set();
+    const done = new Set();
+    // Completed or left-out items; later events for them are ignored.
+    const closed = new Set();
+    const texts = new Map();
+    const numbers = { message: 0, reasoning: 0 };
+    let left = 0;
+    let result;
+    const take = (lines) => {
+        for (const { event, id, item } of codexStreamItems(normalizeLocalActorTranscript(lines))) {
+            if (isParticipantItem(item))
+                participantIds.add(id);
+            const kind = item.type === "agent_message" ? "message" : item.type === "reasoning" ? "reasoning" : null;
+            if (kind === null || !nonempty(item.text) || closed.has(id))
+                continue;
+            if (kind === "message")
+                messageIds.add(id);
+            if (event === "item.completed") {
+                done.add(id);
+                closed.add(id);
+            }
+            // Redact the decoded text before cutting it, so a cut cannot split a value past the patterns.
+            const clean = [...sanitize(withoutMarkerLines(item.text))];
+            const text = (clean.length > MESSAGE_CHARS ? clean.slice(0, MESSAGE_CHARS) : clean).join("");
+            const previous = texts.get(id);
+            if (!text.trim()) {
+                texts.delete(id);
+                continue;
+            }
+            texts.set(id, { kind, number: previous?.number ?? ++numbers[kind], text });
+            // The oldest item beyond the count limit is left out as the stream arrives, finished or not,
+            // so a long stream cannot hold every message in memory.
+            if (texts.size > TEXT_ITEMS_MAX) {
+                const oldest = texts.keys().next().value;
+                texts.delete(oldest);
+                closed.add(oldest);
+                left += 1;
+            }
+        }
+    };
+    return {
+        append(raw) {
+            if (result)
+                return;
+            if (skipping) {
+                const end = raw.indexOf("\n");
+                if (end < 0)
+                    return;
+                skipping = false;
+                raw = raw.slice(end + 1);
+            }
+            pending += raw;
+            const end = pending.lastIndexOf("\n");
+            if (end >= 0) {
+                take(pending.slice(0, end));
+                pending = pending.slice(end + 1);
+            }
+            // A line with no newline in sight is dropped, so one runaway line cannot grow without bound.
+            if (pending.length > PENDING_LINE_CHARS) {
+                pending = "";
+                skipping = true;
+                droppedLines += 1;
+            }
+        },
+        finish() {
+            if (result)
+                return result;
+            if (!skipping)
+                take(pending);
+            pending = "";
+            const entries = [...texts.entries()];
+            let start = entries.length;
+            let bytes = 0;
+            while (start > 0 && entries.length - start < TEXT_ITEMS_MAX) {
+                const size = Buffer.byteLength(entries[start - 1][1].text);
+                if (bytes + size > TEXT_ITEMS_BYTES)
+                    break;
+                bytes += size;
+                start -= 1;
+            }
+            left += start;
+            const kept = entries.slice(start);
+            const items = kept.map(([source, { kind, number, text }]) => ({
+                id: `${kind}-${String(number).padStart(3, "0")}`,
+                kind,
+                lifecycle: done.has(source) ? "completed" : "started",
+                title: kind === "message" ? "agent message" : "agent reasoning",
+                text,
+            }));
+            const notices = [];
+            if (left > 0)
+                notices.push([
+                    "agent text truncated",
+                    `Kept the last ${kept.length} of ${kept.length + left} agent message and reasoning items, within ${TEXT_ITEMS_MAX} items and ${TEXT_ITEMS_BYTES / 1024} KiB. The terminal transcript keeps the captured stream.`,
+                ]);
+            if (droppedLines > 0)
+                notices.push([
+                    "agent output lines skipped",
+                    `Skipped ${droppedLines} stdout line(s) that ran past ${PENDING_LINE_CHARS} characters without a newline. Items on those lines are not in this trace or its counts.`,
+                ]);
+            notices.forEach(([title, text], index) => items.push({
+                id: `notice-${String(index + 1).padStart(3, "0")}`,
+                kind: "notice",
+                lifecycle: "completed",
+                status: "truncated",
+                title,
+                text,
+            }));
+            result = { items, messages: messageIds.size, participantItems: participantIds.size };
+            return result;
+        },
+    };
+}

package/dist/routes/terminal/plan.d.ts

@@ -1,6 +1,5 @@
 import type { RoutePlanResult, RouteRefusal, TerminalPlan } from "../../lab/plan-types.js";
 import type { LabConfig } from "../../lab/types.js";
-import type { RunLabProvenance } from "../../run/status.js";
 import { type TerminalProductLabResult } from "./types.js";
 /** The error a terminal lab returns before a run starts. `actor` names the registered actor. */
 export interface TerminalRefusal extends RouteRefusal<"terminal", NonNullable<TerminalProductLabResult["error"]>["code"]> {
@@ -13,9 +12,6 @@ export type TerminalPlanResult = RoutePlanResult<TerminalPlan, TerminalRefusal>;
  */
 export declare function planTerminalLab(config: LabConfig, input: {
     readonly dryRun: boolean;
-    readonly lab?: RunLabProvenance;
-    /** A caller's costProbe can measure spend lines, so a positive maxUsd can trip. */
-    readonly hooks?: {
-        readonly costProbe?: unknown;
-    };
+    /** A test's costProbe can measure spend lines, so a positive maxUsd can trip. */
+    readonly hasCostProbe?: boolean;
 }): TerminalPlanResult;

package/dist/routes/terminal/plan.js

@@ -1,6 +1,7 @@
 // The terminal route's plan: every configuration refusal the route makes before a run starts, in
 // its order and with its codes, then the plan the run uses. The route checks nothing here again;
 // what stays in the route reads external state (keys, the runtime env, the sandbox).
+import { DEFAULT_OPENAI_CU_MODEL } from "../../actors/computer-use/openai-provider.js";
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { isReasoningEffort } from "../../actors/reasoning-effort.js";
 import { actorRegistry, isTerminalActorDescriptor } from "../../actors/registry.js";
@@ -48,7 +49,6 @@ export function planTerminalLab(config, input) {
         return refuse("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", "terminal-product subjects require `subject.product` with a name and at least one public surface URL.", descriptor.id);
     const base = planBase(config, {
         dryRun: input.dryRun,
-        ...(input.lab === undefined ? {} : { lab: input.lab }),
         analysis,
     });
     const egressAllow = config.execution?.egressAllow;
@@ -62,7 +62,11 @@ export function planTerminalLab(config, input) {
         ...(actor?.mission === undefined ? {} : { mission: actor.mission }),
         runtime: {
             ...(runtimeVersion === undefined ? {} : { version: runtimeVersion }),
-            ...(actor?.model === undefined ? {} : { model: actor.model }),
+            // Codex's own default can change with any release and its JSON stream does not name it, so
+            // the route always passes a model: the declared one, else humanish's participant default.
+            ...(actor?.model === undefined
+                ? { model: DEFAULT_OPENAI_CU_MODEL, modelSource: "humanish_default" }
+                : { model: actor.model, modelSource: "declared" }),
             ...(actor?.reasoningEffort === undefined ? {} : { reasoningEffort: actor.reasoningEffort }),
             ...(config.execution?.runtimeAuth === undefined
                 ? {}
@@ -74,7 +78,7 @@ export function planTerminalLab(config, input) {
     const caps = config.scenario?.caps;
     if (input.dryRun)
         return { ok: true, plan: { ...shared, dryRun: true, ...(caps ? { caps } : {}) } };
-    // The live lane injects the runtime key into one command only, and only a registered actor
+    // The live route injects the runtime key into one command only, and only a registered actor
     // that declares that placement may run live.
     const keyPlacement = descriptor.capabilities.keyPlacement;
     if (keyPlacement !== "in-sandbox-command-scoped")
@@ -85,12 +89,12 @@ export function planTerminalLab(config, input) {
     if (caps === undefined || maxUsd === undefined || maxMinutes === undefined || maxMinutes <= 0)
         return refuse("HUMANISH_TERMINAL_LAB_CAPS_MISSING", "A live terminal-product run grants provider access to the in-sandbox agent and so REQUIRES a fail-closed cap: scenario.caps with maxUsd (0 = no-spend) and a positive maxMinutes (the codex command's wall-clock kill). The live key is never exercised without a cap in force.", descriptor.id);
     // maxUsd is checked against the cost ledger after the session, and only known lines can trip it.
-    // Core records the Codex provider line as unpriced tokens (no rate for model `codex`) and has no
-    // product, media or payment signal, so without a costProbe every line is null and a positive
-    // maxUsd could never trip. That cap would promise a bound nothing enforces, so it is refused;
-    // maxMinutes is what bounds a live run.
-    if (maxUsd > 0 && input.hooks?.costProbe === undefined)
-        return refuse("HUMANISH_TERMINAL_LAB_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: the Codex participant's provider spend is recorded as unpriced tokens and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
+    // The ledger's provider line takes only provider-reported cost, which Codex does not report (the
+    // token estimate in run.json is not a measurement), and core has no product, media or payment
+    // signal, so without a costProbe every line is null and a positive maxUsd could never trip. That
+    // cap would promise a bound nothing enforces, so it is refused; maxMinutes bounds a live run.
+    if (maxUsd > 0 && input.hasCostProbe !== true)
+        return refuse("HUMANISH_TERMINAL_LAB_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: Codex reports no provider cost for the participant (its token cost is only estimated after the run) and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
     // The sandbox's timeout covers the steps before the codex command, maxMinutes and the teardown
     // buffer, and E2B refuses a sandbox over an hour. Refuse here, with the arithmetic, rather than
     // after the plan prints, from a provider 400 that names neither knob.

package/dist/routes/terminal/recorder.d.ts

@@ -1,7 +1,8 @@
 import { type CommandLogRecord, type InterventionRecord, type LifecycleRecord, type TerminalEventRecord } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export declare function createTerminalRecorder(args: {
     nowIso: () => string;
@@ -17,6 +18,10 @@ export declare function createTerminalRecorder(args: {
         stderr: string;
         combined: string;
     };
+    participantText: {
+        append(raw: string): void;
+        finish(): import("./participant-text.js").TerminalParticipantText;
+    };
     recordLifecycle: (event: string, message: string) => void;
     recordStreamedTerminalChunk: (stream: "stdout" | "stderr", raw: string) => void;
     appendReturnedTerminalOutput: (stream: "stdout" | "stderr", raw: string) => void;

package/dist/routes/terminal/recorder.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import { createTerminalParticipantReader } from "./participant-text.js";
 import { MAX_TRANSCRIPT_BYTES, } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export function createTerminalRecorder(args) {
     const { nowIso, sanitize, knownSecretValues } = args;
@@ -13,7 +15,9 @@ export function createTerminalRecorder(args) {
     // cross-chunk redaction below; this overlap is never added to terminal events/artifacts.
     const discardedPrefixes = { stdout: "", stderr: "", combined: "" };
     const maxDiscardedPrefixChars = Math.max(0, ...knownSecretValues.map((value) => value.length - 1));
-    const interventions = []; // ALWAYS empty while no assisted-input path ships.
+    const interventions = []; // Always empty while no assisted-input path ships.
+    // Reads the agent's text from the raw stdout in memory; it keeps only sanitized decoded text.
+    const participantText = createTerminalParticipantReader(sanitize);
     let transcriptBytes = 0;
     const recordLifecycle = (event, message) => {
         lifecycle.push({ at: nowIso(), event, message: sanitize(message) });
@@ -28,10 +32,13 @@ export function createTerminalRecorder(args) {
             return;
         }
         transcriptBytes += Buffer.byteLength(raw, "utf8");
-        // Scrub THEN redact at the SOURCE — raw bytes never leave this function (safety contract item 5).
+        // Scrub, then redact, at the source (safety contract item 5). Only the participant reader below
+        // sees the raw bytes, and it stores none of them.
         terminalEvents.push({ at: nowIso(), stream, chunk: sanitize(raw) });
+        if (stream === "stdout")
+            participantText.append(raw);
     };
-    // E2B can stream every byte through callbacks AND return the same complete output (#667).
+    // E2B can stream every byte through callbacks and return the same complete output (#667).
     // Track transport delivery, independently per stream, rather than deduplicating participant
     // lines or equal usage records. Hash raw callback bytes before redaction/truncation so the
     // comparison cannot confuse two values that redact identically or lose capped-away delivery.
@@ -70,6 +77,7 @@ export function createTerminalRecorder(args) {
         terminalEvents,
         interventions,
         discardedPrefixes,
+        participantText,
         recordLifecycle,
         recordStreamedTerminalChunk,
         appendReturnedTerminalOutput,

package/dist/routes/terminal/result.js

@@ -46,14 +46,14 @@ export function terminalExecutionFailures(args) {
 /** The terminal-product lab result for a live run, from its session, cleanup and cost ledger. */
 export function terminalLabResult(args) {
     const { cwd, labId, actorId, productName, runId, sessionStatus, completionReason, sessionReason, sessionError, sandboxId, cleanup, cost, noSpendProof, capFailure, declaredScorerFailure, judgment, execution, observer, warnings, } = args;
-    // The lab's exit code: verified evidence AND no harness error AND proven cleanup. A blocked/
-    // timed-out agent run is STILL ok-as-evidence at the bundle level (the failure is the evidence),
-    // but the LAB result surfaces ok:false on a harness error or unproven teardown (fail-closed).
+    // The lab's exit code: verified evidence, no harness error and proven cleanup. A blocked/
+    // timed-out agent run is still ok-as-evidence at the bundle level (the failure is the evidence),
+    // but the lab result surfaces ok:false on a harness error or unproven teardown (fail-closed).
     // remaining===0 is the by-id-confirmed-reclaimed state; remaining===1 (still present) and
     // remaining===-1 (kill(id) itself failed) are both unproven by design.
     const cleanupProven = cleanup.killed && cleanup.remaining === 0;
     // A CONFIG-DECLARED scorer that failed to render a pass (status:"fail" / malformed / throw) fails the
-    // run RESULT too, not just the persisted verdict — the keystone lane's declared rubric is a gate, so
+    // run result as well as the persisted verdict: the keystone route's declared rubric is a gate, so
     // its fail must drive exit code. Library callers never set this (additive, back-compat).
     const ok = resultOk({
         judgment,