humanish 0.106.0 → 0.107.0

package/dist/routes/terminal/route.js

@@ -8,39 +8,39 @@
 //      live-sandbox.ts and live-finish.ts); a dry plan publishes its contract bundle (dry-run.ts);
 //   4. automatic analysis of a run that published its final bundle.
 //
-// THE SAFETY CONTRACT (docs/goals/terminal-product-lane/goal.md) is enforced BY CONSTRUCTION in
-// the files each item names, and CHECKED by the verifier (verify/actor.ts
+// The safety contract (`docs/goals/terminal-product-lane/goal.md`) is enforced by construction in
+// the files each item names, and checked by the verifier (verify/actor.ts
 // validateTerminalProductEvidence):
-//   1. EXPLICIT KEY PLACEMENT. openai-env (default) injects the raw runtime key command-scoped,
-//      NEVER Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
+//   1. Explicit key placement. openai-env (default) injects the raw runtime key command-scoped,
+//      never through Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
 //      header transform and passes an inert command placeholder. The proxy is spendable by every
 //      sandbox process from creation; this protects the raw key, not provider spending.
 //      Enforced in credentials.ts and runtime-auth.ts.
-//   2. FAIL-CLOSED CAP. The live key is never exercised without scenario.caps in force: maxUsd
+//   2. Fail-closed cap. The live key is never exercised without scenario.caps in force: maxUsd
 //      (default/require 0 = no-spend) + maxMinutes (wall-clock kill of the codex command).
 //      Enforced in plan.ts (caps required), live-sandbox.ts and lifetime.ts (the wall clock).
-//   3. PUBLIC SURFACES ONLY. The mission references only subject.product.publicSurfaces + the
-//      author mission. No clone, no private-source access — nothing is git-cloned in this lane.
+//   3. Public surfaces only. The mission references only subject.product.publicSurfaces + the
+//      author mission. No clone, no private-source access — nothing is git-cloned on this route.
 //      Enforced in session.ts, which composes the prompt.
-//   4. DENY-BY-DEFAULT CREDENTIALS. The command envs are built from an ALLOWLIST of ONLY the
+//   4. Deny-by-default credentials. The command envs are built from an allowlist holding only the
 //      declared runtime key; GITHUB_TOKEN/GH_TOKEN/payment/deploy/db/media keys are excluded by
 //      construction (a banned-name guard also fails closed if one is ever requested).
 //      Enforced in credentials.ts.
-//   5. NO SECRET VALUES IN EVIDENCE. Every captured byte (event stream, transcript, command logs,
+//   5. No secret values in evidence. Every captured byte (event stream, transcript, command logs,
 //      agent report, metadata) passes scrubKnownValues (literal scrub of the runtime key + any
-//      provisioned values, >=4 chars, PRE-truncation) THEN redactText (shape patterns) BEFORE
-//      persisting. The transport is labeled HONESTLY (exec-stream/snapshot, NOT an interactive pty).
+//      provisioned values, >=4 chars, before truncation), then redactText (shape patterns), before
+//      persisting. The transport is labeled exec-stream/snapshot; there is no interactive pty.
 //      Enforced in recorder.ts, with the scrubber session.ts builds.
-//   6. METADATA POSITIVE ALLOWLIST. buildSandboxMetadata(allowlist) is the ONLY way metadata is
+//   6. Metadata positive allowlist. buildSandboxMetadata(allowlist) is the only way metadata is
 //      set; it carries solely non-secret labels (mode/tool/labId/simId/provider/runId).
 //      Enforced in credentials.ts.
-//   7. STDIN DISABLED + INTERVENTIONS LEDGER. stdin is never wired to the codex command; the
-//      bundle ALWAYS carries an interventions ledger (empty array is valid + required-present).
+//   7. Stdin disabled + interventions ledger. stdin is never wired to the codex command; the
+//      bundle always carries an interventions ledger (empty array is valid + required-present).
 //      Enforced in live-sandbox.ts (stdin) and recorder.ts (the ledger).
-//   8. PROVEN CLEANUP, BY ID, NEVER ACCOUNT-WIDE. Sandbox.kill(id) in a finally; the cleanup
-//      proof is BY EXACT ID: kill(id)'s own found-and-killed boolean, confirmed further by
+//   8. Proven cleanup, by id, never account-wide. Sandbox.kill(id) in a finally; the cleanup
+//      proof is by exact id: kill(id)'s own found-and-killed boolean, confirmed further by
 //      Sandbox.getInfo(id) when the SDK exposes it (a thrown SandboxNotFoundError means gone).
-//      humanish NEVER calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
+//      humanish never calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
 //      sandbox it did not create. A live run that cannot prove teardown fails closed.
 //      Enforced in sandbox.ts.
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
@@ -50,18 +50,18 @@ import { runScope } from "../../run/run.js";
 import { planTerminalLab } from "./plan.js";
 import { runDryTerminalLab } from "./dry-run.js";
 import { checkLiveTerminalMachine, runLiveTerminalSession } from "./session.js";
-import { terminalInputWithScorer } from "../../lab/route-inputs.js";
+import { terminalRouteScorer } from "../../lab/adapter-scorer-loader.js";
+import { withLateScorer } from "../../lab/route-inputs.js";
 import { TERMINAL_PRODUCT_LAB_SCHEMA, } from "./types.js";
 /**
  * The config-taking entry point. It plans, returns a refusal with the same envelope and analysis
  * record the route has always returned, and otherwise runs the plan.
  */
 export async function runTerminalProductLab(options) {
-    const { config, dryRun, lab, ...input } = options;
+    const { config, dryRun, ...input } = options;
     const planned = planTerminalLab(config, {
         dryRun,
-        ...(lab === undefined ? {} : { lab }),
-        ...(input.hooks === undefined ? {} : { hooks: input.hooks }),
+        hasCostProbe: input.deps?.costProbe !== undefined,
     });
     if (planned.ok)
         return runTerminalPlan(planned.plan, input);
@@ -84,7 +84,7 @@ export function terminalLabRefusal(options, refusal) {
     };
     // A refusal starts no run, so a declared or default analysis is recorded as skipped.
     const analysis = resolveAutomaticAnalysis(config.review?.analysis);
-    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options.automaticAnalysis, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
+    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
 }
 /**
  * Run a terminal plan. The run scope gives a direct library caller the same run lifetime the CLI
@@ -106,11 +106,11 @@ export async function admitTerminalPlan(plan, input) {
         return { ok: false, outcome: terminalOutcome(admission.result) };
     return {
         ok: true,
-        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, terminalInputWithScorer(input, scorer))),
+        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, withLateScorer(input, scorer, terminalRouteScorer))),
     };
 }
 function terminalOutcome(result) {
-    return { route: "terminal", backend: "terminal", result };
+    return { route: "terminal", result };
 }
 /**
  * A live plan's local checks, made outside any run scope. A refusal is the result runTerminalPlan
@@ -132,7 +132,7 @@ async function runAdmittedTerminalRun(admitted, input) {
     return completeTerminalAnalysis(admitted.plan, input, result, finished);
 }
 function completeTerminalAnalysis(plan, input, result, finished) {
-    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input.automaticAnalysis, {
+    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input, {
         ...(plan.analysis === undefined ? {} : { trigger: plan.analysis.trigger }),
         preferLargerOutput: plan.analysis?.preferLargerOutput === true,
     });
@@ -157,7 +157,7 @@ async function runTerminalPlanInScope(admitted, input, scope) {
     const cwd = path.resolve(input.cwd);
     const { warnings } = admitted;
     const failed = terminalFailure(admitted.plan, input, warnings);
-    // LIVE path: the real in-sandbox agent session. A separate orchestrator owns the
+    // Live path: the real in-sandbox agent session. A separate orchestrator owns the
     // create -> inject (command-scoped) -> run -> capture -> teardown lifecycle so the dry-run path
     // below stays a pure contract builder. It enforces the safety contract by construction (the
     // keyPlacement-routed command-scoped key, the deny-by-default allowlist, the fail-closed cap,

package/dist/routes/terminal/runtime.d.ts

@@ -6,9 +6,10 @@ export declare function isExactRuntimeVersion(value: unknown): value is string;
 /** Captured Codex CLI output: `codex-cli 0.153.3\n`. Other shapes fail closed. */
 export declare function parseTerminalRuntimeVersion(stdout: string): string | undefined;
 export declare function buildRuntimeVersionCommand(requestedVersion?: string): string;
-export declare function buildRuntimeExecPrefix(version: string, model?: string, reasoningEffort?: ReasoningEffort): string;
+export declare function buildRuntimeExecPrefix(version: string, model: string, reasoningEffort?: ReasoningEffort): string;
 export declare function declaredRuntimeProvenance(args: {
     version?: string;
-    model?: string;
+    model: string;
+    modelSource: "declared" | "humanish_default";
     reasoningEffort?: ReasoningEffort;
 }): ActorRuntimeProvenance;

package/dist/routes/terminal/runtime.js

@@ -26,7 +26,7 @@ export function buildRuntimeExecPrefix(version, model, reasoningEffort) {
     if (!isExactRuntimeVersion(version))
         throw new Error("Codex execution requires a verified exact runtime version.");
     return (`npm_config_update_notifier=false npx -y ${TERMINAL_RUNTIME_PACKAGE}@${version} exec` +
-        (model === undefined ? "" : ` --model ${shellQuote(model)}`) +
+        ` --model ${shellQuote(model)}` +
         (reasoningEffort === undefined
             ? ""
             : ` -c ${shellQuote(`model_reasoning_effort=${JSON.stringify(reasoningEffort)}`)}`));
@@ -37,8 +37,8 @@ export function declaredRuntimeProvenance(args) {
         package: TERMINAL_RUNTIME_PACKAGE,
         requestedVersion: args.version ?? "latest",
         versionStatus: "unobserved",
-        ...(args.model === undefined ? {} : { requestedModel: args.model }),
-        modelStatus: args.model === undefined ? "runtime_default_unobserved" : "declared",
+        requestedModel: args.model,
+        modelStatus: args.modelSource,
         ...(args.reasoningEffort === undefined
             ? {}
             : { requestedReasoningEffort: args.reasoningEffort }),

package/dist/routes/terminal/sandbox.d.ts

@@ -2,13 +2,13 @@ import type { OwnedDesktopAllocation } from "../../substrates/desktop-session.js
 import { E2BDesktopStartupError, type E2BDesktopModule } from "../../substrates/e2b/sdk.js";
 import type { TerminalLedgers } from "./types.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export declare function teardownSandbox(args: {
@@ -17,6 +17,8 @@ export declare function teardownSandbox(args: {
     /** For the Sandbox.getInfo(id) re-check only. */
     sandboxModule: E2BDesktopModule | undefined;
     startupCleanup?: E2BDesktopStartupError["cleanup"];
+    /** Why the startup guard's cleanup is unconfirmed, when it knows. */
+    startupCleanupDetail?: string | undefined;
     requestTimeoutMs: number;
     sanitize: (text: string) => string;
     recordLifecycle: (event: string, message: string) => void;

package/dist/routes/terminal/sandbox.js

@@ -1,27 +1,28 @@
 import { toErrorMessage } from "../../evidence/redaction.js";
 import { E2BDesktopStartupError, isSandboxNotFoundError, } from "../../substrates/e2b/sdk.js";
+import { releaseUnavailableDetail } from "../../substrates/e2b/sandbox.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export async function teardownSandbox(args) {
-    const { allocation, sandboxModule, startupCleanup, requestTimeoutMs, sanitize, recordLifecycle, warnings, } = args;
+    const { allocation, sandboxModule, startupCleanup, startupCleanupDetail, requestTimeoutMs, sanitize, recordLifecycle, warnings, } = args;
     if (allocation === undefined || !sandboxModule) {
-        // create() can reject AFTER its constructor acquired a handle. The default loader retains
-        // that authority and reclaims it before rejecting; the lane itself never receives its ID.
+        // create() can reject after its constructor acquired a handle. The default loader retains
+        // that authority and reclaims it before rejecting; the route itself never receives its ID.
         if (startupCleanup === "killed" || startupCleanup === "already_gone") {
             const reason = `desktop startup guard confirmed its acquired sandbox ${startupCleanup === "killed" ? "was killed" : "was already gone"}`;
             recordLifecycle("terminal-lab.cleanup.killed", reason);
             return { killed: true, remaining: 0, reason };
         }
         const reason = startupCleanup === "unconfirmed"
-            ? "desktop startup guard could not confirm cleanup of its acquired sandbox; provider timeout remains the backstop"
+            ? `desktop startup guard could not confirm cleanup of its acquired sandbox${startupCleanupDetail === undefined ? "" : ` (${startupCleanupDetail})`}; provider timeout remains the backstop`
             : "create did not return a sandbox; the participant has no acquired handle and cannot establish allocation or cleanup";
         recordLifecycle("terminal-lab.cleanup.unconfirmed", reason);
         return { killed: false, remaining: -1, reason };
@@ -30,11 +31,7 @@ export async function teardownSandbox(args) {
     const released = await allocation.close();
     if (released.status !== "released") {
         if (released.status === "unconfirmed" && released.reason === "release_unavailable") {
-            return {
-                killed: false,
-                remaining: -1,
-                reason: "installed @e2b/desktop SDK does not expose Sandbox.kill; server-side kill-on-timeout will reclaim the sandbox",
-            };
+            return { killed: false, remaining: -1, reason: releaseUnavailableDetail(released.detail) };
         }
         if (released.status === "unconfirmed" && released.reason === "release_failed") {
             const sanitizedError = sanitize(toErrorMessage(released.error));
@@ -52,12 +49,12 @@ export async function teardownSandbox(args) {
         recordLifecycle("terminal-lab.cleanup.unconfirmed", `Sandbox ${sandboxId} ${reason}.`);
         return { killed: false, remaining: -1, reason };
     }
-    // BY-ID verification only, from here down: NEVER Sandbox.list. A released result is itself proof
+    // By-id verification only, from here down: never Sandbox.list. A released result is itself proof
     // the exact sandbox is gone: terminated when kill(id) found and killed it, already gone when
     // kill(id) answered false or threw not-found (a 404, e.g. the server-side kill-on-timeout raced
     // ahead). Both mean "this id is no longer running." Sandbox.getInfo(id), when the SDK exposes
     // it, adds a second by-id confirmation; the only thing that overturns the release proof is
-    // getInfo returning a LIVE sandbox for this exact id.
+    // getInfo returning a live sandbox for this exact id.
     const killNote = released.reason === "terminated"
         ? "kill(id) returned true (found and killed)"
         : "kill(id) found the exact sandbox already gone (404)";
@@ -88,8 +85,8 @@ export async function teardownSandbox(args) {
                 reason: `reclaimed by id; getInfo(id) confirms the exact sandbox no longer exists (SandboxNotFoundError)`,
             };
         }
-        // getInfo(id) failed for a reason OTHER than "not found" (e.g. a transient network error):
-        // no second by-id confirmation is available, so the RESOLVED kill(id) call stands as the proof
+        // getInfo(id) failed for a reason other than "not found" (e.g. a transient network error):
+        // no second by-id confirmation is available, so the resolved kill(id) call stands as the proof
         // of absence. Never fall back to Sandbox.list.
         const sanitizedError = sanitize(toErrorMessage(error));
         recordLifecycle("terminal-lab.cleanup.killed", `Sandbox ${sandboxId} reclaimed: ${killNote}; getInfo(id) re-verification errored (${sanitizedError}), so kill(id)'s resolved result is the proof.`);

package/dist/routes/terminal/session.js

@@ -1,4 +1,5 @@
 import { randomBytes, randomUUID } from "node:crypto";
+import { missingKeys } from "../../lab/requirements.js";
 import { declaredRuntimeProvenance } from "./runtime.js";
 import { digestText, redactText, scrubLiterals } from "../../evidence/redaction.js";
 import { describeMissingKeys } from "../../keys/key-resolution.js";
@@ -15,7 +16,7 @@ import { finishLiveTerminalSession } from "./live-finish.js";
  * a declared scorer. Returns the runtime key's command-scoped placement, or the refusal.
  */
 export function checkLiveTerminalMachine(plan, input, warnings) {
-    const env = input.hooks?.env ?? process.env;
+    const env = input.env ?? process.env;
     const { maxUsd } = plan.caps;
     // planTerminalLab refuses a positive maxUsd without a costProbe, so one is present here.
     if (maxUsd > 0) {
@@ -26,7 +27,8 @@ export function checkLiveTerminalMachine(plan, input, warnings) {
     if (!runtimeEnv.ok)
         return runtimeEnv;
     // The sandbox is created with E2B_API_KEY, so a missing key is refused before the run starts.
-    if (!env.E2B_API_KEY?.trim()) {
+    // The runtime key above is the plan's `key-one-of`; E2B_API_KEY is its only `key`.
+    if (missingKeys(plan.requirements, env).length > 0) {
         return {
             ok: false,
             code: "HUMANISH_TERMINAL_LAB_KEYS_MISSING",
@@ -46,9 +48,9 @@ export async function runLiveTerminalSession(args) {
     const { plan, input, cwd, warnings, failed, scope, runtimeEnv } = args;
     const { actor, product } = plan;
     const { maxUsd, maxMinutes } = plan.caps;
-    const hooks = input.hooks ?? {};
-    const env = hooks.env ?? process.env;
-    const now = hooks.now ?? (() => Date.now());
+    const deps = input.deps ?? {};
+    const env = input.env ?? process.env;
+    const now = deps.now ?? (() => Date.now());
     const nowIso = () => new Date(now()).toISOString();
     const prepared = await prepareLivePrompt({ plan, cwd, runtimeEnv, env, warnings });
     const { mission, physicalCwd, persona, composedPrompt, verdictNonce } = prepared;
@@ -61,7 +63,7 @@ export async function runLiveTerminalSession(args) {
         mode: "live",
         lab: plan.lab,
         renderReview: renderTerminalReviewMarkdown,
-        observer: { open: input.open === true, render: hooks.renderObserverFn },
+        observer: { open: input.open === true, render: deps.renderObserver },
         now,
     });
     if (!started.ok)
@@ -77,17 +79,18 @@ export async function runLiveTerminalSession(args) {
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     // The ledgers + capture buffers, mutated through the live lifecycle.
     const recorder = createTerminalRecorder({ nowIso, sanitize, knownSecretValues });
-    const { version, model, reasoningEffort } = plan.runtime;
+    const { version, model, modelSource, reasoningEffort } = plan.runtime;
     const runtime = declaredRuntimeProvenance({
         ...(version === undefined ? {} : { version }),
-        ...(model === undefined ? {} : { model: sanitize(model) }),
+        model: sanitize(model),
+        modelSource,
         ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
     });
     recorder.recordLifecycle("terminal-lab.run.created", `Created live terminal-product run ${runId} (actor ${actor}, product ${product.name}). Caps: maxUsd=${maxUsd}, maxMinutes=${maxMinutes}. Subject provenance UNPINNED (public surfaces only).`);
     const session = new LiveTerminalSandbox({
         plan,
         cwd,
-        hooks,
+        deps,
         now,
         nowIso,
         sanitize,
@@ -122,7 +125,6 @@ export async function runLiveTerminalSession(args) {
         plan,
         input,
         cwd,
-        hooks,
         sanitize,
         nowIso,
         knownSecretValues,
@@ -144,7 +146,7 @@ export async function runLiveTerminalSession(args) {
 async function prepareLivePrompt(args) {
     const { plan, cwd, runtimeEnv, env, warnings } = args;
     const { product } = plan;
-    // Compose the prompt from PUBLIC surfaces + the author mission ONLY (safety contract item 3).
+    // Compose the prompt from public surfaces and the author mission alone (safety contract item 3).
     // Inject a per-run verdict nonce: the agent echoes HUMANISH_ACTOR_VERDICT=<status>
     // HUMANISH_ACTOR_NONCE=<nonce>; the scorer verifies the nonce so replayed text cannot forge it.
     const mission = plan.mission ?? defaultMission(product.name);
@@ -158,8 +160,8 @@ async function prepareLivePrompt(args) {
         verdictNonce,
     });
     const promptDigest = digestText(composedPrompt);
-    // --- Safety contract item 5: literal-scrub EVERY known value, then pattern-redact, at the source. ---
-    // The runtime key value (+ any other provisioned value) is scrubbed by LITERAL match before
+    // --- Safety contract item 5: literal-scrub every known value, then pattern-redact, at the source. ---
+    // The runtime key value (+ any other provisioned value) is scrubbed by literal match before
     // anything persists (a key has no detectable "shape" if it is an arbitrary token); redactText is
     // the second pass for secret-SHAPED content. Applied PRE-truncation so a cut can never split a
     // value past the scrubber.
@@ -177,7 +179,7 @@ async function prepareLivePrompt(args) {
         sanitize,
     };
 }
-/** Compose the live prompt: PUBLIC surfaces + author mission + the verdict-nonce marker contract. */
+/** Compose the live prompt: public surfaces + author mission + the verdict-nonce marker contract. */
 function composeLivePrompt(args) {
     return [
         args.personaLine,

package/dist/routes/terminal/token-usage.js

@@ -1,6 +1,6 @@
-// Provider token accounting for the terminal lane (#531).
+// Provider token accounting for the terminal route (#531).
 //
-// THE GAP THIS CLOSES. A live terminal run reported `cost.lines.provider = null` with source
+// The gap this closes: a live terminal run reported `cost.lines.provider = null` with source
 // "unmeasured", and the no-spend proof then read `satisfied: true` for `maxUsd: 0` on a run that
 // had demonstrably consumed hundreds of thousands of provider tokens. The statement was honest
 // (it listed provider as unmeasured) but it conflated two very different states: having no signal
@@ -10,11 +10,11 @@
 //   {"type":"turn.completed","usage":{"input_tokens":201536,"cached_input_tokens":170558,
 //    "cache_write_input_tokens":30951,"output_tokens":2283,"reasoning_output_tokens":902}}
 //
-// So the lane can record a MEASURED token fact even when it cannot record a priced one. Rates stay
-// out of this module deliberately: pricing lives in src/run/pricing.ts, and the terminal lane has no
+// So the route can record a measured token fact even when it cannot record a priced one. Rates stay
+// out of this module deliberately: pricing lives in src/run/pricing.ts, and the terminal route has no
 // real model id to price against (it records `model: "codex"`), so the honest output is
 // tokens-known-rate-unknown rather than a guessed dollar figure.
-// Bounded to a single line on purpose. `[^}]*` would run past a TRUNCATED record's missing brace
+// Bounded to a single line on purpose. `[^}]*` would run past a truncated record's missing brace
 // and swallow the next, valid record's body, silently dropping a real turn from the count.
 const USAGE_RE = /"type"\s*:\s*"turn\.completed"\s*,\s*"usage"\s*:\s*(\{[^}\n]*\})/g;
 function num(value) {

package/dist/routes/terminal/trace.d.ts

@@ -1,5 +1,6 @@
 import type { ActorCompletionReason, ActorPersonaRef, ActorRuntimeProvenance, ActorStatus, ActorTokenUsage, ActorTrace } from "../../actors/contract.js";
 import type { LabRuntimeAuth } from "../../lab/types.js";
+import type { TerminalParticipantText } from "./participant-text.js";
 import { type CommandLogRecord, type TerminalEventRecord } from "./types.js";
 /**
  * Per-chunk sanitization cannot recognize a value split across deliveries. Redact those complete
@@ -10,9 +11,9 @@ export declare function scrubSplitKnownValues(events: TerminalEventRecord[], kno
 /** Redacted, ellipsis-prefixed tail of a captured stream/log for a message field. */
 export declare function tailOf(text: string): string;
 /**
- * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (lane
+ * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (`lane`
  * "terminal", protocol "terminal-exec"). counts.actions/messages drive the no-engagement honesty
- * guard (a real run bumps them; a no-op is caught). No screenshots on this lane.
+ * guard (a real run bumps them; a no-op is caught). No screenshots on this route.
  */
 export declare function buildTerminalActorTrace(args: {
     persona: ActorPersonaRef;
@@ -31,10 +32,6 @@ export declare function buildTerminalActorTrace(args: {
     /** Runtime-turn aggregate usage parsed from the exec stream (#531). Absent when the stream
      *  carried no usage record, which stays distinct from a measured zero. */
     tokenUsage?: ActorTokenUsage;
+    /** The agent's own text and activity, read from the raw stdout as it arrived. */
+    participant: TerminalParticipantText;
 }): ActorTrace;
-/** Count distinct participant items in the retained Codex JSON stdout stream.
- * The caller supplies stdout only, after transport reconciliation and redaction.
- * Lifecycle, usage, launcher diagnostics, and nested command output are not activity.
- * Zero means no recognized item was retained, not that the participant succeeded.
- */
-export declare function countTerminalParticipantItems(stdout: string): number;

package/dist/routes/terminal/trace.js

@@ -1,6 +1,5 @@
 import { ACTOR_TRACE_SCHEMA, TERMINAL_AGENT_CAPABILITIES } from "../../actors/contract.js";
 import { redactedTail } from "../../evidence/redaction.js";
-import { normalizeLocalActorTranscript } from "../../run/terminal-contract.js";
 import { TAIL_CHARS } from "./types.js";
 /**
  * Per-chunk sanitization cannot recognize a value split across deliveries. Redact those complete
@@ -57,9 +56,9 @@ export function tailOf(text) {
     return redactedTail(text, TAIL_CHARS);
 }
 /**
- * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (lane
+ * Project the live terminal session into the provider-neutral humanish.actor-trace.v1 (`lane`
  * "terminal", protocol "terminal-exec"). counts.actions/messages drive the no-engagement honesty
- * guard (a real run bumps them; a no-op is caught). No screenshots on this lane.
+ * guard (a real run bumps them; a no-op is caught). No screenshots on this route.
  */
 export function buildTerminalActorTrace(args) {
     const items = [
@@ -74,19 +73,7 @@ export function buildTerminalActorTrace(args) {
                 outputTail: args.transcriptTail,
             },
         })),
-        // One message item carrying the (already-redacted) transcript tail so the trace shows the agent
-        // narrated SOMETHING — the engagement signal the no-engagement guard reads.
-        ...(args.terminalEvents.length > 0
-            ? [
-                {
-                    id: "message-001",
-                    kind: "message",
-                    lifecycle: "completed",
-                    title: "agent terminal output",
-                    text: args.transcriptTail,
-                },
-            ]
-            : []),
+        ...args.participant.items,
     ];
     return {
         schema: ACTOR_TRACE_SCHEMA,
@@ -113,17 +100,13 @@ export function buildTerminalActorTrace(args) {
         ...(args.tokenUsage ? { tokenUsage: args.tokenUsage } : {}),
         counts: {
             commands: args.commandLog.length,
-            // Unlike the legacy transcript message/actions counts, this establishes
-            // actual runtime item activity. Stderr and bootstrap commands never count.
-            // Read the full retained stdout: its early items may no longer be in the tail.
-            runtimeParticipantItems: countTerminalParticipantItems(normalizeLocalActorTranscript(args.terminalEvents
-                .filter((event) => event.stream === "stdout")
-                .map((event) => event.chunk)
-                .join(""))),
-            // actions == executed commands; messages == 1 when the agent produced any output. The
-            // no-engagement guard (verify/actor.ts) reads these: a real run bumps them, a no-op is caught.
+            // Unlike the actions count, this establishes actual runtime item activity. Stderr and
+            // bootstrap commands never count.
+            runtimeParticipantItems: args.participant.participantItems,
+            // actions == executed commands, so the launcher command alone keeps the no-engagement guard
+            // (verify/actor.ts) satisfied; messages == the agent_message items in the stream.
             actions: args.commandLog.length,
-            messages: args.terminalEvents.length > 0 ? 1 : 0,
+            messages: args.participant.messages,
             terminalEvents: args.terminalEvents.length,
         },
         items,
@@ -132,41 +115,3 @@ export function buildTerminalActorTrace(args) {
             : TERMINAL_AGENT_CAPABILITIES,
     };
 }
-const itemEvents = new Set(["item.started", "item.updated", "item.completed"]);
-const nonempty = (value) => typeof value === "string" && value.trim().length > 0;
-const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-/** Count distinct participant items in the retained Codex JSON stdout stream.
- * The caller supplies stdout only, after transport reconciliation and redaction.
- * Lifecycle, usage, launcher diagnostics, and nested command output are not activity.
- * Zero means no recognized item was retained, not that the participant succeeded.
- */
-export function countTerminalParticipantItems(stdout) {
-    const ids = new Set();
-    for (const line of stdout.split("\n")) {
-        let event;
-        try {
-            event = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        if (!object(event) ||
-            typeof event.type !== "string" ||
-            !itemEvents.has(event.type) ||
-            !object(event.item))
-            continue;
-        const item = event.item;
-        if (!nonempty(item.id))
-            continue;
-        const active = ((item.type === "agent_message" || item.type === "reasoning") && nonempty(item.text)) ||
-            (item.type === "command_execution" && nonempty(item.command)) ||
-            (item.type === "web_search" &&
-                (nonempty(item.query) || (object(item.action) && nonempty(item.action.type)))) ||
-            (item.type === "file_change" &&
-                Array.isArray(item.changes) &&
-                item.changes.some((change) => object(change) && nonempty(change.path) && nonempty(change.kind)));
-        if (active)
-            ids.add(item.id);
-    }
-    return ids.size;
-}