humanish 0.106.1 → 0.107.0

package/dist/routes/terminal/participant-text.js

@@ -0,0 +1,165 @@
+import { normalizeLocalActorTranscript } from "../../run/terminal-contract.js";
+import { MESSAGE_CHARS, PENDING_LINE_CHARS, TEXT_ITEMS_BYTES, TEXT_ITEMS_MAX } from "./types.js";
+const itemEvents = new Set(["item.started", "item.updated", "item.completed"]);
+const nonempty = (value) => typeof value === "string" && value.trim().length > 0;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Each Codex item event in a run of complete JSON lines, in stream order. */
+function* codexStreamItems(lines) {
+    for (const line of lines.split("\n")) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!object(event) ||
+            typeof event.type !== "string" ||
+            !itemEvents.has(event.type) ||
+            !object(event.item) ||
+            !nonempty(event.item.id))
+            continue;
+        yield { event: event.type, id: event.item.id, item: event.item };
+    }
+}
+function isParticipantItem(item) {
+    return (((item.type === "agent_message" || item.type === "reasoning") && nonempty(item.text)) ||
+        (item.type === "command_execution" && nonempty(item.command)) ||
+        (item.type === "web_search" &&
+            (nonempty(item.query) || (object(item.action) && nonempty(item.action.type)))) ||
+        (item.type === "file_change" &&
+            Array.isArray(item.changes) &&
+            item.changes.some((change) => object(change) && nonempty(change.path) && nonempty(change.kind))));
+}
+// The verdict parser removes all whitespace before matching, so a line is a marker line when its
+// whitespace-free form names either marker. The parser reads the stored stream, not these items.
+const MARKER = /HUMANISH_ACTOR_(?:VERDICT|NONCE)=/i;
+const withoutMarkerLines = (text) => text
+    .split("\n")
+    .filter((line) => !MARKER.test(line.replace(/\s+/g, "")))
+    .join("\n");
+/**
+ * Read participant text from the raw stdout as the recorder receives it. Source redaction runs on
+ * the stored stream and can cut through JSON framing (a redacted URL takes the closing quote with
+ * it), so each line is parsed here, in memory, and only decoded text that has passed `sanitize`
+ * is kept. The raw bytes are never stored.
+ */
+export function createTerminalParticipantReader(sanitize) {
+    let pending = "";
+    // Set while the rest of an over-long line is skipped, up to its newline.
+    let skipping = false;
+    let droppedLines = 0;
+    const participantIds = new Set();
+    const messageIds = new Set();
+    const done = new Set();
+    // Completed or left-out items; later events for them are ignored.
+    const closed = new Set();
+    const texts = new Map();
+    const numbers = { message: 0, reasoning: 0 };
+    let left = 0;
+    let result;
+    const take = (lines) => {
+        for (const { event, id, item } of codexStreamItems(normalizeLocalActorTranscript(lines))) {
+            if (isParticipantItem(item))
+                participantIds.add(id);
+            const kind = item.type === "agent_message" ? "message" : item.type === "reasoning" ? "reasoning" : null;
+            if (kind === null || !nonempty(item.text) || closed.has(id))
+                continue;
+            if (kind === "message")
+                messageIds.add(id);
+            if (event === "item.completed") {
+                done.add(id);
+                closed.add(id);
+            }
+            // Redact the decoded text before cutting it, so a cut cannot split a value past the patterns.
+            const clean = [...sanitize(withoutMarkerLines(item.text))];
+            const text = (clean.length > MESSAGE_CHARS ? clean.slice(0, MESSAGE_CHARS) : clean).join("");
+            const previous = texts.get(id);
+            if (!text.trim()) {
+                texts.delete(id);
+                continue;
+            }
+            texts.set(id, { kind, number: previous?.number ?? ++numbers[kind], text });
+            // The oldest item beyond the count limit is left out as the stream arrives, finished or not,
+            // so a long stream cannot hold every message in memory.
+            if (texts.size > TEXT_ITEMS_MAX) {
+                const oldest = texts.keys().next().value;
+                texts.delete(oldest);
+                closed.add(oldest);
+                left += 1;
+            }
+        }
+    };
+    return {
+        append(raw) {
+            if (result)
+                return;
+            if (skipping) {
+                const end = raw.indexOf("\n");
+                if (end < 0)
+                    return;
+                skipping = false;
+                raw = raw.slice(end + 1);
+            }
+            pending += raw;
+            const end = pending.lastIndexOf("\n");
+            if (end >= 0) {
+                take(pending.slice(0, end));
+                pending = pending.slice(end + 1);
+            }
+            // A line with no newline in sight is dropped, so one runaway line cannot grow without bound.
+            if (pending.length > PENDING_LINE_CHARS) {
+                pending = "";
+                skipping = true;
+                droppedLines += 1;
+            }
+        },
+        finish() {
+            if (result)
+                return result;
+            if (!skipping)
+                take(pending);
+            pending = "";
+            const entries = [...texts.entries()];
+            let start = entries.length;
+            let bytes = 0;
+            while (start > 0 && entries.length - start < TEXT_ITEMS_MAX) {
+                const size = Buffer.byteLength(entries[start - 1][1].text);
+                if (bytes + size > TEXT_ITEMS_BYTES)
+                    break;
+                bytes += size;
+                start -= 1;
+            }
+            left += start;
+            const kept = entries.slice(start);
+            const items = kept.map(([source, { kind, number, text }]) => ({
+                id: `${kind}-${String(number).padStart(3, "0")}`,
+                kind,
+                lifecycle: done.has(source) ? "completed" : "started",
+                title: kind === "message" ? "agent message" : "agent reasoning",
+                text,
+            }));
+            const notices = [];
+            if (left > 0)
+                notices.push([
+                    "agent text truncated",
+                    `Kept the last ${kept.length} of ${kept.length + left} agent message and reasoning items, within ${TEXT_ITEMS_MAX} items and ${TEXT_ITEMS_BYTES / 1024} KiB. The terminal transcript keeps the captured stream.`,
+                ]);
+            if (droppedLines > 0)
+                notices.push([
+                    "agent output lines skipped",
+                    `Skipped ${droppedLines} stdout line(s) that ran past ${PENDING_LINE_CHARS} characters without a newline. Items on those lines are not in this trace or its counts.`,
+                ]);
+            notices.forEach(([title, text], index) => items.push({
+                id: `notice-${String(index + 1).padStart(3, "0")}`,
+                kind: "notice",
+                lifecycle: "completed",
+                status: "truncated",
+                title,
+                text,
+            }));
+            result = { items, messages: messageIds.size, participantItems: participantIds.size };
+            return result;
+        },
+    };
+}

package/dist/routes/terminal/plan.d.ts

@@ -1,6 +1,5 @@
 import type { RoutePlanResult, RouteRefusal, TerminalPlan } from "../../lab/plan-types.js";
 import type { LabConfig } from "../../lab/types.js";
-import type { RunLabProvenance } from "../../run/status.js";
 import { type TerminalProductLabResult } from "./types.js";
 /** The error a terminal lab returns before a run starts. `actor` names the registered actor. */
 export interface TerminalRefusal extends RouteRefusal<"terminal", NonNullable<TerminalProductLabResult["error"]>["code"]> {
@@ -13,9 +12,6 @@ export type TerminalPlanResult = RoutePlanResult<TerminalPlan, TerminalRefusal>;
  */
 export declare function planTerminalLab(config: LabConfig, input: {
     readonly dryRun: boolean;
-    readonly lab?: RunLabProvenance;
-    /** A caller's costProbe can measure spend lines, so a positive maxUsd can trip. */
-    readonly hooks?: {
-        readonly costProbe?: unknown;
-    };
+    /** A test's costProbe can measure spend lines, so a positive maxUsd can trip. */
+    readonly hasCostProbe?: boolean;
 }): TerminalPlanResult;

package/dist/routes/terminal/plan.js

@@ -1,6 +1,7 @@
 // The terminal route's plan: every configuration refusal the route makes before a run starts, in
 // its order and with its codes, then the plan the run uses. The route checks nothing here again;
 // what stays in the route reads external state (keys, the runtime env, the sandbox).
+import { DEFAULT_OPENAI_CU_MODEL } from "../../actors/computer-use/openai-provider.js";
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { isReasoningEffort } from "../../actors/reasoning-effort.js";
 import { actorRegistry, isTerminalActorDescriptor } from "../../actors/registry.js";
@@ -48,7 +49,6 @@ export function planTerminalLab(config, input) {
         return refuse("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", "terminal-product subjects require `subject.product` with a name and at least one public surface URL.", descriptor.id);
     const base = planBase(config, {
         dryRun: input.dryRun,
-        ...(input.lab === undefined ? {} : { lab: input.lab }),
         analysis,
     });
     const egressAllow = config.execution?.egressAllow;
@@ -62,7 +62,11 @@ export function planTerminalLab(config, input) {
         ...(actor?.mission === undefined ? {} : { mission: actor.mission }),
         runtime: {
             ...(runtimeVersion === undefined ? {} : { version: runtimeVersion }),
-            ...(actor?.model === undefined ? {} : { model: actor.model }),
+            // Codex's own default can change with any release and its JSON stream does not name it, so
+            // the route always passes a model: the declared one, else humanish's participant default.
+            ...(actor?.model === undefined
+                ? { model: DEFAULT_OPENAI_CU_MODEL, modelSource: "humanish_default" }
+                : { model: actor.model, modelSource: "declared" }),
             ...(actor?.reasoningEffort === undefined ? {} : { reasoningEffort: actor.reasoningEffort }),
             ...(config.execution?.runtimeAuth === undefined
                 ? {}
@@ -74,7 +78,7 @@ export function planTerminalLab(config, input) {
     const caps = config.scenario?.caps;
     if (input.dryRun)
         return { ok: true, plan: { ...shared, dryRun: true, ...(caps ? { caps } : {}) } };
-    // The live lane injects the runtime key into one command only, and only a registered actor
+    // The live route injects the runtime key into one command only, and only a registered actor
     // that declares that placement may run live.
     const keyPlacement = descriptor.capabilities.keyPlacement;
     if (keyPlacement !== "in-sandbox-command-scoped")
@@ -85,12 +89,12 @@ export function planTerminalLab(config, input) {
     if (caps === undefined || maxUsd === undefined || maxMinutes === undefined || maxMinutes <= 0)
         return refuse("HUMANISH_TERMINAL_LAB_CAPS_MISSING", "A live terminal-product run grants provider access to the in-sandbox agent and so REQUIRES a fail-closed cap: scenario.caps with maxUsd (0 = no-spend) and a positive maxMinutes (the codex command's wall-clock kill). The live key is never exercised without a cap in force.", descriptor.id);
     // maxUsd is checked against the cost ledger after the session, and only known lines can trip it.
-    // Core records the Codex provider line as unpriced tokens (no rate for model `codex`) and has no
-    // product, media or payment signal, so without a costProbe every line is null and a positive
-    // maxUsd could never trip. That cap would promise a bound nothing enforces, so it is refused;
-    // maxMinutes is what bounds a live run.
-    if (maxUsd > 0 && input.hooks?.costProbe === undefined)
-        return refuse("HUMANISH_TERMINAL_LAB_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: the Codex participant's provider spend is recorded as unpriced tokens and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
+    // The ledger's provider line takes only provider-reported cost, which Codex does not report (the
+    // token estimate in run.json is not a measurement), and core has no product, media or payment
+    // signal, so without a costProbe every line is null and a positive maxUsd could never trip. That
+    // cap would promise a bound nothing enforces, so it is refused; maxMinutes bounds a live run.
+    if (maxUsd > 0 && input.hasCostProbe !== true)
+        return refuse("HUMANISH_TERMINAL_LAB_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: Codex reports no provider cost for the participant (its token cost is only estimated after the run) and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
     // The sandbox's timeout covers the steps before the codex command, maxMinutes and the teardown
     // buffer, and E2B refuses a sandbox over an hour. Refuse here, with the arithmetic, rather than
     // after the plan prints, from a provider 400 that names neither knob.

package/dist/routes/terminal/recorder.d.ts

@@ -1,7 +1,8 @@
 import { type CommandLogRecord, type InterventionRecord, type LifecycleRecord, type TerminalEventRecord } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export declare function createTerminalRecorder(args: {
     nowIso: () => string;
@@ -17,6 +18,10 @@ export declare function createTerminalRecorder(args: {
         stderr: string;
         combined: string;
     };
+    participantText: {
+        append(raw: string): void;
+        finish(): import("./participant-text.js").TerminalParticipantText;
+    };
     recordLifecycle: (event: string, message: string) => void;
     recordStreamedTerminalChunk: (stream: "stdout" | "stderr", raw: string) => void;
     appendReturnedTerminalOutput: (stream: "stdout" | "stderr", raw: string) => void;

package/dist/routes/terminal/recorder.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import { createTerminalParticipantReader } from "./participant-text.js";
 import { MAX_TRANSCRIPT_BYTES, } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export function createTerminalRecorder(args) {
     const { nowIso, sanitize, knownSecretValues } = args;
@@ -13,7 +15,9 @@ export function createTerminalRecorder(args) {
     // cross-chunk redaction below; this overlap is never added to terminal events/artifacts.
     const discardedPrefixes = { stdout: "", stderr: "", combined: "" };
     const maxDiscardedPrefixChars = Math.max(0, ...knownSecretValues.map((value) => value.length - 1));
-    const interventions = []; // ALWAYS empty while no assisted-input path ships.
+    const interventions = []; // Always empty while no assisted-input path ships.
+    // Reads the agent's text from the raw stdout in memory; it keeps only sanitized decoded text.
+    const participantText = createTerminalParticipantReader(sanitize);
     let transcriptBytes = 0;
     const recordLifecycle = (event, message) => {
         lifecycle.push({ at: nowIso(), event, message: sanitize(message) });
@@ -28,10 +32,13 @@ export function createTerminalRecorder(args) {
             return;
         }
         transcriptBytes += Buffer.byteLength(raw, "utf8");
-        // Scrub THEN redact at the SOURCE — raw bytes never leave this function (safety contract item 5).
+        // Scrub, then redact, at the source (safety contract item 5). Only the participant reader below
+        // sees the raw bytes, and it stores none of them.
         terminalEvents.push({ at: nowIso(), stream, chunk: sanitize(raw) });
+        if (stream === "stdout")
+            participantText.append(raw);
     };
-    // E2B can stream every byte through callbacks AND return the same complete output (#667).
+    // E2B can stream every byte through callbacks and return the same complete output (#667).
     // Track transport delivery, independently per stream, rather than deduplicating participant
     // lines or equal usage records. Hash raw callback bytes before redaction/truncation so the
     // comparison cannot confuse two values that redact identically or lose capped-away delivery.
@@ -70,6 +77,7 @@ export function createTerminalRecorder(args) {
         terminalEvents,
         interventions,
         discardedPrefixes,
+        participantText,
         recordLifecycle,
         recordStreamedTerminalChunk,
         appendReturnedTerminalOutput,

package/dist/routes/terminal/result.js

@@ -46,14 +46,14 @@ export function terminalExecutionFailures(args) {
 /** The terminal-product lab result for a live run, from its session, cleanup and cost ledger. */
 export function terminalLabResult(args) {
     const { cwd, labId, actorId, productName, runId, sessionStatus, completionReason, sessionReason, sessionError, sandboxId, cleanup, cost, noSpendProof, capFailure, declaredScorerFailure, judgment, execution, observer, warnings, } = args;
-    // The lab's exit code: verified evidence AND no harness error AND proven cleanup. A blocked/
-    // timed-out agent run is STILL ok-as-evidence at the bundle level (the failure is the evidence),
-    // but the LAB result surfaces ok:false on a harness error or unproven teardown (fail-closed).
+    // The lab's exit code: verified evidence, no harness error and proven cleanup. A blocked/
+    // timed-out agent run is still ok-as-evidence at the bundle level (the failure is the evidence),
+    // but the lab result surfaces ok:false on a harness error or unproven teardown (fail-closed).
     // remaining===0 is the by-id-confirmed-reclaimed state; remaining===1 (still present) and
     // remaining===-1 (kill(id) itself failed) are both unproven by design.
     const cleanupProven = cleanup.killed && cleanup.remaining === 0;
     // A CONFIG-DECLARED scorer that failed to render a pass (status:"fail" / malformed / throw) fails the
-    // run RESULT too, not just the persisted verdict — the keystone lane's declared rubric is a gate, so
+    // run result as well as the persisted verdict: the keystone route's declared rubric is a gate, so
     // its fail must drive exit code. Library callers never set this (additive, back-compat).
     const ok = resultOk({
         judgment,

package/dist/routes/terminal/route.js

@@ -8,39 +8,39 @@
 //      live-sandbox.ts and live-finish.ts); a dry plan publishes its contract bundle (dry-run.ts);
 //   4. automatic analysis of a run that published its final bundle.
 //
-// THE SAFETY CONTRACT (docs/goals/terminal-product-lane/goal.md) is enforced BY CONSTRUCTION in
-// the files each item names, and CHECKED by the verifier (verify/actor.ts
+// The safety contract (`docs/goals/terminal-product-lane/goal.md`) is enforced by construction in
+// the files each item names, and checked by the verifier (verify/actor.ts
 // validateTerminalProductEvidence):
-//   1. EXPLICIT KEY PLACEMENT. openai-env (default) injects the raw runtime key command-scoped,
-//      NEVER Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
+//   1. Explicit key placement. openai-env (default) injects the raw runtime key command-scoped,
+//      never through Sandbox.create({envs}). Opt-in openai-egress sends it only in the host-side E2B
 //      header transform and passes an inert command placeholder. The proxy is spendable by every
 //      sandbox process from creation; this protects the raw key, not provider spending.
 //      Enforced in credentials.ts and runtime-auth.ts.
-//   2. FAIL-CLOSED CAP. The live key is never exercised without scenario.caps in force: maxUsd
+//   2. Fail-closed cap. The live key is never exercised without scenario.caps in force: maxUsd
 //      (default/require 0 = no-spend) + maxMinutes (wall-clock kill of the codex command).
 //      Enforced in plan.ts (caps required), live-sandbox.ts and lifetime.ts (the wall clock).
-//   3. PUBLIC SURFACES ONLY. The mission references only subject.product.publicSurfaces + the
-//      author mission. No clone, no private-source access — nothing is git-cloned in this lane.
+//   3. Public surfaces only. The mission references only subject.product.publicSurfaces + the
+//      author mission. No clone, no private-source access — nothing is git-cloned on this route.
 //      Enforced in session.ts, which composes the prompt.
-//   4. DENY-BY-DEFAULT CREDENTIALS. The command envs are built from an ALLOWLIST of ONLY the
+//   4. Deny-by-default credentials. The command envs are built from an allowlist holding only the
 //      declared runtime key; GITHUB_TOKEN/GH_TOKEN/payment/deploy/db/media keys are excluded by
 //      construction (a banned-name guard also fails closed if one is ever requested).
 //      Enforced in credentials.ts.
-//   5. NO SECRET VALUES IN EVIDENCE. Every captured byte (event stream, transcript, command logs,
+//   5. No secret values in evidence. Every captured byte (event stream, transcript, command logs,
 //      agent report, metadata) passes scrubKnownValues (literal scrub of the runtime key + any
-//      provisioned values, >=4 chars, PRE-truncation) THEN redactText (shape patterns) BEFORE
-//      persisting. The transport is labeled HONESTLY (exec-stream/snapshot, NOT an interactive pty).
+//      provisioned values, >=4 chars, before truncation), then redactText (shape patterns), before
+//      persisting. The transport is labeled exec-stream/snapshot; there is no interactive pty.
 //      Enforced in recorder.ts, with the scrubber session.ts builds.
-//   6. METADATA POSITIVE ALLOWLIST. buildSandboxMetadata(allowlist) is the ONLY way metadata is
+//   6. Metadata positive allowlist. buildSandboxMetadata(allowlist) is the only way metadata is
 //      set; it carries solely non-secret labels (mode/tool/labId/simId/provider/runId).
 //      Enforced in credentials.ts.
-//   7. STDIN DISABLED + INTERVENTIONS LEDGER. stdin is never wired to the codex command; the
-//      bundle ALWAYS carries an interventions ledger (empty array is valid + required-present).
+//   7. Stdin disabled + interventions ledger. stdin is never wired to the codex command; the
+//      bundle always carries an interventions ledger (empty array is valid + required-present).
 //      Enforced in live-sandbox.ts (stdin) and recorder.ts (the ledger).
-//   8. PROVEN CLEANUP, BY ID, NEVER ACCOUNT-WIDE. Sandbox.kill(id) in a finally; the cleanup
-//      proof is BY EXACT ID: kill(id)'s own found-and-killed boolean, confirmed further by
+//   8. Proven cleanup, by id, never account-wide. Sandbox.kill(id) in a finally; the cleanup
+//      proof is by exact id: kill(id)'s own found-and-killed boolean, confirmed further by
 //      Sandbox.getInfo(id) when the SDK exposes it (a thrown SandboxNotFoundError means gone).
-//      humanish NEVER calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
+//      humanish never calls Sandbox.list to prove cleanup, so a shared operator key never reaches a
 //      sandbox it did not create. A live run that cannot prove teardown fails closed.
 //      Enforced in sandbox.ts.
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
@@ -50,18 +50,18 @@ import { runScope } from "../../run/run.js";
 import { planTerminalLab } from "./plan.js";
 import { runDryTerminalLab } from "./dry-run.js";
 import { checkLiveTerminalMachine, runLiveTerminalSession } from "./session.js";
-import { terminalInputWithScorer } from "../../lab/route-inputs.js";
+import { terminalRouteScorer } from "../../lab/adapter-scorer-loader.js";
+import { withLateScorer } from "../../lab/route-inputs.js";
 import { TERMINAL_PRODUCT_LAB_SCHEMA, } from "./types.js";
 /**
  * The config-taking entry point. It plans, returns a refusal with the same envelope and analysis
  * record the route has always returned, and otherwise runs the plan.
  */
 export async function runTerminalProductLab(options) {
-    const { config, dryRun, lab, ...input } = options;
+    const { config, dryRun, ...input } = options;
     const planned = planTerminalLab(config, {
         dryRun,
-        ...(lab === undefined ? {} : { lab }),
-        ...(input.hooks === undefined ? {} : { hooks: input.hooks }),
+        hasCostProbe: input.deps?.costProbe !== undefined,
     });
     if (planned.ok)
         return runTerminalPlan(planned.plan, input);
@@ -84,7 +84,7 @@ export function terminalLabRefusal(options, refusal) {
     };
     // A refusal starts no run, so a declared or default analysis is recorded as skipped.
     const analysis = resolveAutomaticAnalysis(config.review?.analysis);
-    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options.automaticAnalysis, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
+    return completeAutomaticAnalysis(refused, undefined, analysis.ok ? analysis.config : undefined, options, { trigger: config.review?.analysis === undefined ? "default" : "explicit" });
 }
 /**
  * Run a terminal plan. The run scope gives a direct library caller the same run lifetime the CLI
@@ -106,11 +106,11 @@ export async function admitTerminalPlan(plan, input) {
         return { ok: false, outcome: terminalOutcome(admission.result) };
     return {
         ok: true,
-        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, terminalInputWithScorer(input, scorer))),
+        run: async (scorer) => terminalOutcome(await runAdmittedTerminalRun(admission.admitted, withLateScorer(input, scorer, terminalRouteScorer))),
     };
 }
 function terminalOutcome(result) {
-    return { route: "terminal", backend: "terminal", result };
+    return { route: "terminal", result };
 }
 /**
  * A live plan's local checks, made outside any run scope. A refusal is the result runTerminalPlan
@@ -132,7 +132,7 @@ async function runAdmittedTerminalRun(admitted, input) {
     return completeTerminalAnalysis(admitted.plan, input, result, finished);
 }
 function completeTerminalAnalysis(plan, input, result, finished) {
-    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input.automaticAnalysis, {
+    return completeAutomaticAnalysis(result, finished, plan.analysis?.config, input, {
         ...(plan.analysis === undefined ? {} : { trigger: plan.analysis.trigger }),
         preferLargerOutput: plan.analysis?.preferLargerOutput === true,
     });
@@ -157,7 +157,7 @@ async function runTerminalPlanInScope(admitted, input, scope) {
     const cwd = path.resolve(input.cwd);
     const { warnings } = admitted;
     const failed = terminalFailure(admitted.plan, input, warnings);
-    // LIVE path: the real in-sandbox agent session. A separate orchestrator owns the
+    // Live path: the real in-sandbox agent session. A separate orchestrator owns the
     // create -> inject (command-scoped) -> run -> capture -> teardown lifecycle so the dry-run path
     // below stays a pure contract builder. It enforces the safety contract by construction (the
     // keyPlacement-routed command-scoped key, the deny-by-default allowlist, the fail-closed cap,

package/dist/routes/terminal/runtime.d.ts

@@ -6,9 +6,10 @@ export declare function isExactRuntimeVersion(value: unknown): value is string;
 /** Captured Codex CLI output: `codex-cli 0.153.3\n`. Other shapes fail closed. */
 export declare function parseTerminalRuntimeVersion(stdout: string): string | undefined;
 export declare function buildRuntimeVersionCommand(requestedVersion?: string): string;
-export declare function buildRuntimeExecPrefix(version: string, model?: string, reasoningEffort?: ReasoningEffort): string;
+export declare function buildRuntimeExecPrefix(version: string, model: string, reasoningEffort?: ReasoningEffort): string;
 export declare function declaredRuntimeProvenance(args: {
     version?: string;
-    model?: string;
+    model: string;
+    modelSource: "declared" | "humanish_default";
     reasoningEffort?: ReasoningEffort;
 }): ActorRuntimeProvenance;

package/dist/routes/terminal/runtime.js

@@ -26,7 +26,7 @@ export function buildRuntimeExecPrefix(version, model, reasoningEffort) {
     if (!isExactRuntimeVersion(version))
         throw new Error("Codex execution requires a verified exact runtime version.");
     return (`npm_config_update_notifier=false npx -y ${TERMINAL_RUNTIME_PACKAGE}@${version} exec` +
-        (model === undefined ? "" : ` --model ${shellQuote(model)}`) +
+        ` --model ${shellQuote(model)}` +
         (reasoningEffort === undefined
             ? ""
             : ` -c ${shellQuote(`model_reasoning_effort=${JSON.stringify(reasoningEffort)}`)}`));
@@ -37,8 +37,8 @@ export function declaredRuntimeProvenance(args) {
         package: TERMINAL_RUNTIME_PACKAGE,
         requestedVersion: args.version ?? "latest",
         versionStatus: "unobserved",
-        ...(args.model === undefined ? {} : { requestedModel: args.model }),
-        modelStatus: args.model === undefined ? "runtime_default_unobserved" : "declared",
+        requestedModel: args.model,
+        modelStatus: args.modelSource,
         ...(args.reasoningEffort === undefined
             ? {}
             : { requestedReasoningEffort: args.reasoningEffort }),

package/dist/routes/terminal/sandbox.d.ts

@@ -2,13 +2,13 @@ import type { OwnedDesktopAllocation } from "../../substrates/desktop-session.js
 import { E2BDesktopStartupError, type E2BDesktopModule } from "../../substrates/e2b/sdk.js";
 import type { TerminalLedgers } from "./types.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export declare function teardownSandbox(args: {

package/dist/routes/terminal/sandbox.js

@@ -2,20 +2,20 @@ import { toErrorMessage } from "../../evidence/redaction.js";
 import { E2BDesktopStartupError, isSandboxNotFoundError, } from "../../substrates/e2b/sdk.js";
 import { releaseUnavailableDetail } from "../../substrates/e2b/sandbox.js";
 /**
- * Tear the sandbox down and PROVE it BY EXACT ID -- NEVER Sandbox.list (humanish must never
+ * Tear the sandbox down and prove it by exact id, never by Sandbox.list (humanish must never
  * enumerate the operator's E2B account; see docs/principles/invariants-and-defaults.md). The
  * allocation's release (src/substrates/e2b/sandbox.ts) kills the exact id and reads the answer the
  * same way every route does: true is terminated, false or a not-found error is already gone. That
- * is the PRIMARY proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
+ * is the primary proof. Where the SDK exposes Sandbox.getInfo(id), a thrown SandboxNotFoundError is
  * a second by-id confirmation that the exact sandbox is gone; a returned SandboxInfo with a live
- * state means teardown is NOT confirmed. Never throws -- teardown failure is recorded, the caller
+ * state means teardown is unconfirmed. Never throws: teardown failure is recorded, and the caller
  * fails closed on an unproven teardown.
  */
 export async function teardownSandbox(args) {
     const { allocation, sandboxModule, startupCleanup, startupCleanupDetail, requestTimeoutMs, sanitize, recordLifecycle, warnings, } = args;
     if (allocation === undefined || !sandboxModule) {
-        // create() can reject AFTER its constructor acquired a handle. The default loader retains
-        // that authority and reclaims it before rejecting; the lane itself never receives its ID.
+        // create() can reject after its constructor acquired a handle. The default loader retains
+        // that authority and reclaims it before rejecting; the route itself never receives its ID.
         if (startupCleanup === "killed" || startupCleanup === "already_gone") {
             const reason = `desktop startup guard confirmed its acquired sandbox ${startupCleanup === "killed" ? "was killed" : "was already gone"}`;
             recordLifecycle("terminal-lab.cleanup.killed", reason);
@@ -49,12 +49,12 @@ export async function teardownSandbox(args) {
         recordLifecycle("terminal-lab.cleanup.unconfirmed", `Sandbox ${sandboxId} ${reason}.`);
         return { killed: false, remaining: -1, reason };
     }
-    // BY-ID verification only, from here down: NEVER Sandbox.list. A released result is itself proof
+    // By-id verification only, from here down: never Sandbox.list. A released result is itself proof
     // the exact sandbox is gone: terminated when kill(id) found and killed it, already gone when
     // kill(id) answered false or threw not-found (a 404, e.g. the server-side kill-on-timeout raced
     // ahead). Both mean "this id is no longer running." Sandbox.getInfo(id), when the SDK exposes
     // it, adds a second by-id confirmation; the only thing that overturns the release proof is
-    // getInfo returning a LIVE sandbox for this exact id.
+    // getInfo returning a live sandbox for this exact id.
     const killNote = released.reason === "terminated"
         ? "kill(id) returned true (found and killed)"
         : "kill(id) found the exact sandbox already gone (404)";
@@ -85,8 +85,8 @@ export async function teardownSandbox(args) {
                 reason: `reclaimed by id; getInfo(id) confirms the exact sandbox no longer exists (SandboxNotFoundError)`,
             };
         }
-        // getInfo(id) failed for a reason OTHER than "not found" (e.g. a transient network error):
-        // no second by-id confirmation is available, so the RESOLVED kill(id) call stands as the proof
+        // getInfo(id) failed for a reason other than "not found" (e.g. a transient network error):
+        // no second by-id confirmation is available, so the resolved kill(id) call stands as the proof
         // of absence. Never fall back to Sandbox.list.
         const sanitizedError = sanitize(toErrorMessage(error));
         recordLifecycle("terminal-lab.cleanup.killed", `Sandbox ${sandboxId} reclaimed: ${killNote}; getInfo(id) re-verification errored (${sanitizedError}), so kill(id)'s resolved result is the proof.`);