humanish 0.106.1 → 0.107.0

package/dist/run/shared-world-shape.js

@@ -4,12 +4,12 @@ import { isNonNegativeSafeInteger, isRecord } from "./type-guards.js";
 // The promptDigest convention: sha256 hex, first 16 chars. A "seeded" record without a real
 // digest cannot pin "same recipe" across bundles, so verify treats it as a hollow claim.
 export const COMMAND_DIGEST_PATTERN = /^[0-9a-f]{16}$/;
-// Env var NAME shape (mirrors ENV_NAME_PATTERN in src/lab/parse/values.ts). externalEnvNames
-// must hold NAMES only — a value sneaking into the list trips this check (a free secret tripwire).
+// Env var name shape (mirrors ENV_NAME_PATTERN in src/lab/parse/values.ts). externalEnvNames
+// must hold names only: a value sneaking into the list trips this check (a free secret tripwire).
 export const SUBJECT_ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
-// SEQUENTIAL: the three disclosures a sequential shared-world bundle MUST pin (verify fails closed
+// Sequential: the three disclosures a sequential shared-world bundle must pin (verify fails closed
 // if any is absent — omission overclaims): sequential turns only, no concurrency/races handled, and
-// a checkpoint delta is attributed to the TURN it followed, not a specific action (correlation).
+// a checkpoint delta is attributed to the turn it followed, never a specific action (correlation).
 export const MANDATORY_ATTRIBUTION_LIMITS = [
     "sequential-only",
     "no-concurrent-races",
@@ -17,11 +17,11 @@ export const MANDATORY_ATTRIBUTION_LIMITS = [
 ];
 // A shared-world checkpoint record persists DIGEST-ONLY: exactly these keys, nothing value-shaped.
 export const SHARED_WORLD_CHECKPOINT_KEYS = new Set(["kind", "name", "digest", "deltaFromPrev"]);
-// CONCURRENT stateSeries record is DIGEST-ONLY too (FIX-7): permit ONLY a numeric timestamp + the
+// A concurrent stateSeries record is digest-only too: it permits a numeric timestamp + the
 // sha256-16 digest; any other key is a value-shaped leak / a smuggled per-delta→actor field.
 export const SHARED_WORLD_STATESERIES_KEYS = new Set(["timestamp", "digest"]);
 /**
- * Single-plane provenance: every item shares ONE (commit, seedDigest), and that pair matches
+ * Single-plane provenance: every item shares one (commit, seedDigest), and that pair matches
  * sharedWorld.plane. Only the first item that diverges from the plane is reported. The shape guard
  * has already typed both fields as strings (commit may be absent).
  */
@@ -62,7 +62,7 @@ export function sharedWorldCommonFindings(bundle, sw) {
     if (isRecord(plane) && Array.isArray(plane.envNames)) {
         for (const name of plane.envNames) {
             if (typeof name !== "string" || !SUBJECT_ENV_NAME_PATTERN.test(name)) {
-                // Does NOT echo the entry: a malformed entry may BE a value.
+                // Never echoes the entry: a malformed entry may be a value.
                 findings.push("sharedWorld.plane.envNames carries an entry that is not an env var NAME shape (values must never appear in evidence)");
             }
         }
@@ -70,8 +70,8 @@ export function sharedWorldCommonFindings(bundle, sw) {
     return findings;
 }
 /**
- * Tolerant SHAPE guard for the shared-world evidence block (#164). Validates required fields +
- * types but TOLERATES extra keys (additive): the strict value-shape/timeline checks are
+ * Tolerant shape guard for the shared-world evidence block (#164). Validates required fields +
+ * types and tolerates extra keys (additive): the strict value-shape/timeline checks are
  * sharedWorldEvidenceFindings' job (an injected value-shaped checkpoint field must pass the shape
  * guard so verify can catch it fail-closed, not silently bounce off isRunBundle).
  */
@@ -109,7 +109,7 @@ export function isSharedWorldEvidence(value) {
     if (!(Array.isArray(value.attributionLimits) &&
         value.attributionLimits.every((limit) => typeof limit === "string")))
         return false;
-    // Tolerant: validate the TYPE of each present field only (the coherence + topologyMode dispatch
+    // Tolerant: validate the type of each present field only (the coherence + topologyMode dispatch
     // are the job of sharedWorldEvidenceFindings — an injected value-shaped field must pass this
     // guard so verify catches it fail-closed). A bundle must carry at least one of the two shapes.
     if (value.sequence !== undefined &&
@@ -148,7 +148,7 @@ function isSharedWorldTimelineEntry(value) {
     }
     return false;
 }
-// Tolerant shape guards for the CONCURRENT series (extra keys tolerated — the digest-only /
+// Tolerant shape guards for the concurrent series (extra keys tolerated; the digest-only /
 // allowed-keys tripwires are the strict job of sharedWorldEvidenceFindings).
 function isSharedWorldLaneWindow(value) {
     return (isRecord(value) &&

package/dist/run/stats.d.ts

@@ -1,4 +1,4 @@
-import { type StudyCosts, type StudyCostRow } from "./costs.js";
+import { type CostTotals, type CostRow } from "./costs.js";
 declare const STATS_SCHEMA = "humanish.stats.v1";
 interface StatsParticipants {
     total: number;
@@ -24,7 +24,7 @@ interface StatsLabRow {
     /** Runs with no estimate: a subscription brain, an interrupted run, an old bundle. Never zero. */
     unpricedRuns: number;
     participants: StatsParticipants;
-    costs: StudyCosts;
+    costs: CostTotals;
 }
 interface StatsDayRow {
     day: string;
@@ -33,7 +33,7 @@ interface StatsDayRow {
     /** Participant and desktop subtotal; `costs` also includes retained analysis. */
     estimatedSpendUsd: number;
     unpricedRuns: number;
-    costs: StudyCosts;
+    costs: CostTotals;
 }
 export interface StatsResult {
     schema: typeof STATS_SCHEMA;
@@ -51,12 +51,12 @@ export interface StatsResult {
         unpricedRuns: number;
         participants: StatsParticipants;
         verdicts: Record<string, number>;
-        costs: StudyCosts;
+        costs: CostTotals;
     };
     labs: StatsLabRow[];
     days: StatsDayRow[];
     /** Same selected runs; individual accounting gaps are inspectable without reading private evidence. */
-    costsByRun: StudyCostRow[];
+    costsByRun: CostRow[];
     /** Directories that could not be read, by name — surfaced, never silently dropped. */
     unreadable: string[];
     note: string;

package/dist/run/stats.js

@@ -3,7 +3,7 @@
 // counts as unknown and never as zero, and every rate has a denominator next to it.
 import path from "node:path";
 import { readRunIndex } from "./run-index.js";
-import { addStudyCosts, emptyStudyCosts, readStudyCosts, } from "./costs.js";
+import { addCostTotals, emptyCostTotals, readCostTotals, } from "./costs.js";
 import { round6 } from "./pricing.js";
 const STATS_SCHEMA = "humanish.stats.v1";
 const STATS_NOTE = "Every dollar figure is a retained rate-table estimate, never a provider charge. " +
@@ -47,7 +47,7 @@ function addToLabRow(labs, entry, priced, costs) {
             unpricedRuns: 0,
             participants: emptyParticipants(),
             durations: [],
-            costs: emptyStudyCosts(),
+            costs: emptyCostTotals(),
             runCosts: [],
         };
         labs.set(labId, row);
@@ -69,7 +69,7 @@ function addToLabRow(labs, entry, priced, costs) {
     else
         row.unpricedRuns += 1;
     addParticipants(row.participants, entry);
-    addStudyCosts(row.costs, costs);
+    addCostTotals(row.costs, costs);
 }
 function addToDayRow(days, entry, priced, costs) {
     const at = entryTime(entry);
@@ -82,7 +82,7 @@ function addToDayRow(days, entry, priced, costs) {
             live: 0,
             estimatedSpendUsd: 0,
             unpricedRuns: 0,
-            costs: emptyStudyCosts(),
+            costs: emptyCostTotals(),
         };
         days.set(day, dayRow);
     }
@@ -93,7 +93,7 @@ function addToDayRow(days, entry, priced, costs) {
         dayRow.estimatedSpendUsd += entry.estimatedCostUsd;
     else
         dayRow.unpricedRuns += 1;
-    addStudyCosts(dayRow.costs, costs);
+    addCostTotals(dayRow.costs, costs);
 }
 export async function computeStats(cwdInput, options = {}) {
     const cwd = path.resolve(cwdInput);
@@ -148,15 +148,15 @@ export async function computeStats(cwdInput, options = {}) {
         unpricedRuns: 0,
         participants: emptyParticipants(),
         verdicts: {},
-        costs: emptyStudyCosts(),
+        costs: emptyCostTotals(),
     };
     const labs = new Map();
     const days = new Map();
     const costsByRun = [];
     for (const entry of selected) {
-        const accounting = await readStudyCosts(cwd, entry);
+        const accounting = await readCostTotals(cwd, entry);
         costsByRun.push(accounting);
-        addStudyCosts(totals.costs, accounting.costs);
+        addCostTotals(totals.costs, accounting.costs);
         totals.runs += 1;
         if (entry.mode === "live")
             totals.live += 1;

package/dist/run/status.d.ts

@@ -7,7 +7,7 @@ export declare const RUN_STATUS_FILE = "status.json";
 /** How often a live run touches `updatedAt`. */
 export declare const RUN_STATUS_TOUCH_MS = 5000;
 /**
- * A `running` record whose `updatedAt` is older than this is INTERRUPTED, not alive: the process
+ * A `running` record whose `updatedAt` is older than this is interrupted, not alive: the process
  * died without finalizing (a dropped SSH, a killed terminal, a crash). Three touch intervals of
  * slack so an ordinary scheduling hiccup or a slow disk never mislabels a healthy run.
  */
@@ -21,7 +21,9 @@ export interface RunLabProvenance {
     /** `committed` = humanish/labs, `ignored` = a local overlay, `explicit` = a path the operator passed. */
     origin?: "committed" | "ignored" | "explicit";
 }
-type RunStatusState = "running" | "finished";
+type RunStatusState = "running" | "finished" | "interrupted";
+/** The signals the CLI's run handler records when it stops a run. */
+export type RunInterruptSignal = "SIGINT" | "SIGTERM" | "SIGHUP";
 /** The outcome summary a finalized record carries. Derived from the bundle; never authoritative. */
 interface RunStatusOutcome {
     /** `review.verdict` verbatim. */
@@ -55,6 +57,8 @@ export interface RunStatusRecord {
     /** Refreshed on a fixed cadence while the run is alive; the staleness signal. */
     updatedAt: string;
     completedAt?: string;
+    /** The signal that stopped the run, on an `interrupted` record. */
+    signal?: RunInterruptSignal;
     outcome?: RunStatusOutcome;
 }
 export interface RunStatusHandle {
@@ -72,11 +76,16 @@ export interface RunStatusHandle {
         ok: boolean;
         execution: ExecutionOutcome;
     }): Promise<void>;
+    /** The process is being stopped by `signal`: state `interrupted`, `completedAt` and the signal.
+     *  It stops the cadence and makes a later finish or settle a no-op, so the route cannot write
+     *  `running` or `finished` over it. When the run had finished it writes nothing, waits for the
+     *  writes already queued and resolves false. */
+    interrupt(signal: RunInterruptSignal): Promise<boolean>;
 }
 export interface BeginRunStatusOptions {
     runId: string;
     mode: "dry-run" | "live";
-    lab?: RunLabProvenance;
+    lab?: RunLabProvenance | undefined;
 }
 /**
  * Start a run's status record and keep it fresh. Fire-and-forget by design: a status write that
@@ -84,7 +93,8 @@ export interface BeginRunStatusOptions {
  * `unref`'d — this file can never be the reason a process stays alive.
  */
 export declare function beginRunStatus(runPaths: PreparedOutputRoot, options: BeginRunStatusOptions): RunStatusHandle;
-/** The three ways a run reads from disk. `interrupted` is a `running` record gone stale. */
+/** The three ways a run reads from disk. `interrupted` is a record its stopped process wrote, or a
+ *  `running` record gone stale. */
 export type RunLiveness = "running" | "interrupted" | "finished";
 /**
  * Classify a status record. Pure, so the TUI, the CLI and tests share one definition of "alive".
@@ -94,11 +104,11 @@ export declare function classifyRunStatus(record: Pick<RunStatusRecord, "state"
 /** Shape guard for a record read off disk. Unknown extra fields are tolerated (additive contract). */
 export declare function isRunStatusRecord(value: unknown): value is RunStatusRecord;
 /**
- * The legacy bridge: infer a lab id for a bundle written BEFORE this contract, where the only
+ * The legacy bridge: infer a lab id for a bundle written before this contract, where the only
  * attribution was the `lab:<id>` convention on persona/scenario source strings. Deliberately
  * conservative — it reads the convention and nothing else, and a `lab:` prefix with an empty
  * remainder is not an id. Ids may contain colons (the removed meta-lab wrote `oss:meta`), so
- * only the FIRST segment is stripped. Returns undefined when the bundle carries no such marker.
+ * only the first segment is stripped. Returns undefined when the bundle carries no such marker.
  */
 export declare function inferLegacyLabId(bundle: {
     persona?: {

package/dist/run/status.js

@@ -17,11 +17,12 @@ export const RUN_STATUS_FILE = "status.json";
 /** How often a live run touches `updatedAt`. */
 export const RUN_STATUS_TOUCH_MS = 5_000;
 /**
- * A `running` record whose `updatedAt` is older than this is INTERRUPTED, not alive: the process
+ * A `running` record whose `updatedAt` is older than this is interrupted, not alive: the process
  * died without finalizing (a dropped SSH, a killed terminal, a crash). Three touch intervals of
  * slack so an ordinary scheduling hiccup or a slow disk never mislabels a healthy run.
  */
 export const RUN_STATUS_STALE_MS = RUN_STATUS_TOUCH_MS * 3;
+const RUN_INTERRUPT_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 /** The outcome a finalized status record carries, read from the bundle that was just written. */
 export function runStatusOutcome(bundle) {
     return {
@@ -102,12 +103,16 @@ export function beginRunStatus(runPaths, options) {
                 return;
             // The record is public-safe by construction, so each message passes the shape redaction
             // again even though the routes scrubbed it.
+            const redacted = (failure) => ({
+                kind: failure.kind,
+                message: redactText(failure.message),
+            });
             const execution = {
                 succeeded: result.execution.succeeded,
-                failures: result.execution.failures.map((failure) => ({
-                    kind: failure.kind,
-                    message: redactText(failure.message),
-                })),
+                failures: result.execution.failures.map(redacted),
+                ...(result.execution.warnings === undefined
+                    ? {}
+                    : { warnings: result.execution.warnings.map(redacted) }),
             };
             finishedRecord = {
                 ...finishedRecord,
@@ -115,6 +120,19 @@ export function beginRunStatus(runPaths, options) {
             };
             await write(finishedRecord);
         },
+        async interrupt(signal) {
+            // A finish that has not landed yet is in the chain: wait for it so the process does not
+            // exit with `running` on disk.
+            if (finished) {
+                await writing;
+                return false;
+            }
+            finished = true;
+            clearInterval(timer);
+            const completedAt = iso();
+            await write({ ...base, state: "interrupted", updatedAt: completedAt, completedAt, signal });
+            return true;
+        },
     };
     return handle;
 }
@@ -125,6 +143,8 @@ export function beginRunStatus(runPaths, options) {
 export function classifyRunStatus(record, nowMs, staleMs = RUN_STATUS_STALE_MS) {
     if (record.state === "finished")
         return "finished";
+    if (record.state === "interrupted")
+        return "interrupted";
     const updated = Date.parse(record.updatedAt);
     if (!Number.isFinite(updated))
         return "interrupted";
@@ -139,7 +159,10 @@ export function isRunStatusRecord(value) {
         return false;
     if (typeof record.runId !== "string" || record.runId === "")
         return false;
-    if (record.state !== "running" && record.state !== "finished")
+    if (record.state !== "running" && record.state !== "finished" && record.state !== "interrupted")
+        return false;
+    if (record.signal !== undefined &&
+        (typeof record.signal !== "string" || !RUN_INTERRUPT_SIGNALS.includes(record.signal)))
         return false;
     if (record.mode !== "dry-run" && record.mode !== "live")
         return false;
@@ -156,11 +179,11 @@ export function isRunStatusRecord(value) {
     return true;
 }
 /**
- * The legacy bridge: infer a lab id for a bundle written BEFORE this contract, where the only
+ * The legacy bridge: infer a lab id for a bundle written before this contract, where the only
  * attribution was the `lab:<id>` convention on persona/scenario source strings. Deliberately
  * conservative — it reads the convention and nothing else, and a `lab:` prefix with an empty
  * remainder is not an id. Ids may contain colons (the removed meta-lab wrote `oss:meta`), so
- * only the FIRST segment is stripped. Returns undefined when the bundle carries no such marker.
+ * only the first segment is stripped. Returns undefined when the bundle carries no such marker.
  */
 export function inferLegacyLabId(bundle) {
     for (const source of [bundle.persona?.source, bundle.scenario?.source]) {

package/dist/run/streams.d.ts

@@ -1,5 +1,5 @@
 import type { CodexAppServerTrace } from "../actors/codex/app-server-trace.js";
-import type { ActorTrace, ActorTraceItem } from "../actors/contract.js";
+import type { ActorStatus, ActorTrace, ActorTraceItem } from "../actors/contract.js";
 import type { RunDesktopRecording } from "../evidence/desktop-recording-types.js";
 export type RunStreamKind = "ui" | "browser" | "terminal" | "tui" | "codex-ui" | "artifact" | "summary";
 export type RunSimulationStatus = "queued" | "preparing" | "running" | "passed" | "abandoned" | "incomplete" | "complete" | "blocked" | "timed_out" | "failed" | "contract_proof_only";
@@ -29,10 +29,10 @@ interface RunStreamCompletion {
     meaningfulUse?: RunMeaningfulUseScore;
 }
 /**
- * The CLOSED set of core meaningful-use scoring components. Closed by design: these are the generic
+ * The closed set of core meaningful-use scoring components. Closed by design: these are the generic
  * dimensions core itself meters (setup/filesystem/nested/actor/product/feedback). A
- * product-specific scorecard does NOT extend this enum, so adopters' nouns stay out of core. It
- * ships as a thin in-repo extension that emits a namespaced `RunAdapterScore` via the lane's
+ * product-specific scorecard does not extend this enum, so adopters' nouns stay out of core. It
+ * ships as a thin in-repo extension that emits a namespaced `RunAdapterScore` via the route's
  * `score` hook, leaving its own component breakdown in that score's `data`. Exported so a thin
  * adapter can type against core's score shape without forking.
  */
@@ -64,14 +64,14 @@ export interface RunDesktopGeometry {
             source: "xdpyinfo";
         };
         /**
-         * The device preset as DECLARED by the lab, present only when it differs from `requested`
+         * The device preset as declared by the lab, present only when it differs from `requested`
          * because the rendered width was floored to MIN_DESKTOP_RENDER_WIDTH.
          *
          * Without this, a floored run is indistinguishable from a faithful one: `verified` compares
          * the floored number with itself and reports a match, so a reader of the bundle sees
          * requested 500 / verified 500 and reasonably concludes a 500-wide preset was asked for. A
          * `mobile` (414) and a `small-mobile` (360) seat both render at 500 and look identical here.
-         * When this field is set, the preset width did NOT render; see #221.
+         * When this field is set, the preset width did not render; see #221.
          */
         declared?: {
             width: number;
@@ -121,10 +121,10 @@ export interface RunDesktopGeometry {
             source: "cdp";
         };
         /**
-         * Page targets the participant drove AFTER the launch page (a link that opened in a new tab)
+         * Page targets the participant drove after the launch page (a link that opened in a new tab)
          * whose own read-back reported the requested viewport width (#623). Absent when the
-         * participant never left the launch tab; a later tab that did NOT report the width is a lane
-         * warning instead.
+         * participant never left the launch tab; a later tab that did not report the width is a
+         * participant warning instead.
          */
         laterTargets?: {
             targetId: string;
@@ -154,20 +154,27 @@ export interface RunParticipantAssignment {
 export interface RunStream {
     id: string;
     simId: string;
-    /** Adapter-owned lane id for fan-out / target-swarm runs. Safe categorical metadata only. */
+    /** Adapter-owned participant id for fan-out / target-swarm runs. Safe categorical metadata only. */
     laneId?: string;
-    /** Adapter-owned actor class for grouping lanes, e.g. viewer/reviewer/admin. */
+    /** Adapter-owned actor class for grouping participants, e.g. viewer/reviewer/admin. */
     actorType?: string;
-    /** Adapter-owned product surface label for grouping lanes without parsing URLs. */
+    /** Adapter-owned product surface label for grouping participants without parsing URLs. */
     surface?: string;
     /** Adapter-owned scenario/case grouping label. */
     caseGroup?: string;
-    /** Authored/default mission and lane focus, redacted before persistence. Missing on older
+    /** Authored/default mission and participant focus, redacted before persistence. Missing on older
      * bundles and uninstrumented routes; never reconstructed from study context or narration. */
     assignment?: RunParticipantAssignment;
     kind: RunStreamKind;
     label: string;
     status: RunSimulationStatus;
+    /**
+     * The judge's status for this participant (`judgedStatus` in src/run/judge.ts). It differs from
+     * the trace status when a goal_satisfied session reported a blocker or never engaged. Computer-use
+     * fan-out writes it for a finished live participant; rerun selection reads it. Absent elsewhere,
+     * and in bundles written before it existed.
+     */
+    judgedStatus?: ActorStatus;
     transport: "snapshot" | "polling" | "sse" | "pty" | "app-server";
     updatedAt: string;
     url?: string;
@@ -176,7 +183,7 @@ export interface RunStream {
         url?: string;
         title?: string;
     };
-    /** Set by the attached watch server when the lane's sandbox is gone: the injected live URL
+    /** Set by the attached watch server when the participant's sandbox is gone: the injected live URL
      *  would render a provider error page, so viewers fall back to recorded evidence. Runtime-only
      *  and never persisted into bundles; declared here because the served observer-data carries it
      *  and the client is typed against this contract. */
@@ -192,7 +199,7 @@ export interface RunStream {
         deviceScaleFactor?: number;
         isMobile?: boolean;
     };
-    /** Truthful screen/window/viewport evidence for hosted desktop browser lanes. */
+    /** Truthful screen/window/viewport evidence for hosted desktop browser participants. */
     desktopGeometry?: RunDesktopGeometry;
     terminal?: {
         title: string;
@@ -227,10 +234,10 @@ export interface RunStream {
     };
     actor?: ActorTrace;
     /**
-     * Mid-run partial actor evidence (#441): the redacted trace items recorded SO FAR,
-     * flushed while a live lane is still running so the attached Observer's timeline can
-     * grow. Deliberately NOT an ActorTrace — a running lane has no honest status,
-     * completionReason, or completedAt, and this shape cannot claim them. Present ONLY on
+     * Mid-run partial actor evidence (#441): the redacted trace items recorded so far,
+     * flushed while a live participant is still running so the attached Observer's timeline can
+     * grow. It is deliberately not an ActorTrace: a running participant has no honest status,
+     * completionReason, or completedAt, and this shape cannot claim them. Present only on
      * `inProgress` bundles; the final write replaces it with the real `actor` and never
      * carries it.
      */

package/dist/run/terminal-contract.d.ts

@@ -1,15 +1,15 @@
 export declare const TERMINAL_EVENTS_ARTIFACT = "terminal-events.ndjson";
 export declare const TERMINAL_TRANSCRIPT_ARTIFACT = "terminal-transcript.txt";
 export declare const TERMINAL_LEDGERS_ARTIFACT = "terminal-ledgers.json";
-/** The cost categories the lane meters. product/media/payment are adapter signals; core can
+/** The cost categories the terminal route meters. product/media/payment are adapter signals; core can
  *  populate the provider line from the actor trace's tokenUsage.costUsd when present. */
 export type CostCategory = "product" | "media" | "payment" | "provider";
 /** The four cost categories, in a fixed order so the ledger shape is stable across runs. */
 export declare const COST_CATEGORIES: readonly CostCategory[];
 /**
  * Strip ANSI/control noise from a captured terminal transcript into stable, scannable text. Pure
- * (no IO). Exported so the terminal-product lane (src/routes/terminal/live-sandbox.ts) normalizes
- * its captured exec stream EXACTLY as the local-actor lanes do — the verdict-nonce scorer is only
+ * (no IO). Exported so the terminal-product route (src/routes/terminal/live-sandbox.ts) normalizes
+ * its captured exec stream exactly as the local-actor routes do: the verdict-nonce scorer is only
  * sound against the same normalization the marker is matched on, so the logic must not diverge.
  */
 export declare function normalizeLocalActorTranscript(transcript: string): string;
@@ -18,8 +18,8 @@ type ActorVerdict = "passed" | "blocked" | "failed";
  * Extract the per-run verdict from a normalized transcript: the agent must print exactly
  * `HUMANISH_ACTOR_VERDICT=<status> HUMANISH_ACTOR_NONCE=<nonce>`, and the nonce is mandatory so a
  * bare marker (echoed or replayed from untrusted text) can never forge a verdict. Pure (no IO).
- * Exported so the terminal-product lane scores its in-sandbox `codex exec` run by the same marker;
- * divergent verdict logic would let the two lanes disagree about what "passed" means.
+ * Exported so the terminal-product route scores its in-sandbox `codex exec` run by the same marker;
+ * divergent verdict logic would let the two routes disagree about what "passed" means.
  */
 export declare function extractLocalActorVerdict(transcript: string, verdictNonce: string): ActorVerdict | null;
 export {};

package/dist/run/terminal-contract.js

@@ -14,8 +14,8 @@ export const COST_CATEGORIES = [
 ];
 /**
  * Strip ANSI/control noise from a captured terminal transcript into stable, scannable text. Pure
- * (no IO). Exported so the terminal-product lane (src/routes/terminal/live-sandbox.ts) normalizes
- * its captured exec stream EXACTLY as the local-actor lanes do — the verdict-nonce scorer is only
+ * (no IO). Exported so the terminal-product route (src/routes/terminal/live-sandbox.ts) normalizes
+ * its captured exec stream exactly as the local-actor routes do: the verdict-nonce scorer is only
  * sound against the same normalization the marker is matched on, so the logic must not diverge.
  */
 export function normalizeLocalActorTranscript(transcript) {
@@ -31,8 +31,8 @@ export function normalizeLocalActorTranscript(transcript) {
  * Extract the per-run verdict from a normalized transcript: the agent must print exactly
  * `HUMANISH_ACTOR_VERDICT=<status> HUMANISH_ACTOR_NONCE=<nonce>`, and the nonce is mandatory so a
  * bare marker (echoed or replayed from untrusted text) can never forge a verdict. Pure (no IO).
- * Exported so the terminal-product lane scores its in-sandbox `codex exec` run by the same marker;
- * divergent verdict logic would let the two lanes disagree about what "passed" means.
+ * Exported so the terminal-product route scores its in-sandbox `codex exec` run by the same marker;
+ * divergent verdict logic would let the two routes disagree about what "passed" means.
  */
 export function extractLocalActorVerdict(transcript, verdictNonce) {
     const compactTranscript = transcript.replace(/\s+/g, "");

package/dist/run/transient-comms-secrets.d.ts

@@ -3,3 +3,8 @@ export declare function withTransientCommsSecrets<T>(work: () => Promise<T>): Pr
 export declare function registerTransientCommsSecrets(values: string[]): void;
 /** Literal, longest-first replacement in one pass; replacement text is never matched recursively. */
 export declare function scrubTransientCommsText(text: string): string;
+/**
+ * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
+ * base64-encoded and returns decoded text. Outside a scope it changes nothing.
+ */
+export declare function transientCommsEncodedScrub(): (text: string) => string;

package/dist/run/transient-comms-secrets.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { scrubSecretValues } from "../evidence/secret-scrub.js";
 import { escapeRegExp } from "./text.js";
 const scopes = new AsyncLocalStorage();
 const MAX_VALUES = 8192;
@@ -70,3 +71,14 @@ export function scrubTransientCommsText(text) {
         return fail(scope);
     }
 }
+/**
+ * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
+ * base64-encoded and returns decoded text. Outside a scope it changes nothing.
+ */
+export function transientCommsEncodedScrub() {
+    const scope = scopes.getStore();
+    if (!scope)
+        return (text) => text;
+    usable(scope);
+    return scrubSecretValues([...scope.values]);
+}