humanish 0.106.1 → 0.108.0

package/dist/routes/shared-world/handoff.js

@@ -1,39 +1,40 @@
-// The external-public plane's host-first handoff. The host seat opens a lobby; each follower waits
+// The external-public plane's host-first handoff. The host opens a lobby; each follower waits
 // for the host's lobby code, read from the host's URL, narration or screen, and then joins with it.
 // A follower fails closed without opening if the host never yields a code within the deadline.
 //
-// TEMPORARY SHIM (tracked by #296): this CDP URL-relay handoff — reading the host's /lobby/CODE off
-// its own browser and threading it into the follower missions — is a temporary coordination shim.
-// It is to be augmented/replaced by the actor message bus (fake SMS/email invite) in #297: the
-// human-realistic version is the HOST SENDING the invite link and followers RECEIVING and tapping
+// Temporary shim: this CDP URL-relay handoff reads the host's /lobby/CODE off its
+// own browser and threads it into the follower missions.
+// It is to be augmented/replaced by the actor message bus (fake SMS/email invite): the
+// human-realistic version is the host sending the invite link and followers receiving and tapping
 // it, rather than the orchestrator relaying the code out-of-band.
 import { commandDigestOf } from "../../subject/state.js";
 import { toErrorMessage } from "../../evidence/redaction.js";
 import { inboxRecipientFor, participantHasInboxRecipient, } from "../computer-use/participant-desktop.js";
 import { withInboxMission } from "../computer-use/participant-prompt.js";
-import { runCuaParticipant } from "../computer-use/lanes.js";
+import { runCuaParticipant } from "../computer-use/participant-execution.js";
 import { extractLobbyCode, extractLobbyCodeFromNarration } from "./lobby-code.js";
 import { hostOriginDigest } from "./provenance.js";
-import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./seats.js";
-// The FLOOR for the host-first handoff barrier deadline (ms). The host seat must surface a
+import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./participant-specs.js";
+// The floor for the host-first handoff barrier deadline (ms). The host must surface a
 // shared-session (/lobby/CODE) URL within the deadline or the run fails closed and no follower
-// opens. The effective deadline SCALES with the per-seat run budget (execution.timeoutMs): a fixed
-// 2 min is too tight for a real create-a-lobby flow on a mobile-layout seat once you subtract the
-// seat's own desktop provisioning — the host reaches /lobby/CODE, but after the followers already
-// gave up. So use max(FLOOR, 40% of the budget), capped at the budget. The latch resolves the
-// instant the host actually reaches /lobby, so a generous ceiling only affects the fail-closed case.
+// opens. The effective deadline scales with the per-participant run budget (execution.timeoutMs): a
+// fixed 2 min is too tight for a real create-a-lobby flow on a mobile-layout participant once you
+// subtract the participant's own desktop provisioning: the host reaches /lobby/CODE, but after the
+// followers already gave up. So use max(floor, 40% of the budget), capped at the budget. The latch
+// resolves the instant the host actually reaches /lobby, so a generous ceiling only affects the
+// fail-closed case.
 const DEFAULT_HANDOFF_DEADLINE_MS = 120_000;
 const HANDOFF_DEADLINE_BUDGET_FRACTION = 0.4;
-// Per-seat runaway backstop for the vision-off-frame lobby-code read (used by the host to LATCH the
-// handoff code, and by each follower to independently OBSERVE its own code for the convergence proof):
-// at most this many single-frame reads before the seat is assumed to be somewhere without a code. Each
-// reader stops the instant it has what it needs, so in practice only a handful fire (a seat reaches its
-// /lobby within a few turns). NOTE: these reads are out-of-band OpenAI calls (external-public route
-// only) and are NOT counted against execution.caps.maxUsd — this hard cap is what bounds their spend
-// instead (each read is one cheap single-frame OCR call). If this route ever runs under a strict
-// budget, fold the estimate in.
+// Per-participant runaway backstop for the vision-off-frame lobby-code read (used by the host to
+// latch the handoff code, and by each follower to independently observe its own code for the
+// convergence proof): at most this many single-frame reads before the participant is assumed to be
+// somewhere without a code. Each reader stops the instant it has what it needs, so in practice only
+// a handful fire (a participant reaches its /lobby within a few turns). NOTE: these reads are
+// out-of-band OpenAI calls (external-public route only) and are left out of execution.caps.maxUsd,
+// so this hard cap is what bounds their spend (each read is one cheap single-frame OCR call). If
+// this route ever runs under a strict budget, fold the estimate in.
 const MAX_LOBBY_CODE_VISION_READS = 30;
-// Idle/no-progress backstop for the HOST lane specifically (default is 6/8). The host legitimately sits
+// Idle/no-progress backstop for the host participant specifically (default is 6/8). The host legitimately sits
 // on an unchanging waiting-room screen while followers provision and join; it must not give up first.
 const HOST_WAIT_IDLE_STEPS = 80;
 const FOLLOWER_WAIT_IDLE_STEPS = 40;
@@ -66,21 +67,23 @@ class HandoffTimeoutError extends Error {
     }
 }
 /**
- * The handoff latch, its deadline and what each seat observed. The latched code and observed URLs
- * are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
- * is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
- * full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
+ * The handoff latch, its deadline and what each participant observed. The latched code and observed
+ * URLs are runtime-only and land in persisted metadata only as digests (origin + convergence). (The
+ * code is a shareable game code, not a secret, and it still renders in the host's screenshots,
+ * which are full-fidelity unless redactScreenshots is set. The digesting is about narration/URL
+ * metadata.)
  */
 export class LobbyHandoff {
-    // Per-lane runtime-only observed state (never persisted raw): the last observed URL and the last
-    // observed /lobby/CODE per seat, fed by onObservedUrl. The URL is digested to ORIGIN for each seat's
-    // routeHostDigest (no code leaks); the codes drive the cross-seat lobby-convergence digest.
+    // Per-participant runtime-only observed state (never persisted raw): the last observed URL and the last
+    // observed /lobby/CODE per participant, fed by onObservedUrl. The URL is digested to its origin
+    // for each participant's routeHostDigest (no code leaks); the codes drive the cross-participant
+    // lobby-convergence digest.
     observedFinalUrls;
     observedLobbyCodes;
     latchedLobbyCode;
     /** A follower gave up because the deadline passed. */
     timedOut = false;
-    /** Why the host seat ended without producing a lobby code. */
+    /** Why the host ended without producing a lobby code. */
     hostFailure;
     deadlineMs;
     lobbyCodeLatch = deferred();
@@ -100,7 +103,7 @@ export class LobbyHandoff {
         this.openaiApiKey = options.openaiApiKey;
     }
     /**
-     * Scrubs the latched lobby CODE from ANY persisted narration once the host resolves it (the
+     * Scrubs the latched lobby code from any persisted narration once the host resolves it (the
      * 6-char code has no detectable secret shape, so shape-only redaction cannot catch it).
      */
     scrub = (text) => {
@@ -122,7 +125,7 @@ export class LobbyHandoff {
             this.deadlineTimer = undefined;
         }
     }
-    // Resolve the host->follower handoff latch from WHICHEVER path sees the code first (CDP url-read,
+    // Resolve the host->follower handoff latch from whichever path sees the code first (CDP url-read,
     // host narration, or vision-off-frame). Idempotent: only the first code wins, and it is also stashed
     // as latchedLobbyCode so it gets scrubbed from any later narration.
     latchLobbyCode(code, participantIndex) {
@@ -133,11 +136,12 @@ export class LobbyHandoff {
         this.stopDeadline();
         this.lobbyCodeLatch.resolve(code);
     }
-    // Build an onScreenshot handler that vision-reads the lobby code off THIS seat's own frame (the
-    // CDP-independent observation). `done()` short-circuits once this seat has what it needs (the host
-    // once latched; a follower once it has recorded its own observed code), `onCode` records/latches the
-    // result. One read in flight at a time, bounded by MAX_LOBBY_CODE_VISION_READS so a seat that never
-    // reaches a lobby can't rack up unbounded calls (fire-and-forget; the loop never awaits it).
+    // Build an onScreenshot handler that vision-reads the lobby code off this participant's own frame
+    // (the CDP-independent observation). `done()` short-circuits once this participant has what it
+    // needs (the host once latched; a follower once it has recorded its own observed code), `onCode`
+    // records/latches the result. One read in flight at a time, bounded by
+    // MAX_LOBBY_CODE_VISION_READS so a participant that never reaches a lobby can't rack up unbounded
+    // calls (fire-and-forget; the loop never awaits it).
     makeLobbyCodeVisionReader(done, onCode) {
         let inFlight = false;
         let reads = 0;
@@ -184,32 +188,34 @@ export class LobbyHandoff {
             this.lobbyCodeLatch.reject(new Error(this.hostFailure));
         }
     }
-    /** The digest-only convergence proofs over what the seats observed. */
+    /** The digest-only convergence proofs over what the participants observed. */
     convergence(declaredOriginDigest) {
-        // Observed-origin convergence proof (blocker 2): the convergence claim is about what the seats
-        // OBSERVED, not what was DECLARED. Digest each observing seat's origin and require they AGREE on
-        // ONE — that agreement IS the convergence proof and becomes plane.publicOriginDigest. A normal
-        // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the seats still
-        // converge on ONE observed origin. Leave it undefined (verify fails closed) only if the seats did
-        // not converge on a single observed origin (or none observed one).
+        // Observed-origin convergence proof: the convergence claim is about what the participants
+        // observed. Digest each observing participant's origin and require one shared origin; that
+        // agreement is the convergence proof and becomes plane.publicOriginDigest. A normal
+        // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the
+        // participants still converge on one observed origin. Leave it undefined (verify fails closed)
+        // only if the participants did not converge on a single observed origin (or none observed one).
         const observedOriginDigests = this.observedFinalUrls
             .filter((url) => typeof url === "string" && url.length > 0)
             .map((url) => hostOriginDigest(url));
         const distinctObservedOrigins = new Set(observedOriginDigests);
         const publicOriginDigest = distinctObservedOrigins.size === 1
             ? [...distinctObservedOrigins][0]
-            : // NOTHING observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
-                // DECLARED origin so a FAILED run's bundle stays structurally valid (every seat's route then
-                // digests to the declared origin too). The run still fails closed for its own reason (HANDOFF_
-                // TIMEOUT / no lobby convergence / no overlap-on-pass). GENUINE divergence (≥2 distinct observed
-                // origins) leaves it undefined so verify fails closed on the non-convergence.
+            : // Nothing observed (e.g. a handoff-timeout run where no participant ever navigated): fall
+                // back to the declared origin so a failed run's bundle stays structurally valid (every
+                // participant's route then digests to the declared origin too). The run still fails
+                // closed for its own reason (`HANDOFF_TIMEOUT`, no lobby convergence, no
+                // overlap-on-pass). Real divergence (≥2 distinct observed origins) leaves it undefined so
+                // verify fails closed on the non-convergence.
                 distinctObservedOrigins.size === 0
                     ? declaredOriginDigest
                     : undefined;
-        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff EVERY seat converged on the
-        // SAME code (a follower stuck on "/" yields no code → no false convergence). Digest-only. NOTE:
-        // observedLobbyCodes may be a SPARSE array (a seat that never observed a code leaves a hole), and
-        // Array.prototype.every SKIPS holes — so count the DEFINED codes explicitly, never rely on every().
+        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff every participant
+        // converged on the same code (a follower stuck on "/" yields no code, so no false convergence).
+        // Digest-only. observedLobbyCodes may be a sparse array (a participant that never observed a
+        // code leaves a hole), and Array.prototype.every skips holes, so count the defined codes
+        // explicitly instead of every().
         const definedCodes = this.observedLobbyCodes.filter((code) => code !== undefined);
         const distinctCodes = new Set(definedCodes);
         const lobbyConvergenceDigest = distinctCodes.size === 1 && definedCodes.length === this.observedLobbyCodes.length
@@ -218,30 +224,30 @@ export class LobbyHandoff {
         return { publicOriginDigest, lobbyConvergenceDigest };
     }
 }
-// Adopter-hosted inbox (#387): the persona is told its address and inbox URL on THIS plane.
+// Adopter-hosted inbox: the persona is told its address and inbox URL on this plane.
 function withParticipantInbox(spec, inbox) {
     return inbox && participantHasInboxRecipient(inbox.email, spec.planned.id)
         ? withInboxMission(spec, inbox.inboxUrl, inboxRecipientFor(inbox.email, spec.planned.id)?.address)
         : spec;
 }
-// The HOST lane (which yields the /lobby/CODE the followers wait on) runs on its OWN dedicated
-// slot, and the FOLLOWERS run through a bounded pool of size concurrency-1 (blockers 1 & 4):
-// followers block on the host's code while holding a worker slot, so if the host lane were
-// scheduled INSIDE the same bounded pool it could be starved (never scheduled among the first
-// `concurrency` workers) and the run would die with a spurious HANDOFF_TIMEOUT (e.g. lanes
-// [p2,p3,host] with concurrency 2). Giving the host its own slot, started IMMEDIATELY and OUTSIDE
-// the follower pool, guarantees it is ALWAYS schedulable regardless of its roster position or of
-// concurrency vs lane count — while total in-flight paid desktops stay ≤ the declared concurrency
+// The host participant (which yields the /lobby/CODE the followers wait on) runs on its own dedicated
+// slot, and the followers run through a bounded pool of size concurrency-1 (blockers 1 & 4):
+// followers block on the host's code while holding a worker slot, so if the host participant were
+// scheduled inside the same bounded pool it could be starved (never scheduled among the first
+// `concurrency` workers) and the run would die with a spurious HANDOFF_TIMEOUT (e.g. participants
+// [p2,p3,host] with concurrency 2). Giving the host its own slot, started immediately and outside
+// the follower pool, keeps it schedulable regardless of its roster position or of concurrency vs
+// participant count, while total in-flight paid desktops stay ≤ the declared concurrency
 // (host + up to concurrency-1 followers), preserving the spend cap.
 export async function runHost(handoff, deps, spec, participantIndex) {
     const onObservedUrl = handoff.makeObservedUrl(participantIndex, true);
-    // CDP-INDEPENDENT handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
-    // unreliable in practice). Two backups, both resolving the SAME latch; whichever sees the code first
+    // CDP-independent handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
+    // unreliable in practice). Two backups, both resolving the same latch; whichever sees the code first
     // wins, all digest-only:
-    //   (1) onMessage — scan the host's own narration IF it happens to state the lobby URL; and
-    //   (2) onScreenshot — vision-read the code straight off the host's waiting-room frame. This is the
-    //       robust one: the code is rendered on screen even when CDP fails AND when the host never
-    //       narrates it, and — crucially — the host is NOT asked to announce anything, so it keeps
+    //   (1) onMessage: scan the host's own narration if it happens to state the lobby URL; and
+    //   (2) onScreenshot: vision-read the code straight off the host's waiting-room frame. This is the
+    //       robust one: the code is rendered on screen even when CDP fails and when the host never
+    //       narrates it, and the host is never asked to announce anything, so it keeps
     //       running (create -> wait for players -> Start -> play) instead of ending on a stray message.
     const onMessage = (text) => {
         if (handoff.latchedLobbyCode !== undefined)
@@ -250,13 +256,14 @@ export async function runHost(handoff, deps, spec, participantIndex) {
         if (code !== undefined)
             handoff.latchLobbyCode(code, participantIndex);
     };
-    // Vision-read the host's waiting-room frame and LATCH the code for the followers (stops once latched).
+    // Vision-read the host's waiting-room frame and latch the code for the followers (stops once latched).
     const onScreenshot = handoff.makeLobbyCodeVisionReader(() => handoff.latchedLobbyCode !== undefined, (code) => handoff.latchLobbyCode(code, participantIndex));
-    // The host's job includes a long LEGITIMATE idle wait — sitting in the waiting room while the
+    // The host's job includes a long, legitimate idle wait: sitting in the waiting room while the
     // followers provision their own desktops and walk the Join flow (easily 15-30 turns of an
     // unchanging "waiting for players" screen). At the default idle backstop (6) the host would give up
     // before anyone arrives, orphaning the lobby (exactly the earlier failure). Raise the host's idle /
-    // no-progress tolerance so it waits patiently; the per-seat timeout still bounds a truly stuck host.
+    // no-progress tolerance so it waits patiently; the per-participant timeout still bounds a truly
+    // stuck host.
     const hostSpec = {
         ...withParticipantInbox(spec, deps.inbox),
         backstop: {
@@ -291,7 +298,7 @@ export async function runHost(handoff, deps, spec, participantIndex) {
 }
 export async function runFollower(handoff, deps, spec, participantIndex) {
     const onObservedUrl = handoff.makeObservedUrl(participantIndex, false);
-    // FOLLOWER: do NOT compose a mission or open the target until the host yields a lobby code.
+    // Follower: compose no mission and open no target until the host yields a lobby code.
     let code;
     try {
         code = await handoff.waitForHostCode();
@@ -310,9 +317,10 @@ export async function runFollower(handoff, deps, spec, participantIndex) {
             route: deps.publicAppUrl,
         };
     }
-    // Followers also idle-wait — in the waiting room until the host starts, and between rounds. Raise
+    // Followers also idle-wait: in the waiting room until the host starts, and between rounds. Raise
     // their idle backstop too (less than the host's: they wait less), so a follower that joins ahead of
-    // the other does not give up before the game begins. Per-seat timeout still bounds a stuck follower.
+    // the other does not give up before the game begins. Per-participant timeout still bounds a stuck
+    // follower.
     const followerSpec = {
         ...withLobbyCodeMission(withParticipantInbox(spec, deps.inbox), code),
         backstop: {
@@ -320,13 +328,13 @@ export async function runFollower(handoff, deps, spec, participantIndex) {
             noProgressSteps: spec.backstop?.noProgressSteps ?? FOLLOWER_WAIT_IDLE_STEPS,
         },
     };
-    // Independently OBSERVE this follower's own lobby code by vision-reading its waiting-room frame,
-    // and record it for the cross-seat convergence proof. This does NOT latch anything (followers gate
-    // on the HOST's code, not their own) — it just fills this seat's observedLobbyCodes slot from a
-    // reliable signal instead of the flaky CDP url-read, so lobbyConvergenceDigest can prove all seats
-    // reached the SAME /lobby/CODE. If a follower somehow joined a DIFFERENT lobby, it reads a different
-    // code and convergence correctly fails (no false proof); if it never reads one, the seat stays a
-    // hole and convergence is honestly "not observed" for that seat.
+    // Independently observe this follower's own lobby code by vision-reading its waiting-room frame,
+    // and record it for the cross-participant convergence proof. This latches nothing (followers gate
+    // on the host's code). It fills this participant's observedLobbyCodes slot from a
+    // reliable signal instead of the flaky CDP url-read, so lobbyConvergenceDigest can prove all
+    // participants reached the same /lobby/CODE. If a follower somehow joined another lobby, it reads
+    // a different code and convergence correctly fails (no false proof); if it never reads one, the
+    // participant stays a hole and convergence is recorded as "not observed" for that participant.
     const onScreenshot = handoff.makeLobbyCodeVisionReader(() => handoff.observedLobbyCodes[participantIndex] !== undefined, (observed) => {
         handoff.observedLobbyCodes[participantIndex] = observed;
     });

package/dist/routes/shared-world/lobby-code.d.ts

@@ -1,14 +1,14 @@
-/** Extract the shared-session CODE from a (runtime-only) observed URL, or undefined. Exported for the
- *  handoff regex table test — pure, no side effects, never persists its input. */
+/** Extract the shared-session code from a (runtime-only) observed URL, or undefined. Exported for the
+ *  handoff regex table test. Pure, no side effects, never persists its input. */
 export declare function extractLobbyCode(url: string | undefined): string | undefined;
 export declare function extractLobbyCodeFromNarration(text: string | undefined): string | undefined;
 /** Pull the assistant's plain text out of an OpenAI Responses API body (`output_text` convenience
  *  field, else the concatenated `output[].content[].text`). Tolerant of shape drift; pure. */
 export declare function extractResponsesOutputText(parsed: unknown): string | undefined;
-/** Parse a vision reply into a lobby CODE. PRECISION-FIRST: accept ONLY when the whole reply IS the
- *  six-character code, or when it echoes an explicit /lobby/CODE — never a bare 6-letter token buried in
- *  prose (e.g. "I see a home SCREEN"), because a wrong latch fails the entire run, whereas a miss just
- *  retries on the next frame while the host keeps waiting. NONE (the instructed "no code" reply) is
+/** Parse a vision reply into a lobby code. Precision-first: accept only when the whole reply is the
+ *  six-character code, or when it echoes an explicit /lobby/CODE; never a bare 6-letter token buried in
+ *  prose (e.g. "I see a home `SCREEN`"), because a wrong latch fails the entire run, whereas a miss just
+ *  retries on the next frame while the host keeps waiting. `NONE` (the instructed "no code" reply) is
  *  rejected. Pure. */
 export declare function parseLobbyCodeReply(reply: string | undefined): string | undefined;
 export interface ReadLobbyCodeOptions {
@@ -18,7 +18,7 @@ export interface ReadLobbyCodeOptions {
     signal?: AbortSignal;
 }
 /**
- * Vision-read a lobby CODE straight off a host waiting-room FRAME (the robust, CDP-independent handoff
+ * Vision-read a lobby code straight off a host waiting-room frame (the robust, CDP-independent handoff
  * relay). Fail-soft: any network/HTTP/parse problem returns undefined so the caller simply retries on
  * the next frame. The frame is runtime-only; only the extracted code is used (as a digest downstream).
  */

package/dist/routes/shared-world/lobby-code.js

@@ -1,15 +1,15 @@
-// Reads a lobby code (the /lobby/CODE path segment) from a URL, from a seat's narration or, through
-// a vision model call, from a seat's screenshot. The external-public plane uses it to hand the
-// host's lobby to the followers.
+// Reads a lobby code (the /lobby/CODE path segment) from a URL, from a participant's narration or,
+// through a vision model call, from a participant's screenshot. The external-public plane uses it
+// to hand the host's lobby to the followers.
 import { OPENAI_RESPONSES_URL } from "../../actors/openai-endpoint.js";
 /**
  * The lobby-trivia (and general "/lobby/CODE") shared-session URL matcher. A code is exactly 6 chars of
- * the [A-Z2-9] class; a locale prefix (/en/lobby/…) and a query/hash suffix are tolerated. RUNTIME-ONLY
- * input (a live location.href); only the extracted CODE is used, and it lands only as a digest.
+ * the [A-Z2-9] class; a locale prefix (/en/lobby/…) and a query/hash suffix are tolerated. Runtime-only
+ * input (a live location.href); only the extracted code is used, and it lands only as a digest.
  */
 const LOBBY_CODE_PATTERN = /\/lobby\/([A-Z2-9]{6})(?:$|[/?#])/;
-/** Extract the shared-session CODE from a (runtime-only) observed URL, or undefined. Exported for the
- *  handoff regex table test — pure, no side effects, never persists its input. */
+/** Extract the shared-session code from a (runtime-only) observed URL, or undefined. Exported for the
+ *  handoff regex table test. Pure, no side effects, never persists its input. */
 export function extractLobbyCode(url) {
     if (typeof url !== "string")
         return undefined;
@@ -17,10 +17,10 @@ export function extractLobbyCode(url) {
     return match ? match[1] : undefined;
 }
 /**
- * Extract a lobby CODE from free-form ACTOR NARRATION (the host's reasoning/message where it states
+ * Extract a lobby code from free-form actor narration (the host's reasoning/message where it states
  * the lobby URL it sees), where the /lobby/CODE is followed by arbitrary prose (a space, backtick,
- * newline) rather than end-of-string or /?# — so the strict LOBBY_CODE_PATTERN would miss it. Uses a
- * negative-lookahead boundary (exactly 6 code chars). This is the CDP-INDEPENDENT handoff path: the
+ * newline) rather than end-of-string or /?#, so the strict LOBBY_CODE_PATTERN would miss it. Uses a
+ * negative-lookahead boundary (exactly 6 code chars). This is the CDP-independent handoff path: the
  * host reads the code on screen and states it, and this reads it from the model's own text. Pure;
  * input is runtime-only; only the code is used (as a digest).
  */
@@ -32,10 +32,10 @@ export function extractLobbyCodeFromNarration(text) {
     if (inUrl)
         return inUrl[1];
     // Fallback: an explicitly-labeled bare code (e.g. "LOBBY_CODE=ABC123"), which the host may state
-    // if it copied the code rather than the URL. The label is matched case-insensitively, but the CODE
-    // itself must be UPPERCASE [A-Z2-9] — a real lobby code always renders uppercase, whereas an /i match
+    // if it copied the code rather than the URL. The label is matched case-insensitively, but the code
+    // itself must be uppercase [A-Z2-9]: a real lobby code always renders uppercase, whereas an /i match
     // on the code class would also grab an ordinary lowercase word after "lobby code " (e.g. "the lobby
-    // code screen") and latch a WRONG code. Precision-first, matching parseLobbyCodeReply's rationale.
+    // code screen") and latch a wrong code. Precision-first, matching parseLobbyCodeReply's rationale.
     const labeled = text.match(/lobby[ _-]?code[=:\s]+([A-Z2-9]{6})(?![A-Za-z2-9])/i);
     return labeled && labeled[1] && /^[A-Z2-9]{6}$/.test(labeled[1]) ? labeled[1] : undefined;
 }
@@ -67,10 +67,10 @@ export function extractResponsesOutputText(parsed) {
     }
     return parts.length > 0 ? parts.join("\n") : undefined;
 }
-/** Parse a vision reply into a lobby CODE. PRECISION-FIRST: accept ONLY when the whole reply IS the
- *  six-character code, or when it echoes an explicit /lobby/CODE — never a bare 6-letter token buried in
- *  prose (e.g. "I see a home SCREEN"), because a wrong latch fails the entire run, whereas a miss just
- *  retries on the next frame while the host keeps waiting. NONE (the instructed "no code" reply) is
+/** Parse a vision reply into a lobby code. Precision-first: accept only when the whole reply is the
+ *  six-character code, or when it echoes an explicit /lobby/CODE; never a bare 6-letter token buried in
+ *  prose (e.g. "I see a home `SCREEN`"), because a wrong latch fails the entire run, whereas a miss just
+ *  retries on the next frame while the host keeps waiting. `NONE` (the instructed "no code" reply) is
  *  rejected. Pure. */
 export function parseLobbyCodeReply(reply) {
     if (typeof reply !== "string")
@@ -88,11 +88,11 @@ const LOBBY_CODE_VISION_PROMPT = "This is a screenshot of a the example multipla
     "code'/'room code' label or inside an invite link of the form /lobby/CODE. Your entire reply MUST be " +
     "exactly those 6 characters in uppercase and NOTHING else (no words, no punctuation). If no lobby " +
     "code is visible on this screen (e.g. it is the home screen or a game round), reply exactly NONE.";
-// A single-frame OCR-style read. gpt-5.5 (the CU default) is used deliberately: it reliably reads the
-// 6-char code off a dense MOBILE-viewport waiting room — a smaller/cheaper model (gpt-4.1-mini) was
-// tried and could NOT read it. reasoning.effort stays "low" (minimal) and the output budget is small
+// A single-frame OCR-style read. gpt-5.5 (the computer-use default) is used deliberately: it reliably reads the
+// 6-char code off a dense mobile-viewport waiting room. A smaller/cheaper model (gpt-4.1-mini) was
+// tried and could not read it. reasoning.effort stays "low" (minimal) and the output budget is small
 // but comfortably clear of the "incomplete on reasoning overflow" edge. Kept on the same account/key
-// as the actor; the same full-fidelity frame is already sent to this API by the CU provider, so this
+// as the actor; the same full-fidelity frame is already sent to this API by the computer-use provider, so this
 // adds no new data-exposure surface. See onScreenshot in runHost.
 const LOBBY_CODE_VISION_MODEL = "gpt-5.5";
 // Output-token budget for the read. The answer is 6 chars, but leave clear margin over any low-effort
@@ -102,7 +102,7 @@ const LOBBY_CODE_VISION_MAX_OUTPUT_TOKENS = 64;
 // visionInFlight pinned true and silently kill the relay for the rest of the host run.
 const LOBBY_CODE_VISION_TIMEOUT_MS = 15_000;
 /**
- * Vision-read a lobby CODE straight off a host waiting-room FRAME (the robust, CDP-independent handoff
+ * Vision-read a lobby code straight off a host waiting-room frame (the robust, CDP-independent handoff
  * relay). Fail-soft: any network/HTTP/parse problem returns undefined so the caller simply retries on
  * the next frame. The frame is runtime-only; only the extracted code is used (as a digest downstream).
  */

package/dist/routes/shared-world/{seats.d.ts → participant-specs.d.ts}

@@ -4,13 +4,13 @@ import type { RunBundle } from "../../run/bundle.js";
 import type { CuaParticipantDeps, DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
 import type { LiveParticipants, PlaneContext } from "./types.js";
 export declare function defaultSessionTimeoutMs(plan: SharedWorldPlan): number;
-/** Resolve an actor's seat URL against the harness-minted getHost base (entry is a same-origin
- *  relative path, validated at parse against serve.url). */
+/** Resolve an actor's participant URL against the harness-minted getHost base (entry is a
+ *  same-origin relative path, validated at parse against serve.url). */
 export declare function resolveActorEntryUrl(baseUrl: string, entry: string | undefined): string;
 export declare function participantTaxonomyLabel(labels: Participant["labels"]): string;
-/** Thread the host-yielded lobby CODE into a follower's mission at runtime (external-public route).
- *  The CODE flows into the follower's join instruction; it is persisted only as the composed prompt
- *  the model reads (never a raw bundle field), and the lab scrubs the CODE from all narration. The
+/** Thread the host-yielded lobby code into a follower's mission at runtime (external-public route).
+ *  The code flows into the follower's join instruction; it is persisted only as the composed prompt
+ *  the model reads (never a raw bundle field), and the lab scrubs the code from all narration. The
  *  follower joins through the real UI (a direct /lobby/CODE visit does not auto-join a non-member). */
 export declare function withLobbyCodeMission(spec: DesktopParticipantRun, code: string): DesktopParticipantRun;
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
@@ -19,20 +19,23 @@ export declare function makeBlockedFollowerOutcome(spec: DesktopParticipantRun,
 /** The computer-use runner deps every participant shares, on either plane. */
 export type ParticipantRunDeps = Omit<CuaParticipantDeps, "signalProvisioned" | "appUrl" | "onObservedUrl">;
 /**
- * A live run publishes an in-progress bundle before its seats start, whether or not an Observer
- * is attached, and the seats' live traces rewrite it as they go, as on the computer-use route. A
- * run killed mid-way leaves that evidence on disk. The flush starts with the first snapshot.
+ * A live run publishes an in-progress bundle before its participants start, whether or not an
+ * Observer is attached, and the participants' live traces rewrite it as they go, as on the
+ * computer-use route. A run killed mid-way leaves that evidence on disk. The flush starts with the
+ * first snapshot.
  */
 export declare function startParticipantFlush(ctx: PlaneContext, live: LiveParticipants, bundle: RunBundle): void;
 /**
- * The runner deps both planes give every participant. cloneRoute=false + subjectEnvNames=[] keep subject
- * creds out of every actor sandbox (FIX-10). `scrubKnownValues` is the plane's scrub: the
- * external-public plane also scrubs the latched lobby code.
+ * The runner deps both planes give every participant. The `shared-app` subject keeps three things
+ * out of every actor sandbox: the subject env names' values, the GitHub token, and clone
+ * or local-tree provisioning. The committed subject.envValues still reach it, non-secret by parse.
+ * `scrubKnownValues` is the plane's scrub: the external-public plane also scrubs the latched lobby
+ * code.
  */
 export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): ParticipantRunDeps;
 /**
  * Each participant's actor spec, with committed personas compiled in so each prompt carries real
- * behavioral directives (#381). Evidence copies of the assignment, instructions and persona are
+ * behavioral directives. Evidence copies of the assignment, instructions and persona are
  * scrubbed of the run's known secret values.
  */
 export declare function buildParticipantSpecs(participants: readonly SharedWorldParticipant[], cwd: string, scrubKnownValues: (text: string) => string): Promise<DesktopParticipantRun[]>;