humanish 0.106.1 → 0.108.0

package/dist/routes/terminal/live-sandbox.js

@@ -52,13 +52,13 @@ export class LiveTerminalSandbox {
         });
     }
     async acquire() {
-        const { plan, hooks, now, sanitize, runtimeEnv, e2bApiKey, runPaths, metadata } = this.inputs;
+        const { plan, deps, now, sanitize, runtimeEnv, e2bApiKey, runPaths, metadata } = this.inputs;
         const { warnings } = this.inputs;
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs, sandboxTimeoutMs } = this;
-        // Declared egress allowlist, or undefined for the historical unrestricted default (#538).
+        // Declared egress allowlist, or undefined for the historical unrestricted default.
         const egressAllow = plan.egressAllow;
-        const sandboxModule = await (hooks.loadModule ?? loadE2BDesktopModule)();
+        const sandboxModule = await (deps.desktopModule ?? loadE2BDesktopModule)();
         this.module = sandboxModule;
         await validatePreparedRunArtifactPaths(runPaths);
         // No sandbox-global env in either mode. In openai-egress, only this host-side SDK request
@@ -99,7 +99,7 @@ export class LiveTerminalSandbox {
         this.sandboxId = sandboxId;
         this.createdAtMs = now();
         await validatePreparedRunArtifactPaths(runPaths);
-        recordLifecycle("terminal-lab.sandbox.created", `E2B shell sandbox ${sandboxId} created with positive-allowlist metadata and kill-on-timeout; NO sandbox-global env.`);
+        recordLifecycle("terminal-lab.sandbox.created", `E2B shell sandbox ${sandboxId} created with allowlisted metadata and kill-on-timeout, and with no sandbox-wide environment variables.`);
         const sandboxResources = await observeDesktopResources(sandbox);
         this.resources = sandboxResources;
         if ("reason" in sandboxResources) {
@@ -108,7 +108,7 @@ export class LiveTerminalSandbox {
         // The allowlist is evidence: a reader of the ledger can see exactly what the participant was
         // able to reach, without the ledger carrying any secret.
         recordLifecycle("terminal-lab.egress.policy", egressAllow === undefined
-            ? "Egress UNRESTRICTED (no execution.egressAllow declared)."
+            ? "Egress is unrestricted (no execution.egressAllow declared)."
             : `Egress routing allowlist: ${egressAllow.length} declared host(s): ${egressAllow.join(", ")}; deny-all fallback. Domain routing is not strict destination isolation on shared infrastructure.`);
         recordLifecycle("terminal-lab.runtime-auth", runtimeEnv.mode === "openai-egress"
             ? "Runtime auth openai-egress: raw key remains outside the sandbox in the api.openai.com HTTPS Authorization transform; Codex receives an inert CODEX_API_KEY placeholder and the default OpenAI endpoint. Every sandbox process, including bootstrap/setup, can spend via this proxy; no added routing restriction or provider spending limit."
@@ -130,8 +130,8 @@ export class LiveTerminalSandbox {
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs } = this;
         // --- Runtime bootstrap: no runtime env; openai-egress proxy capability is already available. ---
-        // The stock desktop needs Node/npm on PATH before npx can run Codex. Reuse a working
-        // installation or install the pinned official binary after checksum verification (#674).
+        // The stock desktop needs Node/npm on `PATH` before npx can run Codex. Reuse a working
+        // installation or install the pinned official binary after checksum verification.
         // No raw runtime key touches this step; the egress proxy, when selected, is already available.
         const bootstrapStartedAt = now();
         let bootstrapError;
@@ -149,10 +149,10 @@ export class LiveTerminalSandbox {
         }
         const bootstrapDurationMs = Math.max(0, now() - bootstrapStartedAt);
         recordLifecycle("terminal-lab.runtime.bootstrapped", bootstrapError
-            ? `Runtime bootstrap FAILED after ${bootstrapDurationMs}ms: ${bootstrapError}. codex exec runs via npx and needs Node/npm present; the participant fails closed rather than attempting an exec with no runtime.`
+            ? `Runtime bootstrap failed after ${bootstrapDurationMs}ms: ${bootstrapError}. codex exec runs through npx and needs Node and npm, so the participant stops here instead of starting codex with no runtime.`
             : `Runtime bootstrap ensured Node/npm present in ${bootstrapDurationMs}ms (codex exec runs via npx).`);
         if (bootstrapError) {
-            // Fail closed as a structured lane status (never a raw throw): no codex exec is attempted
+            // Fail closed as a structured route status (never a raw throw): no codex exec is attempted
             // without a proven runtime; this mirrors the exec-error status assignment below so the
             // bundle and verify surface the failure the same way.
             this.status = "failed";
@@ -185,7 +185,7 @@ export class LiveTerminalSandbox {
                 throw new Error(`Codex version mismatch: requested ${requested}, observed ${observed}.`);
             }
             runtime.versionStatus = "verified";
-            recordLifecycle("terminal-lab.runtime.version", `Codex requested ${runtime.requestedVersion}, observed ${observed}; exact version selected for execution. Model ${runtime.requestedModel ?? "runtime default (unobserved)"}; reasoning effort ${runtime.requestedReasoningEffort ?? "runtime default (unobserved)"}.`);
+            recordLifecycle("terminal-lab.runtime.version", `Codex requested ${runtime.requestedVersion}, observed ${observed}; exact version selected for execution. Model ${runtime.requestedModel ?? "unrecorded"} (${runtime.modelStatus}); reasoning effort ${runtime.requestedReasoningEffort ?? "runtime default (unobserved)"}.`);
         }
         catch (error) {
             runtime.versionStatus = "failed";
@@ -205,15 +205,15 @@ export class LiveTerminalSandbox {
         const { requestTimeoutMs } = this;
         // --- Optional product setup (no runtime env), before the Codex exec. ---
         // Same channel and same guarantees as the runtime bootstrap above: no runtime key touches it,
-        // and a failure fails the lane closed rather than handing the agent a half-built world. It
-        // exists so a study can put the participant IN a prepared project — asking an agent what
+        // and a failure fails the run closed rather than handing the agent a half-built world. It
+        // exists so a study can put the participant in a prepared project: asking an agent what
         // studies a project contains, in an empty directory, measures the lab and not the product
-        // (learned the hard way on the desktop lane, labs/tui-self-study.yaml).
+        // (learned the hard way on the desktop route, labs/tui-self-study.yaml).
         const install = plan.product.install;
         if (install === undefined)
             return true;
         // An optional local file, put on the machine before the install runs, so a study can meet a
-        // build that is not published yet. Read and checked HERE rather than trusted from the
+        // build that is not published yet. It is read and checked here, so nothing is trusted from the
         // manifest: this puts a file from the operator's disk onto a machine an autonomous agent is
         // about to drive, so it stays inside the project, must be a regular file, and is size-capped.
         let uploadAssignment = "";
@@ -239,8 +239,8 @@ export class LiveTerminalSandbox {
                 });
                 const bytes = await readFile(real);
                 await this.sandbox.files.write(destination, bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
-                // Inlined into the command string rather than passed as `envs`: the ONLY call in this
-                // lane that carries envs is the keyed codex exec, and that invariant is worth more than
+                // Inlined into the command string rather than passed as `envs`: the only call on this
+                // route that carries envs is the keyed codex exec, and that invariant is worth more than
                 // the convenience of a second envs channel.
                 uploadAssignment = `export HUMANISH_PRODUCT_UPLOAD=${shellQuote(destination)}; `;
                 recordLifecycle("terminal-lab.product.uploaded", `Uploaded ${info.size} bytes to the sandbox in ${Math.max(0, now() - uploadStartedAt)}ms (no runtime env; declared egress auth may already be available).`);
@@ -259,7 +259,7 @@ export class LiveTerminalSandbox {
             const setup = await this.sandbox.commands.run(`${uploadAssignment}cd ${SANDBOX_WORKDIR} && ${install}`, {
                 // The install step may run the product itself (release:dogfood's does: `humanish init
                 // --yes`); on the 0.67.0 dogfood that one command arrived unmarked while the participant's
-                // nine others carried the marker (#546).
+                // nine others carried the marker.
                 envs: { HUMANISH_STUDY_PARTICIPANT: "1" },
                 requestTimeoutMs,
                 timeoutMs: PRODUCT_SETUP_TIMEOUT_MS,
@@ -272,7 +272,7 @@ export class LiveTerminalSandbox {
             setupError = toErrorMessage(error);
         }
         recordLifecycle("terminal-lab.product.prepared", setupError
-            ? `Product setup FAILED after ${Math.max(0, now() - setupStartedAt)}ms: ${sanitize(setupError)}`
+            ? `Product setup failed after ${Math.max(0, now() - setupStartedAt)}ms: ${sanitize(setupError)}`
             : `Product setup completed in ${Math.max(0, now() - setupStartedAt)}ms (no runtime env; declared egress auth may already be available).`);
         if (setupError) {
             this.status = "failed";
@@ -292,15 +292,15 @@ export class LiveTerminalSandbox {
         const { requestTimeoutMs, wallClockMs } = this;
         // --- The keyed run: `codex exec --json` non-interactively (stdin disabled). ---
         // openai-env passes the real key here; openai-egress passes an inert placeholder. stdin is
-        // never wired (safety contract item 7) — commands.run takes no stdin channel. The command's
-        // wall-clock is bounded by maxMinutes (safety contract item 2): commands.run timeoutMs +
+        // never wired: commands.run takes no stdin channel. The command's
+        // wall-clock is bounded by maxMinutes: commands.run timeoutMs +
         // an injected-clock guard so a mock/real run that exceeds it is killed and fails closed.
         const codexCommand = buildCodexExecCommand({
             workdir: SANDBOX_WORKDIR,
             prompt: composedPrompt,
             runtimeAuth: runtimeEnv.mode,
             version: runtime.observedVersion,
-            ...(model === undefined ? {} : { model }),
+            model,
             ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
         });
         const commandDigest = digestText(codexCommand);
@@ -312,8 +312,7 @@ export class LiveTerminalSandbox {
             const result = await runWithWallClock(this.sandbox.commands.run(codexCommand, {
                 // The selected command env (raw key or inert placeholder). The participant
                 // marker rides the same command: humanish telemetry from inside a study reads as a new
-                // adopter otherwise. #546 added the flag and nothing set it; the 0.66.0 dogfood
-                // participant's twelve commands arrived unmarked.
+                // adopter otherwise.
                 envs: { ...runtimeEnv.envs, HUMANISH_STUDY_PARTICIPANT: "1" },
                 requestTimeoutMs,
                 timeoutMs: wallClockMs,
@@ -342,13 +341,13 @@ export class LiveTerminalSandbox {
             at: nowIso(),
             label: "codex-exec",
             commandDigest,
-            envNames: Object.keys(runtimeEnv.envs), // NAMES only — the credential evidence (item 4).
+            envNames: Object.keys(runtimeEnv.envs), // Names only: the credential evidence (item 4).
             ...(exitCode === undefined ? {} : { exitCode }),
             ...(this.timedOut ? { timedOut: true } : {}),
             durationMs,
         });
-        // Score by the verdict-nonce marker over the SCRUBBED+REDACTED, NORMALIZED transcript — the
-        // exact same logic the local-actor lanes use (extractLocalActorVerdict/normalizeLocalActorTranscript).
+        // Score by the verdict-nonce marker over the scrubbed, redacted and normalized transcript, with
+        // the exact same logic the local-actor routes use (extractLocalActorVerdict/normalizeLocalActorTranscript).
         const rawTranscript = terminalEvents.map((e) => e.chunk).join("");
         const normalizedTranscript = normalizeLocalActorTranscript(rawTranscript);
         const markerStatus = extractLocalActorVerdict(normalizedTranscript, verdictNonce);
@@ -378,8 +377,8 @@ export class LiveTerminalSandbox {
         }
         else {
             // No nonce-verified verdict: the agent did not (credibly) report a terminal status. A run
-            // that exited 0 but printed no verified marker is BLOCKED evidence (the failure IS the
-            // evidence — still structurally verifiable), not a silent pass.
+            // that exited 0 but printed no verified marker is blocked evidence: the failure is the
+            // evidence, and it stays structurally verifiable.
             this.status = "blocked";
             this.completionReason = "gave_up";
             this.reason = `codex exec exit=${exitCode ?? "null"} but no nonce-verified HUMANISH_ACTOR_VERDICT marker was emitted; recorded as blocked (the missing verdict is the evidence).`;
@@ -404,7 +403,7 @@ export class LiveTerminalSandbox {
         const { now, sanitize, warnings } = this.inputs;
         const { recordLifecycle } = this.inputs.recorder;
         const { requestTimeoutMs } = this;
-        // --- Safety contract item 8: PROVEN cleanup, BY EXACT ID, never Sandbox.list. ---
+        // --- Proven cleanup, by exact id, never Sandbox.list. ---
         this.cleanup = await teardownSandbox({
             allocation: this.allocation,
             sandboxModule: this.module,
@@ -435,14 +434,14 @@ export class LiveTerminalSandbox {
 }
 /** Build the in-sandbox `codex exec` command (non-interactive, JSON, stdin disabled by mechanism). */
 function buildCodexExecCommand(args) {
-    // The prompt is passed via a heredoc on stdin of a wrapper? NO, stdin is DISABLED (item 7), so
+    // stdin is disabled (item 7), so no heredoc on a wrapper's stdin carries the prompt;
     // the prompt rides as the final positional arg, shell-quoted. codex exec --json runs once and
     // exits (no interactive loop). --skip-git-repo-check: the workdir is a fresh scratch dir.
     // Pinned via npx (never an ambient/preinstalled `codex` binary, which the stock @e2b/desktop
-    // image does not ship, per issue #159); npm_config_update_notifier=false silences npx's own
+    // image does not ship); npm_config_update_notifier=false silences npx's own
     // update check so it cannot leak into the captured stdout the scorer/redactor parse.
     const quotedPrompt = shellQuote(args.prompt);
-    // --dangerously-bypass-approvals-and-sandbox: codex's OWN inner sandbox is
+    // --dangerously-bypass-approvals-and-sandbox: codex's own inner sandbox is
     // redundant here and blocks the network/file access the study mission needs.
     // The E2B sandbox is the trust boundary (the disposable machine), and exec mode has no
     // interactive approval channel at all.

package/dist/routes/terminal/participant-text.d.ts

@@ -0,0 +1,23 @@
+import type { ActorTraceItem } from "../../actors/contract.js";
+/** What the reader found in the agent's Codex JSON stdout. */
+export interface TerminalParticipantText {
+    /** Message and reasoning items, the most recent kept under the aggregate limits, then a notice
+     *  when older ones were left out. */
+    items: ActorTraceItem[];
+    /** Distinct agent_message items in the stream, kept or not. */
+    messages: number;
+    /** Distinct participant items: messages, reasoning, commands, web searches and file changes.
+     *  Lifecycle, usage, launcher diagnostics and nested command output are not activity. Zero
+     *  means no recognized item was retained, not that the participant succeeded. */
+    participantItems: number;
+}
+/**
+ * Read participant text from the raw stdout as the recorder receives it. Source redaction runs on
+ * the stored stream and can cut through JSON framing (a redacted URL takes the closing quote with
+ * it), so each line is parsed here, in memory, and only decoded text that has passed `sanitize`
+ * is kept. The raw bytes are never stored.
+ */
+export declare function createTerminalParticipantReader(sanitize: (text: string) => string): {
+    append(raw: string): void;
+    finish(): TerminalParticipantText;
+};

package/dist/routes/terminal/participant-text.js

@@ -0,0 +1,165 @@
+import { normalizeLocalActorTranscript } from "../../run/terminal-contract.js";
+import { MESSAGE_CHARS, PENDING_LINE_CHARS, TEXT_ITEMS_BYTES, TEXT_ITEMS_MAX } from "./types.js";
+const itemEvents = new Set(["item.started", "item.updated", "item.completed"]);
+const nonempty = (value) => typeof value === "string" && value.trim().length > 0;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Each Codex item event in a run of complete JSON lines, in stream order. */
+function* codexStreamItems(lines) {
+    for (const line of lines.split("\n")) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!object(event) ||
+            typeof event.type !== "string" ||
+            !itemEvents.has(event.type) ||
+            !object(event.item) ||
+            !nonempty(event.item.id))
+            continue;
+        yield { event: event.type, id: event.item.id, item: event.item };
+    }
+}
+function isParticipantItem(item) {
+    return (((item.type === "agent_message" || item.type === "reasoning") && nonempty(item.text)) ||
+        (item.type === "command_execution" && nonempty(item.command)) ||
+        (item.type === "web_search" &&
+            (nonempty(item.query) || (object(item.action) && nonempty(item.action.type)))) ||
+        (item.type === "file_change" &&
+            Array.isArray(item.changes) &&
+            item.changes.some((change) => object(change) && nonempty(change.path) && nonempty(change.kind))));
+}
+// The verdict parser removes all whitespace before matching, so a line is a marker line when its
+// whitespace-free form names either marker. The parser reads the stored stream, not these items.
+const MARKER = /HUMANISH_ACTOR_(?:VERDICT|NONCE)=/i;
+const withoutMarkerLines = (text) => text
+    .split("\n")
+    .filter((line) => !MARKER.test(line.replace(/\s+/g, "")))
+    .join("\n");
+/**
+ * Read participant text from the raw stdout as the recorder receives it. Source redaction runs on
+ * the stored stream and can cut through JSON framing (a redacted URL takes the closing quote with
+ * it), so each line is parsed here, in memory, and only decoded text that has passed `sanitize`
+ * is kept. The raw bytes are never stored.
+ */
+export function createTerminalParticipantReader(sanitize) {
+    let pending = "";
+    // Set while the rest of an over-long line is skipped, up to its newline.
+    let skipping = false;
+    let droppedLines = 0;
+    const participantIds = new Set();
+    const messageIds = new Set();
+    const done = new Set();
+    // Completed or left-out items; later events for them are ignored.
+    const closed = new Set();
+    const texts = new Map();
+    const numbers = { message: 0, reasoning: 0 };
+    let left = 0;
+    let result;
+    const take = (lines) => {
+        for (const { event, id, item } of codexStreamItems(normalizeLocalActorTranscript(lines))) {
+            if (isParticipantItem(item))
+                participantIds.add(id);
+            const kind = item.type === "agent_message" ? "message" : item.type === "reasoning" ? "reasoning" : null;
+            if (kind === null || !nonempty(item.text) || closed.has(id))
+                continue;
+            if (kind === "message")
+                messageIds.add(id);
+            if (event === "item.completed") {
+                done.add(id);
+                closed.add(id);
+            }
+            // Redact the decoded text before cutting it, so a cut cannot split a value past the patterns.
+            const clean = [...sanitize(withoutMarkerLines(item.text))];
+            const text = (clean.length > MESSAGE_CHARS ? clean.slice(0, MESSAGE_CHARS) : clean).join("");
+            const previous = texts.get(id);
+            if (!text.trim()) {
+                texts.delete(id);
+                continue;
+            }
+            texts.set(id, { kind, number: previous?.number ?? ++numbers[kind], text });
+            // The oldest item beyond the count limit is left out as the stream arrives, finished or not,
+            // so a long stream cannot hold every message in memory.
+            if (texts.size > TEXT_ITEMS_MAX) {
+                const oldest = texts.keys().next().value;
+                texts.delete(oldest);
+                closed.add(oldest);
+                left += 1;
+            }
+        }
+    };
+    return {
+        append(raw) {
+            if (result)
+                return;
+            if (skipping) {
+                const end = raw.indexOf("\n");
+                if (end < 0)
+                    return;
+                skipping = false;
+                raw = raw.slice(end + 1);
+            }
+            pending += raw;
+            const end = pending.lastIndexOf("\n");
+            if (end >= 0) {
+                take(pending.slice(0, end));
+                pending = pending.slice(end + 1);
+            }
+            // A line with no newline in sight is dropped, so one runaway line cannot grow without bound.
+            if (pending.length > PENDING_LINE_CHARS) {
+                pending = "";
+                skipping = true;
+                droppedLines += 1;
+            }
+        },
+        finish() {
+            if (result)
+                return result;
+            if (!skipping)
+                take(pending);
+            pending = "";
+            const entries = [...texts.entries()];
+            let start = entries.length;
+            let bytes = 0;
+            while (start > 0 && entries.length - start < TEXT_ITEMS_MAX) {
+                const size = Buffer.byteLength(entries[start - 1][1].text);
+                if (bytes + size > TEXT_ITEMS_BYTES)
+                    break;
+                bytes += size;
+                start -= 1;
+            }
+            left += start;
+            const kept = entries.slice(start);
+            const items = kept.map(([source, { kind, number, text }]) => ({
+                id: `${kind}-${String(number).padStart(3, "0")}`,
+                kind,
+                lifecycle: done.has(source) ? "completed" : "started",
+                title: kind === "message" ? "agent message" : "agent reasoning",
+                text,
+            }));
+            const notices = [];
+            if (left > 0)
+                notices.push([
+                    "agent text truncated",
+                    `Kept the last ${kept.length} of ${kept.length + left} agent message and reasoning items, within ${TEXT_ITEMS_MAX} items and ${TEXT_ITEMS_BYTES / 1024} KiB. The terminal transcript keeps the captured stream.`,
+                ]);
+            if (droppedLines > 0)
+                notices.push([
+                    "agent output lines skipped",
+                    `Skipped ${droppedLines} stdout line(s) that ran past ${PENDING_LINE_CHARS} characters without a newline. Items on those lines are not in this trace or its counts.`,
+                ]);
+            notices.forEach(([title, text], index) => items.push({
+                id: `notice-${String(index + 1).padStart(3, "0")}`,
+                kind: "notice",
+                lifecycle: "completed",
+                status: "truncated",
+                title,
+                text,
+            }));
+            result = { items, messages: messageIds.size, participantItems: participantIds.size };
+            return result;
+        },
+    };
+}

package/dist/routes/terminal/persona.js

@@ -10,7 +10,7 @@ import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 export async function resolveTerminalPersona(args) {
     const personaId = args.plan.personaId ?? "autonomous-terminal-agent";
     const physicalCwd = await realpath(args.cwd);
-    // Resolve the committed persona so its traits actually shape the agent prompt (#308); fail-safe to
+    // Resolve the committed persona so its traits actually shape the agent prompt; fail-safe to
     // the bare persona id (no traits applied) when no persona file is committed.
     const projectRoot = await prepareSelectedOutputDirectory(path.dirname(physicalCwd), physicalCwd);
     const { persona, warnings } = await resolveCommittedPersona(projectRoot, personaId);

package/dist/routes/terminal/plan.d.ts

@@ -1,6 +1,5 @@
 import type { RoutePlanResult, RouteRefusal, TerminalPlan } from "../../lab/plan-types.js";
 import type { LabConfig } from "../../lab/types.js";
-import type { RunLabProvenance } from "../../run/status.js";
 import { type TerminalProductLabResult } from "./types.js";
 /** The error a terminal lab returns before a run starts. `actor` names the registered actor. */
 export interface TerminalRefusal extends RouteRefusal<"terminal", NonNullable<TerminalProductLabResult["error"]>["code"]> {
@@ -13,9 +12,6 @@ export type TerminalPlanResult = RoutePlanResult<TerminalPlan, TerminalRefusal>;
  */
 export declare function planTerminalLab(config: LabConfig, input: {
     readonly dryRun: boolean;
-    readonly lab?: RunLabProvenance;
-    /** A caller's costProbe can measure spend lines, so a positive maxUsd can trip. */
-    readonly hooks?: {
-        readonly costProbe?: unknown;
-    };
+    /** A test's costProbe can measure spend lines, so a positive maxUsd can trip. */
+    readonly hasCostProbe?: boolean;
 }): TerminalPlanResult;

package/dist/routes/terminal/plan.js

@@ -1,6 +1,7 @@
 // The terminal route's plan: every configuration refusal the route makes before a run starts, in
 // its order and with its codes, then the plan the run uses. The route checks nothing here again;
 // what stays in the route reads external state (keys, the runtime env, the sandbox).
+import { DEFAULT_OPENAI_CU_MODEL } from "../../actors/computer-use/openai-provider.js";
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { isReasoningEffort } from "../../actors/reasoning-effort.js";
 import { actorRegistry, isTerminalActorDescriptor } from "../../actors/registry.js";
@@ -21,34 +22,33 @@ export function planTerminalLab(config, input) {
         refusal: { route: "terminal", code, message, ...(actor === undefined ? {} : { actor }) },
     });
     if (String(config.comms?.email?.kind) === "real")
-        return refuse("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", "Real email receiving is unsupported on the terminal route. Use a supported hosted computer-use browser lab.");
+        return refuse("HUMANISH_TERMINAL_SUBJECT_INVALID", "Real email receiving is unsupported on the terminal route. Use a supported hosted computer-use browser lab.");
     const mediaReason = desktopMediaValidationReason(config);
     if (mediaReason)
-        return refuse("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", mediaReason);
+        return refuse("HUMANISH_TERMINAL_SUBJECT_INVALID", mediaReason);
     const analysis = resolveAutomaticAnalysis(config.review?.analysis);
     if (!analysis.ok)
-        return refuse("HUMANISH_LAB_ANALYSIS_INVALID", analysis.message);
+        return refuse("HUMANISH_STUDY_ANALYSIS_INVALID", analysis.message);
     const tasksReason = taskProtocolValidationReason(config, false);
     if (tasksReason)
-        return refuse("HUMANISH_LAB_TASKS_UNSUPPORTED", tasksReason);
+        return refuse("HUMANISH_STUDY_TASKS_UNSUPPORTED", tasksReason);
     const actorType = config.actors[0]?.type ?? "";
     const descriptor = actorRegistry[actorType];
     if (!descriptor || !isTerminalActorDescriptor(descriptor))
-        return refuse("HUMANISH_TERMINAL_LAB_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered terminal actor.`);
+        return refuse("HUMANISH_TERMINAL_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered terminal actor.`);
     const runtimeVersion = config.execution?.runtime?.version;
     const actor = config.actors[0];
     if ((config.execution?.runtime !== undefined && !isExactRuntimeVersion(runtimeVersion)) ||
         (actor?.model !== undefined &&
             (typeof actor.model !== "string" || actor.model.trim().length === 0)) ||
         (actor?.reasoningEffort !== undefined && !isReasoningEffort(actor.reasoningEffort)))
-        return refuse("HUMANISH_TERMINAL_LAB_FAILED", "Terminal runtime settings require an exact Codex version, a nonempty model when declared, and a supported reasoning-effort value.");
+        return refuse("HUMANISH_TERMINAL_FAILED", "Terminal runtime settings require an exact Codex version, a nonempty model when declared, and a supported reasoning-effort value.");
     const product = config.subject.product;
     const surfaces = product?.publicSurfaces ?? [];
     if (!product || !product.name || !isNonEmpty(surfaces))
-        return refuse("HUMANISH_TERMINAL_LAB_SUBJECT_INVALID", "terminal-product subjects require `subject.product` with a name and at least one public surface URL.", descriptor.id);
+        return refuse("HUMANISH_TERMINAL_SUBJECT_INVALID", "terminal-product subjects require `subject.product` with a name and at least one public surface URL.", descriptor.id);
     const base = planBase(config, {
         dryRun: input.dryRun,
-        ...(input.lab === undefined ? {} : { lab: input.lab }),
         analysis,
     });
     const egressAllow = config.execution?.egressAllow;
@@ -62,7 +62,11 @@ export function planTerminalLab(config, input) {
         ...(actor?.mission === undefined ? {} : { mission: actor.mission }),
         runtime: {
             ...(runtimeVersion === undefined ? {} : { version: runtimeVersion }),
-            ...(actor?.model === undefined ? {} : { model: actor.model }),
+            // Codex's own default can change with any release and its JSON stream does not name it, so
+            // the route always passes a model: the declared one, else humanish's participant default.
+            ...(actor?.model === undefined
+                ? { model: DEFAULT_OPENAI_CU_MODEL, modelSource: "humanish_default" }
+                : { model: actor.model, modelSource: "declared" }),
             ...(actor?.reasoningEffort === undefined ? {} : { reasoningEffort: actor.reasoningEffort }),
             ...(config.execution?.runtimeAuth === undefined
                 ? {}
@@ -74,23 +78,23 @@ export function planTerminalLab(config, input) {
     const caps = config.scenario?.caps;
     if (input.dryRun)
         return { ok: true, plan: { ...shared, dryRun: true, ...(caps ? { caps } : {}) } };
-    // The live lane injects the runtime key into one command only, and only a registered actor
+    // The live route injects the runtime key into one command only, and only a registered actor
     // that declares that placement may run live.
     const keyPlacement = descriptor.capabilities.keyPlacement;
     if (keyPlacement !== "in-sandbox-command-scoped")
-        return refuse("HUMANISH_TERMINAL_LAB_KEYPLACEMENT_INVALID", `Terminal actor "${descriptor.id}" must declare keyPlacement "in-sandbox-command-scoped" for a live run (got "${String(keyPlacement)}"). The engine requires this registered default before applying the declared runtime-auth mode.`, descriptor.id);
+        return refuse("HUMANISH_TERMINAL_KEYPLACEMENT_INVALID", `Terminal actor "${descriptor.id}" must declare keyPlacement "in-sandbox-command-scoped" for a live run (got "${String(keyPlacement)}"). The engine requires this registered default before applying the declared runtime-auth mode.`, descriptor.id);
     // A live run grants the in-sandbox agent provider access, so a fail-closed cap must be in force.
     const maxUsd = caps?.maxUsd;
     const maxMinutes = caps?.maxMinutes;
     if (caps === undefined || maxUsd === undefined || maxMinutes === undefined || maxMinutes <= 0)
-        return refuse("HUMANISH_TERMINAL_LAB_CAPS_MISSING", "A live terminal-product run grants provider access to the in-sandbox agent and so REQUIRES a fail-closed cap: scenario.caps with maxUsd (0 = no-spend) and a positive maxMinutes (the codex command's wall-clock kill). The live key is never exercised without a cap in force.", descriptor.id);
+        return refuse("HUMANISH_TERMINAL_CAPS_MISSING", "A live terminal-product run gives the agent in the sandbox access to a model provider, so it needs a cap: set scenario.caps with maxUsd (0 means no spend) and a positive maxMinutes (the time limit for the codex command). The key is used only while the cap is in force.", descriptor.id);
     // maxUsd is checked against the cost ledger after the session, and only known lines can trip it.
-    // Core records the Codex provider line as unpriced tokens (no rate for model `codex`) and has no
-    // product, media or payment signal, so without a costProbe every line is null and a positive
-    // maxUsd could never trip. That cap would promise a bound nothing enforces, so it is refused;
-    // maxMinutes is what bounds a live run.
-    if (maxUsd > 0 && input.hooks?.costProbe === undefined)
-        return refuse("HUMANISH_TERMINAL_LAB_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: the Codex participant's provider spend is recorded as unpriced tokens and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
+    // The ledger's provider line takes only provider-reported cost, which Codex does not report (the
+    // token estimate in run.json is not a measurement), and core has no product, media or payment
+    // signal, so without a costProbe every line is null and a positive maxUsd could never trip. That
+    // cap would promise a bound nothing enforces, so it is refused; maxMinutes bounds a live run.
+    if (maxUsd > 0 && input.hasCostProbe !== true)
+        return refuse("HUMANISH_TERMINAL_UNPRICED_CAP", `scenario.caps.maxUsd=${maxUsd} cannot be enforced: Codex reports no provider cost for the participant (its token cost is only estimated after the run) and no product, media or payment spend is measured, so a positive dollar cap can never trip. Set scenario.caps.maxUsd to 0 and bound the run with scenario.caps.maxMinutes, the codex command's wall-clock kill. No sandbox was created and the runtime key was not used.`, descriptor.id);
     // The sandbox's timeout covers the steps before the codex command, maxMinutes and the teardown
     // buffer, and E2B refuses a sandbox over an hour. Refuse here, with the arithmetic, rather than
     // after the plan prints, from a provider 400 that names neither knob.
@@ -98,7 +102,7 @@ export function planTerminalLab(config, input) {
     const sandboxTimeoutMs = terminalSandboxTimeoutMs({ maxMinutes, productInstall });
     if (sandboxTimeoutMs > MAX_SANDBOX_MS) {
         const headroomMinutes = (sandboxTimeoutMs - maxMinutes * 60_000) / 60_000;
-        return refuse("HUMANISH_TERMINAL_LAB_CAPS_INVALID", `scenario.caps.maxMinutes ${maxMinutes} derives a ${sandboxTimeoutMs / 60_000}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is maxMinutes plus ${headroomMinutes}m: the Node bootstrap (${NODE_BOOTSTRAP_TIMEOUT_MS / 60_000}m), the runtime version check (${TERMINAL_RUNTIME_VERSION_TIMEOUT_MS / 60_000}m)${productInstall ? `, the product setup (${PRODUCT_SETUP_TIMEOUT_MS / 60_000}m)` : ""} and the teardown buffer (${TERMINAL_SANDBOX_TIMEOUT_BUFFER_MS / 60_000}m). Lower scenario.caps.maxMinutes to at most ${MAX_SANDBOX_MS / 60_000 - headroomMinutes}. No sandbox was created and the runtime key was not used.`, descriptor.id);
+        return refuse("HUMANISH_TERMINAL_CAPS_INVALID", `scenario.caps.maxMinutes ${maxMinutes} derives a ${sandboxTimeoutMs / 60_000}m sandbox deadline, and a sandbox may not live longer than ${MAX_SANDBOX_MS / 60_000}m. The deadline is maxMinutes plus ${headroomMinutes}m: the Node bootstrap (${NODE_BOOTSTRAP_TIMEOUT_MS / 60_000}m), the runtime version check (${TERMINAL_RUNTIME_VERSION_TIMEOUT_MS / 60_000}m)${productInstall ? `, the product setup (${PRODUCT_SETUP_TIMEOUT_MS / 60_000}m)` : ""} and the teardown buffer (${TERMINAL_SANDBOX_TIMEOUT_BUFFER_MS / 60_000}m). Lower scenario.caps.maxMinutes to at most ${MAX_SANDBOX_MS / 60_000 - headroomMinutes}. No sandbox was created and the runtime key was not used.`, descriptor.id);
     }
     return {
         ok: true,

package/dist/routes/terminal/recorder.d.ts

@@ -1,7 +1,8 @@
 import { type CommandLogRecord, type InterventionRecord, type LifecycleRecord, type TerminalEventRecord } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export declare function createTerminalRecorder(args: {
     nowIso: () => string;
@@ -17,6 +18,10 @@ export declare function createTerminalRecorder(args: {
         stderr: string;
         combined: string;
     };
+    participantText: {
+        append(raw: string): void;
+        finish(): import("./participant-text.js").TerminalParticipantText;
+    };
     recordLifecycle: (event: string, message: string) => void;
     recordStreamedTerminalChunk: (stream: "stdout" | "stderr", raw: string) => void;
     appendReturnedTerminalOutput: (stream: "stdout" | "stderr", raw: string) => void;

package/dist/routes/terminal/recorder.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import { createTerminalParticipantReader } from "./participant-text.js";
 import { MAX_TRANSCRIPT_BYTES, } from "./types.js";
 /**
  * The terminal run's ledgers and capture buffers, mutated through the live lifecycle. Every chunk
- * is scrubbed and redacted as it is stored; raw bytes never leave the append functions.
+ * is scrubbed and redacted as it is stored. Raw bytes leave the append functions only for the
+ * in-memory participant reader, which keeps sanitized decoded text.
  */
 export function createTerminalRecorder(args) {
     const { nowIso, sanitize, knownSecretValues } = args;
@@ -13,7 +15,9 @@ export function createTerminalRecorder(args) {
     // cross-chunk redaction below; this overlap is never added to terminal events/artifacts.
     const discardedPrefixes = { stdout: "", stderr: "", combined: "" };
     const maxDiscardedPrefixChars = Math.max(0, ...knownSecretValues.map((value) => value.length - 1));
-    const interventions = []; // ALWAYS empty while no assisted-input path ships.
+    const interventions = []; // Always empty while no assisted-input path ships.
+    // Reads the agent's text from the raw stdout in memory; it keeps only sanitized decoded text.
+    const participantText = createTerminalParticipantReader(sanitize);
     let transcriptBytes = 0;
     const recordLifecycle = (event, message) => {
         lifecycle.push({ at: nowIso(), event, message: sanitize(message) });
@@ -28,10 +32,13 @@ export function createTerminalRecorder(args) {
             return;
         }
         transcriptBytes += Buffer.byteLength(raw, "utf8");
-        // Scrub THEN redact at the SOURCE — raw bytes never leave this function (safety contract item 5).
+        // Scrub, then redact, at the source. Only the participant reader below
+        // sees the raw bytes, and it stores none of them.
         terminalEvents.push({ at: nowIso(), stream, chunk: sanitize(raw) });
+        if (stream === "stdout")
+            participantText.append(raw);
     };
-    // E2B can stream every byte through callbacks AND return the same complete output (#667).
+    // E2B can stream every byte through callbacks and return the same complete output.
     // Track transport delivery, independently per stream, rather than deduplicating participant
     // lines or equal usage records. Hash raw callback bytes before redaction/truncation so the
     // comparison cannot confuse two values that redact identically or lose capped-away delivery.
@@ -70,6 +77,7 @@ export function createTerminalRecorder(args) {
         terminalEvents,
         interventions,
         discardedPrefixes,
+        participantText,
         recordLifecycle,
         recordStreamedTerminalChunk,
         appendReturnedTerminalOutput,