humanish 0.109.0 → 0.110.0

package/dist/evidence/redaction.d.ts

@@ -2,6 +2,21 @@
 export declare function sensitivePatterns(): readonly RegExp[];
 /** True if the text contains any secret-shaped token or known local path. */
 export declare function containsSensitive(text: string): boolean;
+/**
+ * What a shared copy of a run says in place of a provider sandbox id. scripts/public-surface-scan.mjs
+ * passes only this value at a sandbox-id key.
+ */
+export declare const REDACTED_SANDBOX_ID = "[redacted-sandbox-id]";
+/** A sandbox id's public stand-in: its digest matches a receipt without naming the sandbox. */
+export declare function sandboxIdDigest(id: string): string;
+/** The raw ids at the keys redactSandboxIds replaces, anywhere in `value`. */
+export declare function collectSandboxIds(value: unknown, into?: Set<string>): Set<string>;
+/**
+ * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID plus its digest: strings at
+ * `sandboxId` and `subjectSandboxId`, and the `id` of each `providerResources` or `resources` entry. Raw ids live
+ * only in a run's sandbox-receipts.ndjson; every record and output names a sandbox by digest.
+ */
+export declare function redactSandboxIds(value: unknown): unknown;
 /** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */
 export declare function redactText(text: string): string;
 /** Redact every sensitive match (secrets and paths) to a single [REDACTED_SECRET] label. */

package/dist/evidence/redaction.js

@@ -55,6 +55,93 @@ export function containsSensitive(text) {
 function redactLocalPaths(text, label) {
     return LOCAL_PATH_PATTERNS.reduce((current, [pattern, replacement]) => current.replace(pattern, (match) => (label ?? replacement) + (match.match(/\\+$/)?.[0] ?? "")), text);
 }
+/**
+ * What a shared copy of a run says in place of a provider sandbox id. scripts/public-surface-scan.mjs
+ * passes only this value at a sandbox-id key.
+ */
+export const REDACTED_SANDBOX_ID = "[redacted-sandbox-id]";
+/** The keys run writers put a sandbox id under; resource entries hold one as `id`. */
+const SANDBOX_ID_KEYS = new Set(["sandboxId", "subjectSandboxId"]);
+/** Arrays of sandbox records: run.json's `providerResources` and cleanup.json's `resources`. */
+const RESOURCE_ARRAY_KEYS = new Set(["providerResources", "resources"]);
+/** A sandbox id's public stand-in: its digest matches a receipt without naming the sandbox. */
+export function sandboxIdDigest(id) {
+    return digestText(id, 16);
+}
+/** The digest field written beside a redacted id: `idDigest`, `sandboxIdDigest`, … */
+const digestKey = (key) => `${key}Digest`;
+/**
+ * The entries of `object` with each raw id at one of `keys` replaced by REDACTED_SANDBOX_ID and its
+ * digest written beside it, unless the object already records one.
+ */
+function redactIdEntries(object, keys) {
+    const entries = Object.entries(object);
+    const present = new Set(entries.map(([key]) => key));
+    return entries.flatMap(([key, child]) => {
+        if (!keys.has(key) || typeof child !== "string" || child === REDACTED_SANDBOX_ID)
+            return [[key, child]];
+        // A label that a text scrub left at the key already carries the id's digest.
+        const digest = SANDBOX_ID_LABEL.exec(child)?.[1] ?? sandboxIdDigest(child);
+        return [
+            [key, REDACTED_SANDBOX_ID],
+            ...(present.has(digestKey(key)) ? [] : [[digestKey(key), digest]]),
+        ];
+    });
+}
+/** How free text names a sandbox: the marker with the id's digest inside it. */
+const SANDBOX_ID_LABEL = /^\[redacted-sandbox-id ([0-9a-f]{16})\]$/;
+const RESOURCE_ID_KEYS = new Set(["id"]);
+/** A raw id at a sandbox-id key: neither the marker nor a label that names its digest. */
+const isRawSandboxId = (value) => typeof value === "string" && value !== REDACTED_SANDBOX_ID && !SANDBOX_ID_LABEL.test(value);
+/** The raw ids at the keys redactSandboxIds replaces, anywhere in `value`. */
+export function collectSandboxIds(value, into = new Set()) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSandboxIds(item, into);
+        return into;
+    }
+    if (value === null || typeof value !== "object")
+        return into;
+    for (const [key, child] of Object.entries(value)) {
+        if (SANDBOX_ID_KEYS.has(key) && isRawSandboxId(child))
+            into.add(child);
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            for (const resource of child) {
+                const id = resource !== null && typeof resource === "object" ? Reflect.get(resource, "id") : null;
+                if (isRawSandboxId(id))
+                    into.add(id);
+            }
+        collectSandboxIds(child, into);
+    }
+    return into;
+}
+/**
+ * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID plus its digest: strings at
+ * `sandboxId` and `subjectSandboxId`, and the `id` of each `providerResources` or `resources` entry. Raw ids live
+ * only in a run's sandbox-receipts.ndjson; every record and output names a sandbox by digest.
+ */
+export function redactSandboxIds(value) {
+    if (Array.isArray(value)) {
+        const items = value.map(redactSandboxIds);
+        return items.every((item, index) => item === value[index]) ? value : items;
+    }
+    if (value === null || typeof value !== "object")
+        return value;
+    // fromEntries keeps a key such as __proto__ an own property, as JSON.parse made it.
+    const entries = redactIdEntries(value, SANDBOX_ID_KEYS).map(([key, child]) => {
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            return [
+                key,
+                child.map((resource) => resource !== null && typeof resource === "object" && !Array.isArray(resource)
+                    ? Object.fromEntries(redactIdEntries(redactSandboxIds(resource), RESOURCE_ID_KEYS))
+                    : redactSandboxIds(resource)),
+            ];
+        return [key, redactSandboxIds(child)];
+    });
+    const changed = entries.length !== Object.keys(value).length ||
+        entries.some(([key, child]) => child !== value[key]);
+    return changed ? Object.fromEntries(entries) : value;
+}
 /** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */
 export function redactText(text) {
     const withoutSecrets = SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, "[REDACTED_SECRET]"), text);

package/dist/feedback/export-bundle.js

@@ -8,7 +8,8 @@ import { parse as parseYaml } from "yaml";
 import { ACTOR_TRACE_SCHEMA } from "../actors/contract.js";
 import { renderObserver } from "../observer/render.js";
 import { buildObserverData } from "../observer/data.js";
-import { containsSensitive, redactScreenshot, redactText } from "../evidence/redaction.js";
+import { inventorySandboxIds, scrubSandboxIdBytes } from "../run/sandbox-ids.js";
+import { containsSensitive, redactSandboxIds, redactScreenshot, redactText, } from "../evidence/redaction.js";
 import { decodeEscapes } from "../evidence/encoded-text.js";
 import { readPlainText } from "../evidence/plain-text.js";
 import { streamScreenshotPaths } from "../verify/artifacts.js";
@@ -224,7 +225,8 @@ function transformText(file, imagePaths) {
         const parsed = JSON.parse(text);
         // Parsing also resolves escape sequences in string values before inspection.
         assertNoInlineRaster(JSON.stringify(parsed));
-        const transformed = updateScreenshotDeclarations(parsed, imagePaths);
+        // The copy names no sandbox: an id is local operational evidence, and the copy is shared.
+        const transformed = redactSandboxIds(updateScreenshotDeclarations(parsed, imagePaths));
         if (JSON.stringify(transformed) === JSON.stringify(parsed))
             return file.bytes;
         assertRewritableNumbers(text);
@@ -237,7 +239,7 @@ function transformText(file, imagePaths) {
                 return line;
             const parsed = JSON.parse(line);
             assertNoInlineRaster(JSON.stringify(parsed));
-            const updated = JSON.stringify(updateScreenshotDeclarations(parsed, imagePaths));
+            const updated = JSON.stringify(redactSandboxIds(updateScreenshotDeclarations(parsed, imagePaths)));
             if (updated === JSON.stringify(parsed))
                 return line;
             assertRewritableNumbers(line);
@@ -299,6 +301,7 @@ function keptPngPaths(source, bundle) {
 async function writeDerivative(source, stagePaths, bundle) {
     const entries = [];
     const imagePaths = keptPngPaths(source, bundle);
+    const sandboxIds = inventorySandboxIds(source.files);
     let images = 0;
     for (const file of source.files) {
         const isPng = path.extname(file.path).toLowerCase() === ".png";
@@ -329,7 +332,7 @@ async function writeDerivative(source, stagePaths, bundle) {
             bytes = transformText(file, imagePaths);
             if (file.path === "run.json") {
                 assertRewritableNumbers(file.bytes.toString("utf8"));
-                const transformed = updateScreenshotDeclarations(bundle, imagePaths);
+                const transformed = redactSandboxIds(updateScreenshotDeclarations(bundle, imagePaths));
                 transformed.redaction = {
                     status: "passed",
                     notes: `${bundle.redaction.notes} Exported copy: screenshots were blurred during export; the original capture is retained separately. See derivation.json.`,
@@ -342,6 +345,7 @@ async function writeDerivative(source, stagePaths, bundle) {
                 }
                 bytes = jsonBytes(transformed);
             }
+            bytes = scrubSandboxIdBytes(file.path, bytes, sandboxIds);
             action = bytes.equals(file.bytes) ? "copied" : "updated";
         }
         await writeContainedOutputFile(stagePaths, file.path, bytes);
@@ -495,7 +499,9 @@ async function verifyFrozenSource(workspace, source, runId) {
                 verified.shareSafety.reasons.every(
                 // Both are repaired in the copy: frames are blurred, and an unread PNG is dropped or
                 // refused by keptPngPaths. Any other unread file fails as an unsupported format.
-                (reason) => reason.code === "RAW_SCREENSHOTS" || reason.code === "UNSCANNED_ARTIFACT")))) {
+                (reason) => reason.code === "RAW_SCREENSHOTS" ||
+                    reason.code === "RAW_SANDBOX_ID" ||
+                    reason.code === "UNSCANNED_ARTIFACT")))) {
         return { shareSafety: verified.shareSafety };
     }
     const loaded = await loadRunBundlePrepared(rawSnapshot.physicalPath, snapshotPaths);

package/dist/feedback/export.js

@@ -384,6 +384,9 @@ function shareSafetyRemedy(codes) {
     if (codes.includes("RAW_SCREENSHOTS")) {
         steps.push("Re-run with policies.redactScreenshots: true to blur screenshots at capture.");
     }
+    if (codes.includes("RAW_SANDBOX_ID")) {
+        steps.push("Export with --format bundle --redact-screenshots, which writes a copy without raw sandbox ids, and share from that copy.");
+    }
     if (codes.includes("UNSCANNED_ARTIFACT")) {
         steps.push("verify cannot read the files that `humanish verify --json` lists under UNSCANNED_ARTIFACT as text: remove them from the run folder, or keep only images an actor trace references as stream screenshots.");
     }

package/dist/keys/key-resolution.d.ts

@@ -22,6 +22,11 @@ export declare function discoverProviderKeys(args: {
     deps?: KeyResolutionDeps;
     announced?: ReadonlySet<string>;
 }): Promise<ResolvedKeyFill[]>;
+/** What `--dotenv` loaded: the path as given, and the names it set because they were unset. */
+export interface DotenvLoad {
+    path: string;
+    names: readonly string[];
+}
 export interface KeySourceProbe {
     name: string;
     /** The source that supplies the key right now, or null when missing everywhere. */
@@ -43,6 +48,8 @@ export declare function probeKeySources(names: readonly string[], args: {
     cwd: string;
     env: NodeJS.ProcessEnv;
     deps?: KeyResolutionDeps;
+    /** The names `--dotenv` put into `env`, so their rows name the file, not the process env. */
+    dotenv?: DotenvLoad;
 }): Promise<KeySourceProbe[]>;
 /** Resolve a `humanish keys set` target: a vendor alias or a raw env name. Null = invalid. */
 export declare function resolveKeyName(vendorOrName: string): string | null;

package/dist/keys/key-resolution.js

@@ -1,8 +1,8 @@
 // Provider-key discovery: resolve the keys a live run needs through each vendor's
-// native chain instead of demanding a per-repo --env-file that operators hand-copy keys into.
+// native chain instead of demanding a per-repo --dotenv that operators hand-copy keys into.
 //
 // The chain, per key, fill-only (a rung never overrides anything already present):
-//   1. process env, including whatever --env-file just loaded (explicit always wins);
+//   1. process env, including whatever --dotenv just loaded (explicit always wins);
 //   2. `.humanish/local/provider.env`, the project-local overlay this CLI's own --help
 //      examples document;
 //   3. the owning vendor's native store, where one exists:
@@ -24,7 +24,7 @@ import { loadEnvFile } from "./env-file.js";
 /** The only names implicit discovery may fill (and `humanish keys set` may store). Everything
  *  else in an overlay/store file is ignored-and-named: a repo-planted NODE_OPTIONS/LD_PRELOAD
  *  must never enter process env off a file the operator did not explicitly pass (an explicit
- *  --env-file remains the operator's own full-file load). */
+ *  --dotenv remains the operator's own full-file load). */
 const KNOWN_PROVIDER_KEYS = [
     "OPENAI_API_KEY",
     "ANTHROPIC_API_KEY",
@@ -213,7 +213,7 @@ export async function discoverProviderKeys(args) {
         if (announced === undefined || announced.has(fill_.name))
             announce(`humanish keys: ${fill_.name} from ${fill_.source}`);
     for (const name of ignored)
-        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --env-file to load every name in it.`);
+        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --dotenv to load every name in it.`);
     return fills;
 }
 /** True when the file's parent directory is (or traverses) a symlink at its last component:
@@ -253,7 +253,7 @@ export function describeMissingKeys(names, env) {
     const hints = names.map((name) => `${name}: ${missingKeyHint(name)}`).join("; ");
     const strict = env.HUMANISH_STRICT_KEYS?.trim() === "1";
     const chain = strict
-        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --env-file are read"
+        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --dotenv are read"
         : `also checked ${PROJECT_OVERLAY_RELATIVE}, ~/.e2b/config.json, gh auth token, and ${path.join("~", ".config", "humanish", "keys.env")}`;
     return `${chain}. Fill: ${hints}.`;
 }
@@ -278,7 +278,9 @@ export async function probeKeySources(names, args) {
             args.env.GITHUB_TOKEN !== undefined &&
             args.env.GITHUB_TOKEN.trim() !== "";
         const source = inEnv
-            ? "process env"
+            ? args.dotenv?.names.includes(name)
+                ? `--dotenv ${args.dotenv.path}`
+                : "process env"
             : aliasInEnv
                 ? "process env (GITHUB_TOKEN)"
                 : (bySource.get(name) ?? null);
@@ -307,7 +309,7 @@ export function setUserKey(name, value, env, deps = {}) {
         throw new Error(`Not a valid env name: ${name}`);
     }
     if (!PROVIDER_KEY_SET.has(name)) {
-        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --env-file.`);
+        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --dotenv.`);
     }
     const storePath = userKeyStorePath(env, deps);
     const dir = path.dirname(storePath);
@@ -325,7 +327,7 @@ export function setUserKey(name, value, env, deps = {}) {
     // would silently resolve to a different secret on the next run.
     const roundTrip = parseStoreLine(`${name}=${trimmed}`);
     if (roundTrip === null || roundTrip[0] !== name || roundTrip[1] !== trimmed) {
-        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --env-file instead.");
+        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --dotenv instead.");
     }
     writeStore(storePath, entries);
     return { path: storePath };

package/dist/routes/computer-use/in-process-desktop.js

@@ -20,7 +20,7 @@ export function createInProcessDesktop(deps) {
                 throw new Error("The participant desktop must be prepared and may only be opened once, before finalization.");
             opened = true;
             if (deps.inProcessExecutor === undefined)
-                throw new Error("The in-process route needs RunLabOptions.inProcess.");
+                throw new Error("The in-process route needs RunStudyOptions.inProcess.");
             return { executor: await deps.inProcessExecutor(deps.appUrl) };
         },
         finalize() {

package/dist/routes/computer-use/live-phase.d.ts

@@ -27,6 +27,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
         };
         sandbox?: {
             sandboxId: string;
+            sandboxIdDigest?: string;
             killed: boolean;
             streamUrlPresent: boolean;
         };

package/dist/routes/computer-use/plan.js

@@ -159,7 +159,7 @@ function driverReason(driving, { localAppSubject, inProcessRoute }) {
     if (driving.inProcess && !driving.createProvider)
         return {
             code: "HUMANISH_COMPUTER_USE_EXECUTOR_NO_PROVIDER",
-            message: "RunLabOptions.inProcess needs RunLabOptions.createProvider: an in-process executor returns no screenshot, so it needs a provider that does not read images. The default OpenAI computer-use provider reads screenshots and would stop the session.",
+            message: "RunStudyOptions.inProcess needs RunStudyOptions.createProvider: an in-process executor returns no screenshot, so it needs a provider that does not read images. The default OpenAI computer-use provider reads screenshots and would stop the session.",
         };
     // There is no built-in in-process driver for a local app.
     if (localAppSubject && !inProcessRoute)
@@ -233,7 +233,7 @@ export function planComputerUseStudy(config, input) {
     const source = config.subject.source;
     if (driving.inProcess &&
         (source === "clone" || source === "local-tree" || source === "desktop-cli"))
-        return refuse("in-scope", "HUMANISH_COMPUTER_USE_SUBJECT_INVALID", `RunLabOptions.inProcess drives subject.appUrl in this process, and a ${source} subject needs the hosted desktop the in-process route never creates. Use an app-url or local-app subject with inProcess, or remove inProcess to run on a hosted desktop.`, actor);
+        return refuse("in-scope", "HUMANISH_COMPUTER_USE_SUBJECT_INVALID", `RunStudyOptions.inProcess drives subject.appUrl in this process, and a ${source} subject needs the hosted desktop the in-process route never creates. Use an app-url or local-app subject with inProcess, or remove inProcess to run on a hosted desktop.`, actor);
     // The parser's rule; without a product the desktop study fails later.
     const productReason = desktopCliProductReason(config);
     if (productReason)
@@ -243,7 +243,7 @@ export function planComputerUseStudy(config, input) {
         return refuse("after-personas", "HUMANISH_COMPUTER_USE_FANOUT_INVALID", `Computer-use fan-out is capped at ${MAX_COMPUTER_USE_PARTICIPANTS} participants (resolved ${participants.length}); N concurrent paid desktops is real spend.`, actor);
     const [first, ...rest] = participants;
     if (driving.inProcess && rest.length > 0)
-        return refuse("after-personas", "HUMANISH_COMPUTER_USE_FANOUT_INVALID", "Fan-out to more than one participant is not supported on the in-process route (RunLabOptions.inProcess): fan-out provisions one independent E2B desktop per participant, which the in-process route deliberately skips. Run a single in-process participant, or fan out on the E2B route.", actor);
+        return refuse("after-personas", "HUMANISH_COMPUTER_USE_FANOUT_INVALID", "Fan-out to more than one participant is not supported on the in-process route (RunStudyOptions.inProcess): fan-out provisions one independent E2B desktop per participant, which the in-process route deliberately skips. Run a single in-process participant, or fan out on the E2B route.", actor);
     if (first === undefined)
         throw new Error("computerUseParticipants returned no participant");
     const appUrl = config.subject.appUrl ?? "";

package/dist/routes/computer-use/preflight.js

@@ -55,7 +55,7 @@ export async function liveCuaRejection(args) {
     if (unsetSubjectEnv.length > 0) {
         return {
             code: "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING",
-            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`,
+            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`,
         };
     }
     // Fail-closed cap: a maxUsd cap needs a measurable per-turn estimate.

package/dist/routes/computer-use/setup.js

@@ -89,7 +89,7 @@ export async function admitCuaRun(plan, input, config) {
         ok: false,
         result: fail(...args),
     });
-    // runStudyWith's local VM study supplies a local-target app-url study's desktop; a direct route call or
+    // runStudyWith's `localVm` supplies the desktop of a local-target app-url study; a direct route call or
     // an in-process executor on the same study has none. It reads the declared source, as the planner
     // did: a library config the parser never saw can plan to an app-url subject from another source.
     if (config.subject.source === "app-url" &&

package/dist/routes/computer-use/types.d.ts

@@ -155,7 +155,10 @@ export interface CuaParticipantResult {
         screenshots: number;
     };
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         streamUrlPresent: boolean;
     };
@@ -240,7 +243,10 @@ export interface CuaActorStudyResult extends AutomaticAnalysisResult, StudyResul
         screenshots: number;
     };
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         /** The stream URL itself (carries an auth key) is runtime-only and is deliberately not
          * surfaced on the result; the sandbox is already dead by the time the result exists. */

package/dist/routes/scripted/types.d.ts

@@ -48,6 +48,7 @@ export interface ScriptedBrowserStudyResult extends AutomaticAnalysisResult, Stu
     subject?: RunSubjectProvenance;
     subjectSandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     hostDigest?: string;

package/dist/routes/shared-world/route.js

@@ -141,7 +141,7 @@ async function admitSharedWorldRun(plan, input) {
     }
     const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
     if (unsetSubjectEnv.length > 0) {
-        return fail("HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`);
+        return fail("HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`);
     }
     return undefined;
 }

package/dist/routes/shared-world/types.d.ts

@@ -95,6 +95,7 @@ export interface ConcurrentSharedWorldParticipantResult {
     /** The actor sandbox lifecycle proof (the getHost/key value is never surfaced here). */
     sandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     error?: {
@@ -119,6 +120,7 @@ export interface ConcurrentSharedWorldStudyResult extends AutomaticAnalysisResul
     /** The one subject sandbox lifecycle proof. */
     subjectSandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     /** Whether ≥2 actor windows overlapped in time (proven concurrency; live only). */

package/dist/routes/terminal/credentials.js

@@ -38,7 +38,7 @@ export function buildRuntimeAuth(args) {
         return {
             ok: false,
             code: "HUMANISH_TERMINAL_RUNTIME_AUTH_MISSING",
-            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --env-file; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
+            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --dotenv; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
         };
     }
     const keyValue = args.env[keyName];

package/dist/routes/terminal/live-finish.js

@@ -1,5 +1,6 @@
 // Finishing a live terminal session: the actor trace from the captured stream, the spend ledger
 // and its caps check, the evidence files, the bundle, and the study result.
+import { publicSandboxView, readRunSandboxIds, scrubSandboxIds } from "../../run/sandbox-ids.js";
 import { buildRunCostSummary } from "../../run/cost-summary.js";
 import { writeContainedOutputFile } from "../../run/contained-output.js";
 import { validatePreparedRunArtifactPaths, } from "../../run/paths.js";
@@ -209,8 +210,11 @@ export async function finishLiveTerminalSession(inputs) {
 /** Persist the terminal evidence: redacted events, normalized transcript, ledgers, actor trace. */
 async function writeTerminalEvidence(runPaths, evidence) {
     const { terminalEvents, normalizedTranscript, ledgers, trace } = evidence;
-    await writeContainedOutputFile(runPaths, TERMINAL_EVENTS_ARTIFACT, `${terminalEvents.map((e) => JSON.stringify(e)).join("\n")}${terminalEvents.length > 0 ? "\n" : ""}`, "utf8");
-    await writeContainedOutputFile(runPaths, TERMINAL_TRANSCRIPT_ARTIFACT, `${normalizedTranscript}\n`, "utf8");
-    await writeContainedOutputFile(runPaths, TERMINAL_LEDGERS_ARTIFACT, `${JSON.stringify(ledgers, null, 2)}\n`, "utf8");
-    await writeContainedOutputFile(runPaths, "actor.json", `${JSON.stringify(trace, null, 2)}\n`, "utf8");
+    // The sandbox's raw id stays in sandbox-receipts.ndjson; these files name it by digest.
+    const ids = await readRunSandboxIds(runPaths);
+    const scrub = (text) => scrubSandboxIds(text, ids);
+    await writeContainedOutputFile(runPaths, TERMINAL_EVENTS_ARTIFACT, scrub(`${terminalEvents.map((e) => JSON.stringify(e)).join("\n")}${terminalEvents.length > 0 ? "\n" : ""}`), "utf8");
+    await writeContainedOutputFile(runPaths, TERMINAL_TRANSCRIPT_ARTIFACT, scrub(`${normalizedTranscript}\n`), "utf8");
+    await writeContainedOutputFile(runPaths, TERMINAL_LEDGERS_ARTIFACT, `${JSON.stringify(publicSandboxView(ledgers, ids), null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "actor.json", scrub(`${JSON.stringify(trace, null, 2)}\n`), "utf8");
 }

package/dist/routes/terminal/types.d.ts

@@ -147,7 +147,10 @@ export interface TerminalProductStudyResult extends AutomaticAnalysisResult, Stu
     };
     /** Live-only: the sandbox lifecycle proof (the key/auth value is never surfaced here). */
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         /** By-id proof (never a re-list): 0 = confirmed reclaimed, 1 = still present (unconfirmed),
          *  -1 = kill(id) itself failed or was unavailable. See TerminalLedgers["cleanup"]. */

package/dist/run/bundle-shape.js

@@ -73,6 +73,7 @@ function isRunProviderResource(value) {
         value.kind === "sandbox" &&
         typeof value.id === "string" &&
         value.id.trim().length > 0 &&
+        (value.idDigest === undefined || typeof value.idDigest === "string") &&
         value.owner === "humanish" &&
         (value.status === "running" || value.status === "killed" || value.status === "unknown") &&
         (value.simId === undefined || typeof value.simId === "string") &&

package/dist/run/bundle.d.ts

@@ -413,7 +413,13 @@ export interface RunProviderResource {
     schema: "humanish.provider-resource.v1";
     provider: "e2b-desktop";
     kind: "sandbox";
+    /**
+     * "[redacted-sandbox-id]" in runs from 0.110 on; earlier runs recorded the raw id here. The raw id
+     * is in the run's sandbox-receipts.ndjson.
+     */
     id: string;
+    /** The id's digest, which matches its receipt. Absent on runs recorded before 0.110. */
+    idDigest?: string;
     owner: "humanish";
     status: "running" | "killed" | "unknown";
     simId?: string;

package/dist/run/reclaim.d.ts

@@ -3,7 +3,10 @@ import { type PreparedRunArtifactPaths } from "./paths.js";
 declare const RECLAIM_RESULT_SCHEMA = "humanish.reclaim-result.v1";
 export declare const RECLAIM_RECEIPT_ARTIFACT = "reclaim-receipt.json";
 interface ReclaimOutcome {
+    /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
     sandboxId: string;
+    /** The id's digest, which matches its receipt. */
+    sandboxIdDigest: string;
     laneId: string;
     /** killed = kill(id) confirmed; already-gone = the server no longer knows the id (TTL or a
      *  prior cleanup got it); kill-failed = the attempt errored (the TTL backstop still applies);

package/dist/run/reclaim.js

@@ -9,7 +9,8 @@ import { discardPreflightJournal, listPreflightJournals, preflightReclaimDecisio
 import { resolveRunPath } from "./locate.js";
 import { parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT, } from "./sandbox-receipts.js";
 import { destroyE2BSandbox } from "../substrates/e2b/sandbox.js";
-import { redactText, toErrorMessage } from "../evidence/redaction.js";
+import { REDACTED_SANDBOX_ID, redactText, sandboxIdDigest, toErrorMessage, } from "../evidence/redaction.js";
+import { scrubSandboxIds } from "./sandbox-ids.js";
 import { runIdOf } from "./paths.js";
 const RECLAIM_RESULT_SCHEMA = "humanish.reclaim-result.v1";
 export const RECLAIM_RECEIPT_ARTIFACT = "reclaim-receipt.json";
@@ -182,10 +183,16 @@ async function reclaimJournal(root, hooks) {
         if (seen.has(key))
             continue;
         seen.add(key);
+        // The result and reclaim-receipt.json name the sandbox by digest, and a provider error that
+        // quotes the id is scrubbed; the raw id stays in sandbox-receipts.ndjson.
+        const attempt = await destroy(receipt);
         outcomes.push({
-            sandboxId: receipt.sandboxId,
+            sandboxId: REDACTED_SANDBOX_ID,
+            sandboxIdDigest: sandboxIdDigest(receipt.sandboxId),
             laneId: receipt.laneId,
-            ...(await destroy(receipt)),
+            ...("detail" in attempt
+                ? { ...attempt, detail: scrubSandboxIds(attempt.detail, [receipt.sandboxId]) }
+                : attempt),
         });
     }
     return { kind: "done", receiptCount: receipts.length, outcomes };

package/dist/run/results.d.ts

@@ -37,7 +37,10 @@ export interface RunResult {
 export interface CleanupResourceResult {
     provider: RunProviderResource["provider"];
     kind: RunProviderResource["kind"];
+    /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
     id: string;
+    /** The id's digest, which matches its receipt; absent when the record had neither. */
+    idDigest?: string;
     /** Cleanup reads recorded evidence and never kills a sandbox, so it never writes `killed`. */
     status: "already_clean" | "failed" | "skipped";
     message: string;

package/dist/run/run.js

@@ -9,6 +9,7 @@ import {} from "./results.js";
 import { createRunArtifactPaths, validatePreparedRunArtifactPaths, } from "./paths.js";
 import { registerActiveRun } from "./active-runs.js";
 import { writeContainedOutputFile, writePreparedRunLatestPointer } from "./contained-output.js";
+import { scrubRunSandboxIds, withPublicSandboxIds } from "./sandbox-ids.js";
 import { beginRunStatus, runStatusOutcome } from "./status.js";
 /** An entry point called in a state that does not admit it. */
 class RunLifecycleError extends Error {
@@ -55,6 +56,16 @@ export class FinishedRun {
     }
 }
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+/** Where FinishedRun renders the Observer, when the run was started with one. */
+function observerTarget(options) {
+    return options.observer === undefined
+        ? undefined
+        : {
+            cwd: options.cwd,
+            open: options.observer.open,
+            render: options.observer.render ?? renderObserver,
+        };
+}
 /**
  * Run `fn` as the lifetime of at most one run. When `fn` settles the scope closes synchronously,
  * so the scope and its run admit no further calls, even through references `fn` leaked into
@@ -100,13 +111,7 @@ export async function runScope(fn) {
     const openRun = (options, runId, paths, runStatus) => {
         const now = options.now ?? Date.now;
         const createdAt = new Date(now()).toISOString();
-        const observer = options.observer === undefined
-            ? undefined
-            : {
-                cwd: options.cwd,
-                open: options.observer.open,
-                render: options.observer.render ?? renderObserver,
-            };
+        const observer = observerTarget(options);
         let finishCalled = false;
         let pointerWritten = false;
         // One chain serializes every write. A rejection reaches only the caller of that write; the
@@ -133,7 +138,7 @@ export async function runScope(fn) {
         /** run.json, then `afterBundle`, then the review and projections. */
         const writeBundleFiles = async (bundle, afterBundle) => {
             await validatePreparedRunArtifactPaths(paths);
-            const publicBundle = { ...bundle, cwd: PUBLIC_TARGET_CWD };
+            const publicBundle = await withPublicSandboxIds(paths, { ...bundle, cwd: PUBLIC_TARGET_CWD });
             await writeContainedOutputFile(paths, RUN_BUNDLE_FILE, json(publicBundle), "utf8");
             await afterBundle(publicBundle);
             await writeContainedOutputFile(paths, "review.json", json(publicBundle.review), "utf8");
@@ -149,6 +154,7 @@ export async function runScope(fn) {
         };
         const publish = async (bundle) => {
             await writeBundleFiles(bundle, (publicBundle) => runStatus.finish(runStatusOutcome(publicBundle)));
+            await scrubRunSandboxIds(paths);
             await writePointer();
             return new FinishedRun(issueKey, runId, paths, observer, runStatus);
         };