humanish 0.109.0 → 0.110.0

package/dist/run/sandbox-ids.d.ts

@@ -0,0 +1,53 @@
+import { type PreparedOutputRoot } from "./contained-output.js";
+import { type PreparedRunArtifactPaths } from "./paths.js";
+/** `text` with every occurrence of each raw id replaced by its label, longest id first. */
+export declare function scrubSandboxIds(text: string, ids: Iterable<string>, label?: (id: string) => string): string;
+/**
+ * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
+ * digest, and any raw id left in free text or a URL becomes its label.
+ */
+export declare function publicSandboxView<T>(value: T, ids: Iterable<string>): T;
+/**
+ * The raw ids at sandbox-id keys in `value`, such as a run.json recorded before 0.110. A value
+ * shorter than an E2B id is left to the key rule, so the text scrub never rewrites a common word.
+ */
+export declare function keyedSandboxIds(value: unknown): string[];
+/**
+ * Every raw sandbox id a run's files name: the receipts', and any at a sandbox-id key in its
+ * JSON, which is where a run from before 0.110 that has no receipts still records them.
+ */
+export declare function inventorySandboxIds(files: readonly {
+    path: string;
+    bytes: Buffer;
+}[]): string[];
+/** Whether a run file's JSON holds a raw id at a sandbox-id key, which no receipt may name. */
+export declare function holdsKeyedSandboxId(file: string, text: string): boolean;
+/**
+ * The raw sandbox ids a run's receipts journal, with any this process receipted whose append
+ * failed; empty when there are none or the journal cannot be read.
+ */
+export declare function readRunSandboxIds(root: PreparedOutputRoot): Promise<string[]>;
+/**
+ * `value` as a run writes it: raw sandbox ids stay in the run's sandbox-receipts.ndjson, and the
+ * file names each by marker and digest.
+ */
+export declare function withPublicSandboxIds<T>(root: PreparedOutputRoot, value: T): Promise<T>;
+/**
+ * The bytes of `file` with each raw id replaced by its label: the same buffer when none occurs, or
+ * when the bytes are not the plain text verify and export read as text.
+ */
+export declare function scrubSandboxIdBytes(file: string, bytes: Buffer, ids: readonly string[]): Buffer;
+/**
+ * Rewrite each file of a finished run that names one of its raw sandbox ids, apart from the
+ * receipts, with the label in place of the id. Writers such as a participant's actor.json can
+ * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
+ * Best effort: verify grades a file this misses.
+ */
+export declare function scrubRunSandboxIds(paths: PreparedRunArtifactPaths): Promise<void>;
+/**
+ * A run's result as it may be returned or printed: the same object when it names no sandbox,
+ * otherwise its public view, scrubbed of the ids the run's receipts journal.
+ */
+export declare function publicRunResult<T extends {
+    runId?: string;
+}>(result: T, cwd: string): Promise<T>;

package/dist/run/sandbox-ids.js

@@ -0,0 +1,198 @@
+// A run's raw sandbox ids live in one place: sandbox-receipts.ndjson, which reclaim reads to kill
+// them and export omits. Every other record a run writes (run.json, its review and projections, the
+// cleanup and reclaim receipts) and every result or CLI line names a sandbox by marker and digest,
+// so output an agent pastes into an issue never carries an id.
+import { opendir, realpath } from "node:fs/promises";
+import path from "node:path";
+import { readPlainText } from "../evidence/plain-text.js";
+import { collectSandboxIds, redactSandboxIds, sandboxIdDigest, REDACTED_SANDBOX_ID, } from "../evidence/redaction.js";
+import { readContainedRegularFile, writeContainedOutputFile, } from "./contained-output.js";
+import { bindExistingRunArtifactPaths, isSafeRunIdSegment, validatePreparedRunRootIdentity, } from "./paths.js";
+import { appendedSandboxIds, parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT, } from "./sandbox-receipts.js";
+/** How text names a sandbox: the marker with the id's digest. */
+function sandboxIdLabel(id) {
+    return `${REDACTED_SANDBOX_ID.slice(0, -1)} ${sandboxIdDigest(id)}]`;
+}
+/**
+ * How YAML names a sandbox: the label without its brackets, since a plain scalar that starts with
+ * `[` reads as a list. Every other byte of the file stays as written.
+ */
+function yamlSandboxIdLabel(id) {
+    return `redacted-sandbox-id-${sandboxIdDigest(id)}`;
+}
+/** `text` with every occurrence of each raw id replaced by its label, longest id first. */
+export function scrubSandboxIds(text, ids, label = sandboxIdLabel) {
+    const unique = [...new Set(ids)].filter((id) => id.length > 0);
+    unique.sort((left, right) => right.length - left.length);
+    return unique.reduce((current, id) => current.split(id).join(label(id)), text);
+}
+/**
+ * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
+ * digest, and any raw id left in free text or a URL becomes its label.
+ */
+export function publicSandboxView(value, ids) {
+    const redacted = redactSandboxIds(value);
+    const known = [...ids];
+    if (known.length === 0)
+        return redacted;
+    const text = JSON.stringify(redacted);
+    if (text === undefined)
+        return redacted;
+    const scrubbed = scrubSandboxIds(text, known);
+    return (scrubbed === text ? redacted : JSON.parse(scrubbed));
+}
+/** The raw sandbox ids a receipts journal names. */
+function receiptSandboxIds(journal) {
+    return parseSandboxReceipts(journal.toString()).map((receipt) => receipt.sandboxId);
+}
+/**
+ * The raw ids at sandbox-id keys in `value`, such as a run.json recorded before 0.110. A value
+ * shorter than an E2B id is left to the key rule, so the text scrub never rewrites a common word.
+ */
+export function keyedSandboxIds(value) {
+    return [...collectSandboxIds(value)].filter((id) => id.length >= 8);
+}
+/** The JSON records in one file's text: one document, or one per NDJSON line. */
+function jsonRecords(file, text) {
+    // Most run files name no sandbox key, and parsing each one would slow verify on large runs. A
+    // key spelled with an escape only shows once parsed.
+    if (!/"(?:sandboxId|subjectSandboxId|providerResources|resources)"|\\u/.test(text))
+        return [];
+    const parse = (part) => {
+        try {
+            return [JSON.parse(part)];
+        }
+        catch {
+            return [];
+        }
+    };
+    if (/\.json$/i.test(file))
+        return parse(text);
+    if (/\.(?:ndjson|jsonl)$/i.test(file))
+        return text.split("\n").flatMap(parse);
+    return [];
+}
+/**
+ * Every raw sandbox id a run's files name: the receipts', and any at a sandbox-id key in its
+ * JSON, which is where a run from before 0.110 that has no receipts still records them.
+ */
+export function inventorySandboxIds(files) {
+    const ids = new Set();
+    for (const file of files) {
+        if (file.path === SANDBOX_RECEIPTS_ARTIFACT) {
+            for (const id of receiptSandboxIds(file.bytes))
+                ids.add(id);
+            continue;
+        }
+        for (const record of jsonRecords(file.path, file.bytes.toString("utf8")))
+            for (const id of keyedSandboxIds(record))
+                ids.add(id);
+    }
+    return [...ids];
+}
+/** Whether a run file's JSON holds a raw id at a sandbox-id key, which no receipt may name. */
+export function holdsKeyedSandboxId(file, text) {
+    return jsonRecords(file, text).some((record) => collectSandboxIds(record).size > 0);
+}
+/**
+ * The raw sandbox ids a run's receipts journal, with any this process receipted whose append
+ * failed; empty when there are none or the journal cannot be read.
+ */
+export async function readRunSandboxIds(root) {
+    let journaled = [];
+    try {
+        const bytes = await readContainedRegularFile(root, SANDBOX_RECEIPTS_ARTIFACT);
+        if (bytes)
+            journaled = receiptSandboxIds(bytes);
+    }
+    catch {
+        // The ids this process receipted still apply.
+    }
+    return [...new Set([...journaled, ...appendedSandboxIds(root)])];
+}
+/**
+ * `value` as a run writes it: raw sandbox ids stay in the run's sandbox-receipts.ndjson, and the
+ * file names each by marker and digest.
+ */
+export async function withPublicSandboxIds(root, value) {
+    return publicSandboxView(value, await readRunSandboxIds(root));
+}
+/**
+ * The bytes of `file` with each raw id replaced by its label: the same buffer when none occurs, or
+ * when the bytes are not the plain text verify and export read as text.
+ */
+export function scrubSandboxIdBytes(file, bytes, ids) {
+    if (!ids.some((id) => id.length > 0 && bytes.includes(id)))
+        return bytes;
+    const decoded = readPlainText(bytes);
+    if (!decoded.ok)
+        return bytes;
+    const label = /\.ya?ml$/i.test(file) ? yamlSandboxIdLabel : sandboxIdLabel;
+    return Buffer.from(scrubSandboxIds(decoded.text, ids, label));
+}
+/** The run files the sweep rewrites: the text formats export copies, and the Observer page. */
+const TEXT_FILE = /\.(?:json|ndjson|jsonl|md|txt|log|yaml|yml|csv|html)$/i;
+/** Enough for any run directory; a sweep stops there rather than hold up the run's finish. */
+const MAX_SWEPT_ENTRIES = 10_000;
+/**
+ * Rewrite each file of a finished run that names one of its raw sandbox ids, apart from the
+ * receipts, with the label in place of the id. Writers such as a participant's actor.json can
+ * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
+ * Best effort: verify grades a file this misses.
+ */
+export async function scrubRunSandboxIds(paths) {
+    const ids = await readRunSandboxIds(paths);
+    if (ids.length === 0)
+        return;
+    const valid = await validatePreparedRunRootIdentity(paths).then(() => true, () => false);
+    if (!valid)
+        return;
+    const scrub = async (file) => {
+        const bytes = await readContainedRegularFile(paths, file);
+        if (bytes === null)
+            return;
+        const scrubbed = scrubSandboxIdBytes(file, bytes, ids);
+        if (scrubbed !== bytes)
+            await writeContainedOutputFile(paths, file, scrubbed);
+    };
+    let seen = 0;
+    const walk = async (relative) => {
+        const directory = path.join(paths.physicalRunRoot, relative);
+        // A directory replaced by a link after it was listed resolves elsewhere and is not walked.
+        if ((await realpath(directory).catch(() => null)) !== directory)
+            return;
+        const listing = await opendir(directory).catch(() => null);
+        if (listing === null)
+            return;
+        for await (const entry of listing) {
+            // Returning from the loop closes the listing.
+            if (++seen > MAX_SWEPT_ENTRIES)
+                return;
+            const file = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                await walk(file);
+            else if (entry.isFile() && file !== SANDBOX_RECEIPTS_ARTIFACT && TEXT_FILE.test(file))
+                // A file that cannot be scrubbed stays as written; verify names it.
+                await scrub(file).catch(() => { });
+        }
+    };
+    await walk("").catch(() => {
+        // A directory that changed while it was listed ends the sweep; verify names what it missed.
+    });
+}
+/**
+ * A run's result as it may be returned or printed: the same object when it names no sandbox,
+ * otherwise its public view, scrubbed of the ids the run's receipts journal.
+ */
+export async function publicRunResult(result, cwd) {
+    let ids = [];
+    if (typeof result.runId === "string" && isSafeRunIdSegment(result.runId)) {
+        try {
+            ids = await readRunSandboxIds(await bindExistingRunArtifactPaths(cwd, result.runId));
+        }
+        catch {
+            // A run that never created its directory has no receipts; the keys are still redacted.
+        }
+    }
+    return publicSandboxView(result, ids);
+}

package/dist/run/sandbox-receipts.d.ts

@@ -20,6 +20,8 @@ export interface SandboxReceipt {
 export interface ParsedSandboxReceipt extends Omit<SandboxReceipt, "provider"> {
     provider: string;
 }
+/** The ids this process has receipted for `root`, whether or not the journal write landed. */
+export declare function appendedSandboxIds(root: PreparedOutputRoot): string[];
 /**
  * Append one receipt. Best-effort by design: the receipt exists to protect the run, so a failed
  * receipt write must never fail the participant. The only cost of a miss is that `reclaim` cannot see

package/dist/run/sandbox-receipts.js

@@ -4,6 +4,23 @@
 import { appendFile } from "node:fs/promises";
 import { prepareContainedOutputFile } from "./contained-output.js";
 export const SANDBOX_RECEIPTS_ARTIFACT = "sandbox-receipts.ndjson";
+/**
+ * The ids this process has receipted for each run directory, kept even when the append fails, so
+ * the run's other records can still be scrubbed of them. Keyed by the directory's identity, so a
+ * run created later at a deleted run's path starts empty, and only the latest runs are kept.
+ */
+const appended = new Map();
+const MAX_REMEMBERED_RUNS = 64;
+function rootKey(root) {
+    const [where, { dev, ino, birthtimeNs }] = "physicalRunRoot" in root
+        ? [root.physicalRunRoot, root.runRootIdentity]
+        : [root.physicalPath, root.identity];
+    return `${where}\0${dev}:${ino}:${birthtimeNs}`;
+}
+/** The ids this process has receipted for `root`, whether or not the journal write landed. */
+export function appendedSandboxIds(root) {
+    return [...(appended.get(rootKey(root)) ?? [])];
+}
 /**
  * Append one receipt. Best-effort by design: the receipt exists to protect the run, so a failed
  * receipt write must never fail the participant. The only cost of a miss is that `reclaim` cannot see
@@ -11,6 +28,15 @@ export const SANDBOX_RECEIPTS_ARTIFACT = "sandbox-receipts.ndjson";
  * artifact write uses; append (not atomic-replace) keeps racing participants' receipts intact.
  */
 export async function appendSandboxReceipt(root, receipt) {
+    const key = rootKey(root);
+    const ids = appended.get(key) ?? new Set();
+    appended.delete(key);
+    appended.set(key, ids.add(receipt.sandboxId));
+    for (const oldest of appended.keys()) {
+        if (appended.size <= MAX_REMEMBERED_RUNS)
+            break;
+        appended.delete(oldest);
+    }
     try {
         const filePath = await prepareContainedOutputFile(root, SANDBOX_RECEIPTS_ARTIFACT);
         await appendFile(filePath, `${JSON.stringify(receipt)}\n`, "utf8");

package/dist/run/status.js

@@ -12,6 +12,7 @@
 import { isProvenanceField, studyFields } from "./study-provenance.js";
 import { writeContainedOutputFile } from "./contained-output.js";
 import { redactText } from "../evidence/redaction.js";
+import { readRunSandboxIds, scrubSandboxIds } from "./sandbox-ids.js";
 export const RUN_STATUS_SCHEMA = "humanish.run-status.v1";
 /** The file, relative to the run directory. */
 export const RUN_STATUS_FILE = "status.json";
@@ -106,10 +107,12 @@ export function beginRunStatus(runPaths, options) {
             if (finishedRecord === undefined)
                 return;
             // The record is public-safe by construction, so each message passes the shape redaction
-            // again even though the routes scrubbed it.
+            // again even though the routes scrubbed it. A route settles with its own result, so an SDK
+            // error here can still name a sandbox; the receipts give the ids to replace.
+            const ids = await readRunSandboxIds(runPaths);
             const redacted = (failure) => ({
                 kind: failure.kind,
-                message: redactText(failure.message),
+                message: scrubSandboxIds(redactText(failure.message), ids),
             });
             const execution = {
                 succeeded: result.execution.succeeded,

package/dist/run/stored-runs.js

@@ -1,3 +1,4 @@
+import { REDACTED_SANDBOX_ID, sandboxIdDigest } from "../evidence/redaction.js";
 import { lstat, readdir } from "node:fs/promises";
 import { runNotFoundMessage } from "./run-not-found.js";
 import path from "node:path";
@@ -30,7 +31,15 @@ function cleanupRefusal(cwd, runInput, checkedAt, error, bundlePath) {
 }
 /** What the recorded evidence says about one provider resource; nothing is killed from here. */
 function recordedResourceResult(resource) {
-    const base = { provider: resource.provider, kind: resource.kind, id: resource.id };
+    // Named by digest: a run recorded before 0.110 holds the raw id here, which is digested.
+    const raw = resource.id === REDACTED_SANDBOX_ID ? undefined : resource.id;
+    const idDigest = resource.idDigest ?? (raw === undefined ? undefined : sandboxIdDigest(raw));
+    const base = {
+        provider: resource.provider,
+        kind: resource.kind,
+        id: REDACTED_SANDBOX_ID,
+        ...(idDigest === undefined ? {} : { idDigest }),
+    };
     if (resource.provider !== "e2b-desktop" || resource.kind !== "sandbox") {
         return {
             ...base,

package/dist/run-study.js

@@ -19,6 +19,7 @@ import {} from "./routes/shared-world/types.js";
 import { admitTerminalPlan, terminalStudyRefusal } from "./routes/terminal/route.js";
 import {} from "./routes/terminal/types.js";
 import {} from "./run/bundle.js";
+import { publicRunResult } from "./run/sandbox-ids.js";
 import { isLocalBrowserStudy, localBrowserDefaults } from "./substrates/local/runtime-config.js";
 /**
  * Runs a study on its route. The options are checked against the route and mapped into the route's
@@ -100,7 +101,11 @@ export async function prepareStudy(config, options, deps = {}) {
                 // study, so a rebuilt one would leave the participants they start for no finally to close.
                 const outcome = await admitted.run(scorer);
                 outcome.result.warnings.push(...normalized.warnings);
-                return outcome;
+                // The result names each sandbox by digest; the raw ids stay in the run's receipts.
+                return {
+                    ...outcome,
+                    result: await publicRunResult(outcome.result, options.cwd),
+                };
             }
             finally {
                 await vm?.close();

package/dist/study/doctor.js

@@ -227,7 +227,7 @@ async function realEmailCheck(connection, keys, args) {
         message: name === null
             ? "The selected email connection is missing or invalid. Open Connections in the TUI."
             : !args.keyPresent(name)
-                ? `Missing ${name} for the selected email connection. Provide it through process env or --env-file. Authentication has not been checked.`
+                ? `Missing ${name} for the selected email connection. Provide it through process env or --dotenv. Authentication has not been checked.`
                 : "Fresh hosted inbox per participant. Local presence only; run humanish comms check --online to authenticate. Provider permissions/capacity and delivery remain untested.",
     };
 }
@@ -300,7 +300,7 @@ function subjectEnvChecks(names, args) {
         ok: !!args.env[name]?.trim() || args.keyPresent(name),
         message: args.env[name]?.trim() || args.keyPresent(name)
             ? "present; value not shown"
-            : "missing declared subject environment variable; provide it with --env-file",
+            : "missing declared subject environment variable; provide it with --dotenv",
     }));
 }
 /** The post-run analysis: the Codex account, or the OpenAI key and the analysis cost limit. */

package/dist/study/init-templates.js

@@ -245,9 +245,9 @@ title: Computer-use browser study
 description: >-
   A computer-use participant drives your app in a hosted desktop browser and writes its evidence
   to gitignored .humanish/. Starts as a dry run. For a live session, set mode to live
-  and pass OPENAI_API_KEY and E2B_API_KEY with --env-file. The clone subject below serves your
+  and pass OPENAI_API_KEY and E2B_API_KEY with --dotenv. The clone subject below serves your
   repo inside the sandbox, and the env names declared under subject get their values from
-  --env-file without the values being saved. Screenshots keep full fidelity by default; set
+  --dotenv without the values being saved. Screenshots keep full fidelity by default; set
   policies.redactScreenshots: true to blur them at capture for a bundle you can share as is.
   Typed text is recorded as its length only.
 route: computer-use

package/dist/study/migrate.d.ts

@@ -21,6 +21,8 @@ export interface MigrateResult {
     readonly files: readonly MigrateFile[];
     /** Files left behind after a clean-up step found them changed: sources, backups or temp files. */
     readonly unresolved?: readonly string[];
+    /** The labs/ directories the moves emptied and migrate removed, or with `--dry-run` would remove. */
+    readonly removedDirectories?: readonly string[];
     readonly error?: {
         readonly code: "HUMANISH_MIGRATE_REFUSED" | "HUMANISH_MIGRATE_FAILED";
         readonly phase: "plan" | "stage" | "commit" | "clean-up";
@@ -34,8 +36,11 @@ export interface MigrateOptions {
     /** Files to convert. Without any, the six study directories are scanned. */
     readonly paths?: readonly string[];
     readonly dryRun?: boolean;
-    /** Called with the plan before anything is written, so a caller can print every destination. */
-    readonly onPlan?: (files: readonly MigrateFile[]) => void;
+    /**
+     * Called with the plan before anything is written, so a caller can print every destination and
+     * each labs/ directory the moves empty, which migrate then removes.
+     */
+    readonly onPlan?: (files: readonly MigrateFile[], emptied: readonly string[]) => void;
     /** Replaces `fs.link`. Tests use it to stand in for a filesystem without hard links. */
     readonly link?: (from: string, to: string) => Promise<void>;
     /** Called between stage and commit, and between commit and clean-up. Tests change files there. */

package/dist/study/migrate.js

@@ -8,6 +8,8 @@
 //    name, so no file this run did not write is ever overwritten. A failure undoes the commits.
 // 4. Clean up: delete each moved source and each rewrite's original, once checked (owned-files.ts).
 //    A file that changed since the plan is kept and listed; a rewrite's original as <name>.v2.bak.
+//    Then a labs/ directory whose every entry moved is removed with a plain rmdir, which fails, and
+//    keeps the directory, when anything else is in it by then.
 import { randomUUID } from "node:crypto";
 import { link, lstat, readdir, readFile, realpath, rename, rmdir } from "node:fs/promises";
 import path from "node:path";
@@ -317,6 +319,46 @@ async function undoCommits(root, writes, linkFile) {
     }
     return unrestored;
 }
+// Each labs/ directory whose every entry, a dotfile or a subdirectory included, is a file this run
+// moves out. Only these are removed after the move.
+async function emptiedRetiredDirectories(root, writes) {
+    const moving = new Map();
+    for (const write of writes) {
+        if (write.file.action !== "move")
+            continue;
+        const directory = path.dirname(write.sourcePath);
+        const relative = path.relative(root, directory);
+        const retired = STUDY_DIRECTORIES.some((entry) => entry.family === "labs" && entry.relativeDir === relative);
+        if (!retired)
+            continue;
+        const entry = moving.get(directory) ?? { write, names: new Set() };
+        entry.names.add(path.basename(write.sourcePath));
+        moving.set(directory, entry);
+    }
+    const emptied = [];
+    for (const [directory, { write, names }] of moving) {
+        const entries = await readdir(directory).catch(() => undefined);
+        if (entries !== undefined && entries.every((name) => names.has(name)))
+            emptied.push(write);
+    }
+    return emptied;
+}
+// Remove each emptied labs/ directory, if it is still the one the plan read. rmdir is not
+// recursive, so a file that appeared in it since the plan keeps it. Returns the removed paths.
+async function removeEmptiedDirectories(root, emptied) {
+    const removed = [];
+    for (const write of emptied) {
+        try {
+            await assertDirectory(write.sourceDirectory, root);
+            await rmdir(path.dirname(write.sourcePath));
+            removed.push(path.relative(root, path.dirname(write.sourcePath)));
+        }
+        catch {
+            // Not empty, or not the directory the plan read: it stays.
+        }
+    }
+    return removed;
+}
 // Delete each moved source and each rewrite's original, but only once the v3 file is in place as
 // written, and only if the old file is still the one the plan read (removeChecked). Anything kept
 // is listed; a rewrite's original is kept as <name>.v2.bak.
@@ -356,9 +398,17 @@ export async function migrateStudies(options) {
     const linkFile = options.link ?? link;
     try {
         ({ files, writes } = await planWrites(root, options));
-        options.onPlan?.(files);
-        if (options.dryRun === true || writes.length === 0)
-            return { ...base, ok: true, files };
+        const emptied = await emptiedRetiredDirectories(root, writes);
+        const emptiedPaths = emptied.map((write) => path.relative(root, path.dirname(write.sourcePath)));
+        options.onPlan?.(files, emptiedPaths);
+        if (options.dryRun === true || writes.length === 0) {
+            return {
+                ...base,
+                ok: true,
+                files,
+                ...(emptiedPaths.length === 0 ? {} : { removedDirectories: emptiedPaths }),
+            };
+        }
         try {
             await stage(root, writes, created);
             options.onPhase?.("stage");
@@ -386,7 +436,13 @@ export async function migrateStudies(options) {
                 },
             };
         }
-        return { ...base, ok: true, files };
+        const removed = await removeEmptiedDirectories(root, emptied);
+        return {
+            ...base,
+            ok: true,
+            files,
+            ...(removed.length === 0 ? {} : { removedDirectories: removed }),
+        };
     }
     catch (error) {
         const failure = error instanceof MigrateError

package/dist/study/run-study-events.js

@@ -43,7 +43,7 @@ export function studyEventEmitter(onEvent, warnings, secretValues) {
             catch {
                 detail = "the thrown value has no message";
             }
-            warnings.push(`RunLabOptions.onEvent failed on ${type}: ${detail}`);
+            warnings.push(`RunStudyOptions.onEvent failed on ${type}: ${detail}`);
         };
         try {
             const returned = onEvent(event);

package/dist/study/run-study-options.js

@@ -11,7 +11,7 @@ import { studyResultIdentity } from "../run/study-result.js";
 const unsupported = (option, route, reason) => ({
     ok: false,
     code: "HUMANISH_STUDY_OPTION_UNSUPPORTED",
-    message: `RunLabOptions.${option} is not supported on the ${route} route: ${reason}`,
+    message: `RunStudyOptions.${option} is not supported on the ${route} route: ${reason}`,
 });
 // Fields RunStudyOptions no longer has, and where each one's job went.
 const REMOVED_OPTIONS = {
@@ -32,7 +32,7 @@ export function removedOptionRefusal(options) {
         return {
             ok: false,
             code: "HUMANISH_STUDY_OPTION_UNSUPPORTED",
-            message: 'RunLabOptions.rerun.laneIds was removed. Use rerun.participantIds. See docs/contracts/schemas.md, "Library options".',
+            message: '`rerun.laneIds` was removed in 0.107.0. Use `rerun.participantIds`. See docs/contracts/schemas.md, "Library options".',
         };
     const field = Object.keys(REMOVED_OPTIONS).find((key) => Reflect.get(options, key) !== undefined);
     if (field === undefined)
@@ -40,7 +40,7 @@ export function removedOptionRefusal(options) {
     return {
         ok: false,
         code: "HUMANISH_STUDY_OPTION_UNSUPPORTED",
-        message: `RunLabOptions.${field} was removed. ${REMOVED_OPTIONS[field]} See docs/contracts/schemas.md, "Library options".`,
+        message: `\`${field}\` was removed. ${REMOVED_OPTIONS[field]} See docs/contracts/schemas.md, "Library options".`,
     };
 }
 /** Why the route cannot honor an option it was given, or undefined when it can. */

package/dist/study/types.d.ts

@@ -239,7 +239,7 @@ export interface StudySubject {
     serve?: StudySubjectServe;
     /**
      * Env var names the subject app needs, provisioned into the sandbox from the caller's
-     * environment (--env-file). Names are recorded in evidence; values never are. Consumed
+     * environment (--dotenv). Names are recorded in evidence; values never are. Consumed
      * on the computer-use clone route.
      */
     env?: string[];

package/dist/verify/artifacts.d.ts

@@ -37,6 +37,10 @@ export declare function rawScreenshotStreamIds(bundle: RunBundle, redactedShapeF
 interface RegisteredStreamMedia {
     recordingPaths: Set<string>;
     screenshotPaths: Set<string>;
+    /** The run's raw sandbox ids, from its receipts; any other file holding one is listed below. */
+    sandboxIds?: readonly string[];
+    /** Filled by the scan: files other than the receipts that name a raw sandbox id. */
+    sandboxIdFiles?: string[];
 }
 /**
  * Scans every run file for secret and path patterns and returns the findings. A file that is not

package/dist/verify/artifacts.js

@@ -7,6 +7,8 @@ import { readPlainText } from "../evidence/plain-text.js";
 import { containsSensitive } from "../evidence/redaction.js";
 import { isLocalEvidenceArtifactPath, isRiskyPublicArtifactPath, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { openContainedRegularFile } from "../run/contained-output.js";
+import { holdsKeyedSandboxId } from "../run/sandbox-ids.js";
+import { SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { readSafeRunArtifactBytes, readSafeRunArtifactJson } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
 import { TERMINAL_EVENTS_ARTIFACT } from "../run/terminal-contract.js";
@@ -348,6 +350,12 @@ async function scanRunPublicSafetyDirectory(runPaths, relativeDirectory, finding
             unscanned.push(relativePath);
             continue;
         }
+        // A receipt's id in any other file, or a raw id at a sandbox-id key, which an older run or
+        // export copy can hold with no receipt to name it.
+        if (relativePath !== SANDBOX_RECEIPTS_ARTIFACT &&
+            (media.sandboxIds?.some((id) => decoded.text.includes(id)) ||
+                holdsKeyedSandboxId(relativePath, decoded.text)))
+            media.sandboxIdFiles?.push(relativePath);
         // serve renders observer/index.html from run.json and export regenerates it, so the on-disk
         // copy reaches neither. It embeds the Observer's own base64 fonts and scripts.
         const scan = scanEncodedTextCached(decoded.text, {

package/dist/verify/liveness.js

@@ -1,6 +1,7 @@
 // `humanish verify`'s RUN_NOT_FINISHED warning. Verify checks the integrity of what a run wrote,
 // and a run killed mid-way leaves an in-progress bundle that passes those checks. The warning says
 // what verify saw on disk, so `ok: true` is not read as "the run finished". It never flips `ok`.
+import { sandboxIdDigest } from "../evidence/redaction.js";
 import path from "node:path";
 import { readRunJsonIfExists, readRunTextIfExists } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
@@ -45,12 +46,14 @@ export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now(
 /** What the reclaim receipt says about the sandboxes this run journaled, or what to run. */
 async function reclaimState(runPaths, runId) {
     const journal = await readRunTextIfExists(runPaths, SANDBOX_RECEIPTS_ARTIFACT);
-    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => receipt.sandboxId));
+    // Matched by digest: a reclaim receipt names each sandbox by digest, and one written before it
+    // did holds the raw id, which is digested here.
+    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => sandboxIdDigest(receipt.sandboxId)));
     const receipt = await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT);
     const outcomes = reclaimOutcomes(receipt, runId);
     if (outcomes !== undefined) {
         const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
-        const reclaimed = new Set(outcomes.map((outcome) => outcome.sandboxId));
+        const reclaimed = new Set(outcomes.map((outcome) => outcome.digest));
         const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
         return `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}.`;
     }
@@ -66,10 +69,11 @@ function reclaimOutcomes(receipt, runId) {
     for (const outcome of receipt.outcomes) {
         if (!isRecord(outcome))
             return undefined;
-        const { sandboxId, state } = outcome;
+        const { sandboxId, sandboxIdDigest: recorded, state } = outcome;
         if (typeof sandboxId !== "string" || typeof state !== "string")
             return undefined;
-        outcomes.push({ sandboxId, state });
+        const digest = typeof recorded === "string" ? recorded : sandboxIdDigest(sandboxId);
+        outcomes.push({ digest, state });
     }
     return outcomes;
 }

package/dist/verify/verify.d.ts

@@ -16,7 +16,7 @@ export interface VerifyResult {
     shareSafety: {
         status: "share_ready" | "local_only" | "blocked";
         reasons: Array<{
-            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
+            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "RAW_SANDBOX_ID" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
             message: string;
         }>;
     };