humanish 0.109.0 → 0.110.0

package/dist/verify/verify.js

@@ -2,7 +2,8 @@ import path from "node:path";
 import { listAnalysisExecutions } from "../analysis/store-executions.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { analysisSharingProblems } from "../analysis/sharing.js";
-import { containsSensitive } from "../evidence/redaction.js";
+import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
+import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA } from "../run/bundle.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
@@ -83,11 +84,17 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
     }));
     const derivedPublicSafetyFindings = [];
     const unscannedArtifacts = [];
+    const sandboxIdFiles = [];
     const publicSafetyFindings = await scanRunPublicSafetyArtifacts(runPaths, derivedPublicSafetyFindings, {
         recordingPaths: new Set(isRunBundle(bundle)
             ? bundle.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : []))
             : []),
         screenshotPaths: isRunBundle(bundle) ? streamScreenshotPaths(bundle) : new Set(),
+        // A run from before 0.110 with no receipts still names its ids in run.json.
+        sandboxIds: [
+            ...new Set([...(await readRunSandboxIds(runPaths)), ...keyedSandboxIds(bundle)]),
+        ],
+        sandboxIdFiles,
     }, unscannedArtifacts);
     // JSON escapes can hide a sensitive value from the byte scan while the
     // decoded recording exposes it to Observer, feedback, or analysis input.
@@ -146,6 +153,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             publicSafetyFindings,
             unscannedArtifacts,
             redactedShapeFrames,
+            sandboxIdFiles,
         })
         : {
             status: "blocked",
@@ -366,6 +374,18 @@ function buildShareSafety(args) {
             message: `The public-safety scan cannot read ${plural(paths.length, "file")} as text that ${paths.length === 1 ? "is not a stream screenshot under screenshots/ or a registered recording" : "are not stream screenshots under screenshots/ or registered recordings"}: ${shown}${more > 0 ? ` and ${more} more` : ""}. Review them before sharing.`,
         });
     }
+    // Runs from 0.110 keep raw sandbox ids only in sandbox-receipts.ndjson. An earlier run records
+    // them in run.json, and any file that names one is not share-ready as it is.
+    const rawResources = (args.bundle.providerResources ?? []).some((resource) => resource.id !== REDACTED_SANDBOX_ID);
+    if (rawResources || args.sandboxIdFiles.length > 0) {
+        const files = [
+            ...new Set([...(rawResources ? [RUN_BUNDLE_FILE] : []), ...args.sandboxIdFiles]),
+        ];
+        reasons.push({
+            code: "RAW_SANDBOX_ID",
+            message: `Raw sandbox ids appear in ${files.sort().join(", ")}. Runs from 0.110 keep them only in sandbox-receipts.ndjson; \`humanish export --format bundle --redact-screenshots\` writes a copy without them.`,
+        });
+    }
     const rawStreamIds = rawScreenshotStreamIds(args.bundle, args.redactedShapeFrames);
     if (rawStreamIds.length > 0) {
         reasons.push({

package/docs/architecture/restricted-codex-analysis.md

@@ -176,7 +176,7 @@ the following, on Linux x64:
    runs this check; see "The qualifier" below.
 3. One hosted participant study with the candidate first on `PATH` (for example
    `PATH=<evidence>/npm-<version>/node_modules/.bin:$PATH pnpm humanish run <study>
---env-file <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
+--dotenv <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
    verified request receipt, `humanish verify --run <id>` passing and the automatic Codex
    analysis recording the release. Keep `OPENAI_API_KEY` out of that environment so the
    participant stays on ChatGPT-account billing.

package/docs/contracts/run-bundle.md

@@ -525,6 +525,10 @@ bundle is safe to promote into a public issue. Public promotion should branch on
 
 - `share_ready`: feedback draft commands may render public issue payloads;
 - `local_only`: keep the run local; only supported redaction-only cases can produce a shareable derivative;
+  `RAW_SANDBOX_ID` is one: a file other than `sandbox-receipts.ndjson` names one of the run's raw
+  sandbox ids, which verify reads from the receipts and from any raw `providerResources[].id` in
+  `run.json`, or a JSON file holds a raw id at a sandbox-id key. Runs from 0.110 keep raw ids only in the receipts, so it fires on runs recorded
+  before 0.110, whose `run.json` holds them, until they are exported;
 - `blocked`: fix the verification or public-safety failure first.
 
 `ok: true` also does not mean the run finished. A run killed mid-way leaves an
@@ -540,7 +544,9 @@ writing; an older one reads as interrupted. The warning names what verify saw:
   there is no usable record;
 - how many streams are still `running`;
 - what `reclaim-receipt.json` records: how many of the run's sandboxes are gone
-  (killed or already gone), and how many journaled sandboxes it does not cover;
+  (killed or already gone), and how many journaled sandboxes it does not cover. It
+  matches its outcomes to the receipts by `sandboxIdDigest`; a reclaim receipt from
+  before 0.110 names raw ids, which are digested to match;
 - with journaled sandboxes and no reclaim receipt, the command that stops them:
   `humanish reclaim --run <id>`.
 
@@ -633,6 +639,19 @@ The receipt describes the transformation; it does not attest that a participant'
 finding is true. Its own bytes are not included in its hash inventory. Feedback
 commands can subsequently generate new derivative-local artifacts.
 
+The derivative names no sandbox. In every JSON and NDJSON file it copies, the
+values at `sandboxId`, `subjectSandboxId`, each `providerResources[].id` and each
+cleanup.json `resources[].id` read `[redacted-sandbox-id]`, with the id's digest
+beside them. In every text file it copies, Markdown, logs and YAML included, each
+id the source names becomes `[redacted-sandbox-id <digest>]`: the ids in its
+`sandbox-receipts.ndjson`, and any raw id at one of those keys, which is where a
+run recorded before 0.110 with no receipts names them. Only those exact ids are
+replaced, so the rest of each file is unchanged. In YAML the label is
+`redacted-sandbox-id-<digest>`, without brackets, so a value keeps its type.
+An id that appears only in free text, in a run with no receipts, is not known to
+export. `sandbox-receipts.ndjson` is omitted, and the source keeps its raw ids,
+which reclaim reads.
+
 PNG files that actor traces reference as stream screenshots are re-encoded as
 blurred thumbnails. A PNG that nothing in `run.json` cites is omitted and
 inventoried. Export refuses a run whose feedback candidates, adapter artifacts or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.109.0",
+  "version": "0.110.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",
@@ -56,9 +56,10 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && pnpm --filter humanish-observer build && pnpm --filter humanish-tui build && node scripts/finish-build.mjs",
-    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm tui:smoke",
+    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm cli:dotenv:test && pnpm tui:smoke",
     "cli:startup:test": "node scripts/terminal-startup-exit-proof.mjs",
     "cli:preflight:test": "node scripts/task-route-preflight-proof.mjs",
+    "cli:dotenv:test": "node scripts/dotenv-proof.mjs",
     "humanish": "tsx src/cli.ts",
     "pack:dry-run": "npm pack --dry-run",
     "prepack": "pnpm build",
@@ -91,6 +92,7 @@
     "prose:check": "node scripts/check-code-prose.mjs",
     "vocabulary:check": "tsx scripts/check-retired-words.ts",
     "site-css:check": "node scripts/check-site-css.mjs",
+    "site:tour": "tsx scripts/site-tour.ts",
     "site:hero:proof": "node scripts/site-hero-wrap-proof.mjs"
   },
   "dependencies": {

package/skills/humanish/SKILL.md

@@ -16,7 +16,7 @@ patient data, or private upstream artifacts.
 
 Do not edit `.env` or secret files. Do not paste credential values. Use env var
 names only, usually `OPENAI_API_KEY` and `E2B_API_KEY`. For live local runs,
-prefer an explicit ignored env file passed with `--env-file <path>`; do not
+prefer an explicit ignored env file passed with `--dotenv <path>`; do not
 assume broad inherited job env is safe. Stop before live provider spend,
 hosted execution, deploys, public tunnels, or GitHub mutation unless the user
 explicitly approves that exact action.
@@ -442,7 +442,7 @@ Do not paste values into files, prompts, run bundles, issue drafts, or logs.
 Load local values only at invocation time:
 
 ```bash
-npx humanish watch .humanish/studies/local-live.yaml --env-file .humanish/local/provider.env
+npx humanish watch .humanish/studies/local-live.yaml --dotenv .humanish/local/provider.env
 ```
 
 When choosing dogfood targets, prefer apps, CLIs, or agent-facing tools with a