humanish 0.109.1 → 0.110.0

package/dist/evidence/redaction.js

@@ -60,12 +60,65 @@ function redactLocalPaths(text, label) {
  * passes only this value at a sandbox-id key.
  */
 export const REDACTED_SANDBOX_ID = "[redacted-sandbox-id]";
-/** The keys run writers put a sandbox id under; `providerResources` entries hold one as `id`. */
+/** The keys run writers put a sandbox id under; resource entries hold one as `id`. */
 const SANDBOX_ID_KEYS = new Set(["sandboxId", "subjectSandboxId"]);
+/** Arrays of sandbox records: run.json's `providerResources` and cleanup.json's `resources`. */
+const RESOURCE_ARRAY_KEYS = new Set(["providerResources", "resources"]);
+/** A sandbox id's public stand-in: its digest matches a receipt without naming the sandbox. */
+export function sandboxIdDigest(id) {
+    return digestText(id, 16);
+}
+/** The digest field written beside a redacted id: `idDigest`, `sandboxIdDigest`, … */
+const digestKey = (key) => `${key}Digest`;
+/**
+ * The entries of `object` with each raw id at one of `keys` replaced by REDACTED_SANDBOX_ID and its
+ * digest written beside it, unless the object already records one.
+ */
+function redactIdEntries(object, keys) {
+    const entries = Object.entries(object);
+    const present = new Set(entries.map(([key]) => key));
+    return entries.flatMap(([key, child]) => {
+        if (!keys.has(key) || typeof child !== "string" || child === REDACTED_SANDBOX_ID)
+            return [[key, child]];
+        // A label that a text scrub left at the key already carries the id's digest.
+        const digest = SANDBOX_ID_LABEL.exec(child)?.[1] ?? sandboxIdDigest(child);
+        return [
+            [key, REDACTED_SANDBOX_ID],
+            ...(present.has(digestKey(key)) ? [] : [[digestKey(key), digest]]),
+        ];
+    });
+}
+/** How free text names a sandbox: the marker with the id's digest inside it. */
+const SANDBOX_ID_LABEL = /^\[redacted-sandbox-id ([0-9a-f]{16})\]$/;
+const RESOURCE_ID_KEYS = new Set(["id"]);
+/** A raw id at a sandbox-id key: neither the marker nor a label that names its digest. */
+const isRawSandboxId = (value) => typeof value === "string" && value !== REDACTED_SANDBOX_ID && !SANDBOX_ID_LABEL.test(value);
+/** The raw ids at the keys redactSandboxIds replaces, anywhere in `value`. */
+export function collectSandboxIds(value, into = new Set()) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSandboxIds(item, into);
+        return into;
+    }
+    if (value === null || typeof value !== "object")
+        return into;
+    for (const [key, child] of Object.entries(value)) {
+        if (SANDBOX_ID_KEYS.has(key) && isRawSandboxId(child))
+            into.add(child);
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            for (const resource of child) {
+                const id = resource !== null && typeof resource === "object" ? Reflect.get(resource, "id") : null;
+                if (isRawSandboxId(id))
+                    into.add(id);
+            }
+        collectSandboxIds(child, into);
+    }
+    return into;
+}
 /**
- * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID: strings at `sandboxId` and
- * `subjectSandboxId`, and the `id` of each `providerResources` entry. A run keeps raw ids as local
- * evidence for cleanup; a copy made to be shared names no sandbox.
+ * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID plus its digest: strings at
+ * `sandboxId` and `subjectSandboxId`, and the `id` of each `providerResources` or `resources` entry. Raw ids live
+ * only in a run's sandbox-receipts.ndjson; every record and output names a sandbox by digest.
  */
 export function redactSandboxIds(value) {
     if (Array.isArray(value)) {
@@ -74,28 +127,19 @@ export function redactSandboxIds(value) {
     }
     if (value === null || typeof value !== "object")
         return value;
-    let changed = false;
     // fromEntries keeps a key such as __proto__ an own property, as JSON.parse made it.
-    const entries = Object.entries(value).map(([key, child]) => {
-        let next;
-        if (SANDBOX_ID_KEYS.has(key) && typeof child === "string")
-            next = REDACTED_SANDBOX_ID;
-        else if (key === "providerResources" && Array.isArray(child))
-            next = child.map((resource) => resource !== null &&
-                typeof resource === "object" &&
-                !Array.isArray(resource) &&
-                "id" in resource
-                ? Object.fromEntries(Object.entries(redactSandboxIds(resource)).map(([field, entry]) => [
-                    field,
-                    field === "id" ? REDACTED_SANDBOX_ID : entry,
-                ]))
-                : redactSandboxIds(resource));
-        else
-            next = redactSandboxIds(child);
-        if (next !== child && JSON.stringify(next) !== JSON.stringify(child))
-            changed = true;
-        return [key, next];
+    const entries = redactIdEntries(value, SANDBOX_ID_KEYS).map(([key, child]) => {
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            return [
+                key,
+                child.map((resource) => resource !== null && typeof resource === "object" && !Array.isArray(resource)
+                    ? Object.fromEntries(redactIdEntries(redactSandboxIds(resource), RESOURCE_ID_KEYS))
+                    : redactSandboxIds(resource)),
+            ];
+        return [key, redactSandboxIds(child)];
     });
+    const changed = entries.length !== Object.keys(value).length ||
+        entries.some(([key, child]) => child !== value[key]);
     return changed ? Object.fromEntries(entries) : value;
 }
 /** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */

package/dist/feedback/export-bundle.js

@@ -8,6 +8,7 @@ import { parse as parseYaml } from "yaml";
 import { ACTOR_TRACE_SCHEMA } from "../actors/contract.js";
 import { renderObserver } from "../observer/render.js";
 import { buildObserverData } from "../observer/data.js";
+import { inventorySandboxIds, scrubSandboxIdBytes } from "../run/sandbox-ids.js";
 import { containsSensitive, redactSandboxIds, redactScreenshot, redactText, } from "../evidence/redaction.js";
 import { decodeEscapes } from "../evidence/encoded-text.js";
 import { readPlainText } from "../evidence/plain-text.js";
@@ -300,6 +301,7 @@ function keptPngPaths(source, bundle) {
 async function writeDerivative(source, stagePaths, bundle) {
     const entries = [];
     const imagePaths = keptPngPaths(source, bundle);
+    const sandboxIds = inventorySandboxIds(source.files);
     let images = 0;
     for (const file of source.files) {
         const isPng = path.extname(file.path).toLowerCase() === ".png";
@@ -343,6 +345,7 @@ async function writeDerivative(source, stagePaths, bundle) {
                 }
                 bytes = jsonBytes(transformed);
             }
+            bytes = scrubSandboxIdBytes(file.path, bytes, sandboxIds);
             action = bytes.equals(file.bytes) ? "copied" : "updated";
         }
         await writeContainedOutputFile(stagePaths, file.path, bytes);
@@ -496,7 +499,9 @@ async function verifyFrozenSource(workspace, source, runId) {
                 verified.shareSafety.reasons.every(
                 // Both are repaired in the copy: frames are blurred, and an unread PNG is dropped or
                 // refused by keptPngPaths. Any other unread file fails as an unsupported format.
-                (reason) => reason.code === "RAW_SCREENSHOTS" || reason.code === "UNSCANNED_ARTIFACT")))) {
+                (reason) => reason.code === "RAW_SCREENSHOTS" ||
+                    reason.code === "RAW_SANDBOX_ID" ||
+                    reason.code === "UNSCANNED_ARTIFACT")))) {
         return { shareSafety: verified.shareSafety };
     }
     const loaded = await loadRunBundlePrepared(rawSnapshot.physicalPath, snapshotPaths);

package/dist/feedback/export.js

@@ -384,6 +384,9 @@ function shareSafetyRemedy(codes) {
     if (codes.includes("RAW_SCREENSHOTS")) {
         steps.push("Re-run with policies.redactScreenshots: true to blur screenshots at capture.");
     }
+    if (codes.includes("RAW_SANDBOX_ID")) {
+        steps.push("Export with --format bundle --redact-screenshots, which writes a copy without raw sandbox ids, and share from that copy.");
+    }
     if (codes.includes("UNSCANNED_ARTIFACT")) {
         steps.push("verify cannot read the files that `humanish verify --json` lists under UNSCANNED_ARTIFACT as text: remove them from the run folder, or keep only images an actor trace references as stream screenshots.");
     }

package/dist/keys/key-resolution.d.ts

@@ -22,6 +22,11 @@ export declare function discoverProviderKeys(args: {
     deps?: KeyResolutionDeps;
     announced?: ReadonlySet<string>;
 }): Promise<ResolvedKeyFill[]>;
+/** What `--dotenv` loaded: the path as given, and the names it set because they were unset. */
+export interface DotenvLoad {
+    path: string;
+    names: readonly string[];
+}
 export interface KeySourceProbe {
     name: string;
     /** The source that supplies the key right now, or null when missing everywhere. */
@@ -43,6 +48,8 @@ export declare function probeKeySources(names: readonly string[], args: {
     cwd: string;
     env: NodeJS.ProcessEnv;
     deps?: KeyResolutionDeps;
+    /** The names `--dotenv` put into `env`, so their rows name the file, not the process env. */
+    dotenv?: DotenvLoad;
 }): Promise<KeySourceProbe[]>;
 /** Resolve a `humanish keys set` target: a vendor alias or a raw env name. Null = invalid. */
 export declare function resolveKeyName(vendorOrName: string): string | null;

package/dist/keys/key-resolution.js

@@ -1,8 +1,8 @@
 // Provider-key discovery: resolve the keys a live run needs through each vendor's
-// native chain instead of demanding a per-repo --env-file that operators hand-copy keys into.
+// native chain instead of demanding a per-repo --dotenv that operators hand-copy keys into.
 //
 // The chain, per key, fill-only (a rung never overrides anything already present):
-//   1. process env, including whatever --env-file just loaded (explicit always wins);
+//   1. process env, including whatever --dotenv just loaded (explicit always wins);
 //   2. `.humanish/local/provider.env`, the project-local overlay this CLI's own --help
 //      examples document;
 //   3. the owning vendor's native store, where one exists:
@@ -24,7 +24,7 @@ import { loadEnvFile } from "./env-file.js";
 /** The only names implicit discovery may fill (and `humanish keys set` may store). Everything
  *  else in an overlay/store file is ignored-and-named: a repo-planted NODE_OPTIONS/LD_PRELOAD
  *  must never enter process env off a file the operator did not explicitly pass (an explicit
- *  --env-file remains the operator's own full-file load). */
+ *  --dotenv remains the operator's own full-file load). */
 const KNOWN_PROVIDER_KEYS = [
     "OPENAI_API_KEY",
     "ANTHROPIC_API_KEY",
@@ -213,7 +213,7 @@ export async function discoverProviderKeys(args) {
         if (announced === undefined || announced.has(fill_.name))
             announce(`humanish keys: ${fill_.name} from ${fill_.source}`);
     for (const name of ignored)
-        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --env-file to load every name in it.`);
+        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --dotenv to load every name in it.`);
     return fills;
 }
 /** True when the file's parent directory is (or traverses) a symlink at its last component:
@@ -253,7 +253,7 @@ export function describeMissingKeys(names, env) {
     const hints = names.map((name) => `${name}: ${missingKeyHint(name)}`).join("; ");
     const strict = env.HUMANISH_STRICT_KEYS?.trim() === "1";
     const chain = strict
-        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --env-file are read"
+        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --dotenv are read"
         : `also checked ${PROJECT_OVERLAY_RELATIVE}, ~/.e2b/config.json, gh auth token, and ${path.join("~", ".config", "humanish", "keys.env")}`;
     return `${chain}. Fill: ${hints}.`;
 }
@@ -278,7 +278,9 @@ export async function probeKeySources(names, args) {
             args.env.GITHUB_TOKEN !== undefined &&
             args.env.GITHUB_TOKEN.trim() !== "";
         const source = inEnv
-            ? "process env"
+            ? args.dotenv?.names.includes(name)
+                ? `--dotenv ${args.dotenv.path}`
+                : "process env"
             : aliasInEnv
                 ? "process env (GITHUB_TOKEN)"
                 : (bySource.get(name) ?? null);
@@ -307,7 +309,7 @@ export function setUserKey(name, value, env, deps = {}) {
         throw new Error(`Not a valid env name: ${name}`);
     }
     if (!PROVIDER_KEY_SET.has(name)) {
-        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --env-file.`);
+        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --dotenv.`);
     }
     const storePath = userKeyStorePath(env, deps);
     const dir = path.dirname(storePath);
@@ -325,7 +327,7 @@ export function setUserKey(name, value, env, deps = {}) {
     // would silently resolve to a different secret on the next run.
     const roundTrip = parseStoreLine(`${name}=${trimmed}`);
     if (roundTrip === null || roundTrip[0] !== name || roundTrip[1] !== trimmed) {
-        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --env-file instead.");
+        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --dotenv instead.");
     }
     writeStore(storePath, entries);
     return { path: storePath };

package/dist/routes/computer-use/live-phase.d.ts

@@ -27,6 +27,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
         };
         sandbox?: {
             sandboxId: string;
+            sandboxIdDigest?: string;
             killed: boolean;
             streamUrlPresent: boolean;
         };

package/dist/routes/computer-use/preflight.js

@@ -55,7 +55,7 @@ export async function liveCuaRejection(args) {
     if (unsetSubjectEnv.length > 0) {
         return {
             code: "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING",
-            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`,
+            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`,
         };
     }
     // Fail-closed cap: a maxUsd cap needs a measurable per-turn estimate.

package/dist/routes/computer-use/types.d.ts

@@ -155,7 +155,10 @@ export interface CuaParticipantResult {
         screenshots: number;
     };
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         streamUrlPresent: boolean;
     };
@@ -240,7 +243,10 @@ export interface CuaActorStudyResult extends AutomaticAnalysisResult, StudyResul
         screenshots: number;
     };
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         /** The stream URL itself (carries an auth key) is runtime-only and is deliberately not
          * surfaced on the result; the sandbox is already dead by the time the result exists. */

package/dist/routes/scripted/types.d.ts

@@ -48,6 +48,7 @@ export interface ScriptedBrowserStudyResult extends AutomaticAnalysisResult, Stu
     subject?: RunSubjectProvenance;
     subjectSandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     hostDigest?: string;

package/dist/routes/shared-world/route.js

@@ -141,7 +141,7 @@ async function admitSharedWorldRun(plan, input) {
     }
     const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
     if (unsetSubjectEnv.length > 0) {
-        return fail("HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --env-file; values are never persisted).`);
+        return fail("HUMANISH_SHARED_WORLD_SUBJECT_ENV_MISSING", `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`);
     }
     return undefined;
 }

package/dist/routes/shared-world/types.d.ts

@@ -95,6 +95,7 @@ export interface ConcurrentSharedWorldParticipantResult {
     /** The actor sandbox lifecycle proof (the getHost/key value is never surfaced here). */
     sandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     error?: {
@@ -119,6 +120,7 @@ export interface ConcurrentSharedWorldStudyResult extends AutomaticAnalysisResul
     /** The one subject sandbox lifecycle proof. */
     subjectSandbox?: {
         sandboxId: string;
+        sandboxIdDigest?: string;
         killed: boolean;
     };
     /** Whether ≥2 actor windows overlapped in time (proven concurrency; live only). */

package/dist/routes/terminal/credentials.js

@@ -38,7 +38,7 @@ export function buildRuntimeAuth(args) {
         return {
             ok: false,
             code: "HUMANISH_TERMINAL_RUNTIME_AUTH_MISSING",
-            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --env-file; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
+            message: `Live terminal-product studies declare runtimeAuth "${String(args.runtimeAuth)}" and need ${ALLOWED_RUNTIME_KEY_NAMES.join(" or ")} in the environment (pass via --dotenv; the selected auth mode places the value in command-scoped env or an external E2B header transform; the value is never persisted).`,
         };
     }
     const keyValue = args.env[keyName];

package/dist/routes/terminal/live-finish.js

@@ -1,5 +1,6 @@
 // Finishing a live terminal session: the actor trace from the captured stream, the spend ledger
 // and its caps check, the evidence files, the bundle, and the study result.
+import { publicSandboxView, readRunSandboxIds, scrubSandboxIds } from "../../run/sandbox-ids.js";
 import { buildRunCostSummary } from "../../run/cost-summary.js";
 import { writeContainedOutputFile } from "../../run/contained-output.js";
 import { validatePreparedRunArtifactPaths, } from "../../run/paths.js";
@@ -209,8 +210,11 @@ export async function finishLiveTerminalSession(inputs) {
 /** Persist the terminal evidence: redacted events, normalized transcript, ledgers, actor trace. */
 async function writeTerminalEvidence(runPaths, evidence) {
     const { terminalEvents, normalizedTranscript, ledgers, trace } = evidence;
-    await writeContainedOutputFile(runPaths, TERMINAL_EVENTS_ARTIFACT, `${terminalEvents.map((e) => JSON.stringify(e)).join("\n")}${terminalEvents.length > 0 ? "\n" : ""}`, "utf8");
-    await writeContainedOutputFile(runPaths, TERMINAL_TRANSCRIPT_ARTIFACT, `${normalizedTranscript}\n`, "utf8");
-    await writeContainedOutputFile(runPaths, TERMINAL_LEDGERS_ARTIFACT, `${JSON.stringify(ledgers, null, 2)}\n`, "utf8");
-    await writeContainedOutputFile(runPaths, "actor.json", `${JSON.stringify(trace, null, 2)}\n`, "utf8");
+    // The sandbox's raw id stays in sandbox-receipts.ndjson; these files name it by digest.
+    const ids = await readRunSandboxIds(runPaths);
+    const scrub = (text) => scrubSandboxIds(text, ids);
+    await writeContainedOutputFile(runPaths, TERMINAL_EVENTS_ARTIFACT, scrub(`${terminalEvents.map((e) => JSON.stringify(e)).join("\n")}${terminalEvents.length > 0 ? "\n" : ""}`), "utf8");
+    await writeContainedOutputFile(runPaths, TERMINAL_TRANSCRIPT_ARTIFACT, scrub(`${normalizedTranscript}\n`), "utf8");
+    await writeContainedOutputFile(runPaths, TERMINAL_LEDGERS_ARTIFACT, `${JSON.stringify(publicSandboxView(ledgers, ids), null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "actor.json", scrub(`${JSON.stringify(trace, null, 2)}\n`), "utf8");
 }

package/dist/routes/terminal/types.d.ts

@@ -147,7 +147,10 @@ export interface TerminalProductStudyResult extends AutomaticAnalysisResult, Stu
     };
     /** Live-only: the sandbox lifecycle proof (the key/auth value is never surfaced here). */
     sandbox?: {
+        /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
         sandboxId: string;
+        /** The id's digest, which matches its receipt. */
+        sandboxIdDigest?: string;
         killed: boolean;
         /** By-id proof (never a re-list): 0 = confirmed reclaimed, 1 = still present (unconfirmed),
          *  -1 = kill(id) itself failed or was unavailable. See TerminalLedgers["cleanup"]. */

package/dist/run/bundle-shape.js

@@ -73,6 +73,7 @@ function isRunProviderResource(value) {
         value.kind === "sandbox" &&
         typeof value.id === "string" &&
         value.id.trim().length > 0 &&
+        (value.idDigest === undefined || typeof value.idDigest === "string") &&
         value.owner === "humanish" &&
         (value.status === "running" || value.status === "killed" || value.status === "unknown") &&
         (value.simId === undefined || typeof value.simId === "string") &&

package/dist/run/bundle.d.ts

@@ -413,7 +413,13 @@ export interface RunProviderResource {
     schema: "humanish.provider-resource.v1";
     provider: "e2b-desktop";
     kind: "sandbox";
+    /**
+     * "[redacted-sandbox-id]" in runs from 0.110 on; earlier runs recorded the raw id here. The raw id
+     * is in the run's sandbox-receipts.ndjson.
+     */
     id: string;
+    /** The id's digest, which matches its receipt. Absent on runs recorded before 0.110. */
+    idDigest?: string;
     owner: "humanish";
     status: "running" | "killed" | "unknown";
     simId?: string;

package/dist/run/reclaim.d.ts

@@ -3,7 +3,10 @@ import { type PreparedRunArtifactPaths } from "./paths.js";
 declare const RECLAIM_RESULT_SCHEMA = "humanish.reclaim-result.v1";
 export declare const RECLAIM_RECEIPT_ARTIFACT = "reclaim-receipt.json";
 interface ReclaimOutcome {
+    /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
     sandboxId: string;
+    /** The id's digest, which matches its receipt. */
+    sandboxIdDigest: string;
     laneId: string;
     /** killed = kill(id) confirmed; already-gone = the server no longer knows the id (TTL or a
      *  prior cleanup got it); kill-failed = the attempt errored (the TTL backstop still applies);

package/dist/run/reclaim.js

@@ -9,7 +9,8 @@ import { discardPreflightJournal, listPreflightJournals, preflightReclaimDecisio
 import { resolveRunPath } from "./locate.js";
 import { parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT, } from "./sandbox-receipts.js";
 import { destroyE2BSandbox } from "../substrates/e2b/sandbox.js";
-import { redactText, toErrorMessage } from "../evidence/redaction.js";
+import { REDACTED_SANDBOX_ID, redactText, sandboxIdDigest, toErrorMessage, } from "../evidence/redaction.js";
+import { scrubSandboxIds } from "./sandbox-ids.js";
 import { runIdOf } from "./paths.js";
 const RECLAIM_RESULT_SCHEMA = "humanish.reclaim-result.v1";
 export const RECLAIM_RECEIPT_ARTIFACT = "reclaim-receipt.json";
@@ -182,10 +183,16 @@ async function reclaimJournal(root, hooks) {
         if (seen.has(key))
             continue;
         seen.add(key);
+        // The result and reclaim-receipt.json name the sandbox by digest, and a provider error that
+        // quotes the id is scrubbed; the raw id stays in sandbox-receipts.ndjson.
+        const attempt = await destroy(receipt);
         outcomes.push({
-            sandboxId: receipt.sandboxId,
+            sandboxId: REDACTED_SANDBOX_ID,
+            sandboxIdDigest: sandboxIdDigest(receipt.sandboxId),
             laneId: receipt.laneId,
-            ...(await destroy(receipt)),
+            ...("detail" in attempt
+                ? { ...attempt, detail: scrubSandboxIds(attempt.detail, [receipt.sandboxId]) }
+                : attempt),
         });
     }
     return { kind: "done", receiptCount: receipts.length, outcomes };

package/dist/run/results.d.ts

@@ -37,7 +37,10 @@ export interface RunResult {
 export interface CleanupResourceResult {
     provider: RunProviderResource["provider"];
     kind: RunProviderResource["kind"];
+    /** "[redacted-sandbox-id]"; the raw id is only in the run's sandbox-receipts.ndjson. */
     id: string;
+    /** The id's digest, which matches its receipt; absent when the record had neither. */
+    idDigest?: string;
     /** Cleanup reads recorded evidence and never kills a sandbox, so it never writes `killed`. */
     status: "already_clean" | "failed" | "skipped";
     message: string;

package/dist/run/run.js

@@ -9,6 +9,7 @@ import {} from "./results.js";
 import { createRunArtifactPaths, validatePreparedRunArtifactPaths, } from "./paths.js";
 import { registerActiveRun } from "./active-runs.js";
 import { writeContainedOutputFile, writePreparedRunLatestPointer } from "./contained-output.js";
+import { scrubRunSandboxIds, withPublicSandboxIds } from "./sandbox-ids.js";
 import { beginRunStatus, runStatusOutcome } from "./status.js";
 /** An entry point called in a state that does not admit it. */
 class RunLifecycleError extends Error {
@@ -55,6 +56,16 @@ export class FinishedRun {
     }
 }
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+/** Where FinishedRun renders the Observer, when the run was started with one. */
+function observerTarget(options) {
+    return options.observer === undefined
+        ? undefined
+        : {
+            cwd: options.cwd,
+            open: options.observer.open,
+            render: options.observer.render ?? renderObserver,
+        };
+}
 /**
  * Run `fn` as the lifetime of at most one run. When `fn` settles the scope closes synchronously,
  * so the scope and its run admit no further calls, even through references `fn` leaked into
@@ -100,13 +111,7 @@ export async function runScope(fn) {
     const openRun = (options, runId, paths, runStatus) => {
         const now = options.now ?? Date.now;
         const createdAt = new Date(now()).toISOString();
-        const observer = options.observer === undefined
-            ? undefined
-            : {
-                cwd: options.cwd,
-                open: options.observer.open,
-                render: options.observer.render ?? renderObserver,
-            };
+        const observer = observerTarget(options);
         let finishCalled = false;
         let pointerWritten = false;
         // One chain serializes every write. A rejection reaches only the caller of that write; the
@@ -133,7 +138,7 @@ export async function runScope(fn) {
         /** run.json, then `afterBundle`, then the review and projections. */
         const writeBundleFiles = async (bundle, afterBundle) => {
             await validatePreparedRunArtifactPaths(paths);
-            const publicBundle = { ...bundle, cwd: PUBLIC_TARGET_CWD };
+            const publicBundle = await withPublicSandboxIds(paths, { ...bundle, cwd: PUBLIC_TARGET_CWD });
             await writeContainedOutputFile(paths, RUN_BUNDLE_FILE, json(publicBundle), "utf8");
             await afterBundle(publicBundle);
             await writeContainedOutputFile(paths, "review.json", json(publicBundle.review), "utf8");
@@ -149,6 +154,7 @@ export async function runScope(fn) {
         };
         const publish = async (bundle) => {
             await writeBundleFiles(bundle, (publicBundle) => runStatus.finish(runStatusOutcome(publicBundle)));
+            await scrubRunSandboxIds(paths);
             await writePointer();
             return new FinishedRun(issueKey, runId, paths, observer, runStatus);
         };

package/dist/run/sandbox-ids.d.ts

@@ -0,0 +1,53 @@
+import { type PreparedOutputRoot } from "./contained-output.js";
+import { type PreparedRunArtifactPaths } from "./paths.js";
+/** `text` with every occurrence of each raw id replaced by its label, longest id first. */
+export declare function scrubSandboxIds(text: string, ids: Iterable<string>, label?: (id: string) => string): string;
+/**
+ * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
+ * digest, and any raw id left in free text or a URL becomes its label.
+ */
+export declare function publicSandboxView<T>(value: T, ids: Iterable<string>): T;
+/**
+ * The raw ids at sandbox-id keys in `value`, such as a run.json recorded before 0.110. A value
+ * shorter than an E2B id is left to the key rule, so the text scrub never rewrites a common word.
+ */
+export declare function keyedSandboxIds(value: unknown): string[];
+/**
+ * Every raw sandbox id a run's files name: the receipts', and any at a sandbox-id key in its
+ * JSON, which is where a run from before 0.110 that has no receipts still records them.
+ */
+export declare function inventorySandboxIds(files: readonly {
+    path: string;
+    bytes: Buffer;
+}[]): string[];
+/** Whether a run file's JSON holds a raw id at a sandbox-id key, which no receipt may name. */
+export declare function holdsKeyedSandboxId(file: string, text: string): boolean;
+/**
+ * The raw sandbox ids a run's receipts journal, with any this process receipted whose append
+ * failed; empty when there are none or the journal cannot be read.
+ */
+export declare function readRunSandboxIds(root: PreparedOutputRoot): Promise<string[]>;
+/**
+ * `value` as a run writes it: raw sandbox ids stay in the run's sandbox-receipts.ndjson, and the
+ * file names each by marker and digest.
+ */
+export declare function withPublicSandboxIds<T>(root: PreparedOutputRoot, value: T): Promise<T>;
+/**
+ * The bytes of `file` with each raw id replaced by its label: the same buffer when none occurs, or
+ * when the bytes are not the plain text verify and export read as text.
+ */
+export declare function scrubSandboxIdBytes(file: string, bytes: Buffer, ids: readonly string[]): Buffer;
+/**
+ * Rewrite each file of a finished run that names one of its raw sandbox ids, apart from the
+ * receipts, with the label in place of the id. Writers such as a participant's actor.json can
+ * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
+ * Best effort: verify grades a file this misses.
+ */
+export declare function scrubRunSandboxIds(paths: PreparedRunArtifactPaths): Promise<void>;
+/**
+ * A run's result as it may be returned or printed: the same object when it names no sandbox,
+ * otherwise its public view, scrubbed of the ids the run's receipts journal.
+ */
+export declare function publicRunResult<T extends {
+    runId?: string;
+}>(result: T, cwd: string): Promise<T>;