humanish 0.109.1 → 0.110.0

package/dist/run/sandbox-ids.js

@@ -0,0 +1,198 @@
+// A run's raw sandbox ids live in one place: sandbox-receipts.ndjson, which reclaim reads to kill
+// them and export omits. Every other record a run writes (run.json, its review and projections, the
+// cleanup and reclaim receipts) and every result or CLI line names a sandbox by marker and digest,
+// so output an agent pastes into an issue never carries an id.
+import { opendir, realpath } from "node:fs/promises";
+import path from "node:path";
+import { readPlainText } from "../evidence/plain-text.js";
+import { collectSandboxIds, redactSandboxIds, sandboxIdDigest, REDACTED_SANDBOX_ID, } from "../evidence/redaction.js";
+import { readContainedRegularFile, writeContainedOutputFile, } from "./contained-output.js";
+import { bindExistingRunArtifactPaths, isSafeRunIdSegment, validatePreparedRunRootIdentity, } from "./paths.js";
+import { appendedSandboxIds, parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT, } from "./sandbox-receipts.js";
+/** How text names a sandbox: the marker with the id's digest. */
+function sandboxIdLabel(id) {
+    return `${REDACTED_SANDBOX_ID.slice(0, -1)} ${sandboxIdDigest(id)}]`;
+}
+/**
+ * How YAML names a sandbox: the label without its brackets, since a plain scalar that starts with
+ * `[` reads as a list. Every other byte of the file stays as written.
+ */
+function yamlSandboxIdLabel(id) {
+    return `redacted-sandbox-id-${sandboxIdDigest(id)}`;
+}
+/** `text` with every occurrence of each raw id replaced by its label, longest id first. */
+export function scrubSandboxIds(text, ids, label = sandboxIdLabel) {
+    const unique = [...new Set(ids)].filter((id) => id.length > 0);
+    unique.sort((left, right) => right.length - left.length);
+    return unique.reduce((current, id) => current.split(id).join(label(id)), text);
+}
+/**
+ * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
+ * digest, and any raw id left in free text or a URL becomes its label.
+ */
+export function publicSandboxView(value, ids) {
+    const redacted = redactSandboxIds(value);
+    const known = [...ids];
+    if (known.length === 0)
+        return redacted;
+    const text = JSON.stringify(redacted);
+    if (text === undefined)
+        return redacted;
+    const scrubbed = scrubSandboxIds(text, known);
+    return (scrubbed === text ? redacted : JSON.parse(scrubbed));
+}
+/** The raw sandbox ids a receipts journal names. */
+function receiptSandboxIds(journal) {
+    return parseSandboxReceipts(journal.toString()).map((receipt) => receipt.sandboxId);
+}
+/**
+ * The raw ids at sandbox-id keys in `value`, such as a run.json recorded before 0.110. A value
+ * shorter than an E2B id is left to the key rule, so the text scrub never rewrites a common word.
+ */
+export function keyedSandboxIds(value) {
+    return [...collectSandboxIds(value)].filter((id) => id.length >= 8);
+}
+/** The JSON records in one file's text: one document, or one per NDJSON line. */
+function jsonRecords(file, text) {
+    // Most run files name no sandbox key, and parsing each one would slow verify on large runs. A
+    // key spelled with an escape only shows once parsed.
+    if (!/"(?:sandboxId|subjectSandboxId|providerResources|resources)"|\\u/.test(text))
+        return [];
+    const parse = (part) => {
+        try {
+            return [JSON.parse(part)];
+        }
+        catch {
+            return [];
+        }
+    };
+    if (/\.json$/i.test(file))
+        return parse(text);
+    if (/\.(?:ndjson|jsonl)$/i.test(file))
+        return text.split("\n").flatMap(parse);
+    return [];
+}
+/**
+ * Every raw sandbox id a run's files name: the receipts', and any at a sandbox-id key in its
+ * JSON, which is where a run from before 0.110 that has no receipts still records them.
+ */
+export function inventorySandboxIds(files) {
+    const ids = new Set();
+    for (const file of files) {
+        if (file.path === SANDBOX_RECEIPTS_ARTIFACT) {
+            for (const id of receiptSandboxIds(file.bytes))
+                ids.add(id);
+            continue;
+        }
+        for (const record of jsonRecords(file.path, file.bytes.toString("utf8")))
+            for (const id of keyedSandboxIds(record))
+                ids.add(id);
+    }
+    return [...ids];
+}
+/** Whether a run file's JSON holds a raw id at a sandbox-id key, which no receipt may name. */
+export function holdsKeyedSandboxId(file, text) {
+    return jsonRecords(file, text).some((record) => collectSandboxIds(record).size > 0);
+}
+/**
+ * The raw sandbox ids a run's receipts journal, with any this process receipted whose append
+ * failed; empty when there are none or the journal cannot be read.
+ */
+export async function readRunSandboxIds(root) {
+    let journaled = [];
+    try {
+        const bytes = await readContainedRegularFile(root, SANDBOX_RECEIPTS_ARTIFACT);
+        if (bytes)
+            journaled = receiptSandboxIds(bytes);
+    }
+    catch {
+        // The ids this process receipted still apply.
+    }
+    return [...new Set([...journaled, ...appendedSandboxIds(root)])];
+}
+/**
+ * `value` as a run writes it: raw sandbox ids stay in the run's sandbox-receipts.ndjson, and the
+ * file names each by marker and digest.
+ */
+export async function withPublicSandboxIds(root, value) {
+    return publicSandboxView(value, await readRunSandboxIds(root));
+}
+/**
+ * The bytes of `file` with each raw id replaced by its label: the same buffer when none occurs, or
+ * when the bytes are not the plain text verify and export read as text.
+ */
+export function scrubSandboxIdBytes(file, bytes, ids) {
+    if (!ids.some((id) => id.length > 0 && bytes.includes(id)))
+        return bytes;
+    const decoded = readPlainText(bytes);
+    if (!decoded.ok)
+        return bytes;
+    const label = /\.ya?ml$/i.test(file) ? yamlSandboxIdLabel : sandboxIdLabel;
+    return Buffer.from(scrubSandboxIds(decoded.text, ids, label));
+}
+/** The run files the sweep rewrites: the text formats export copies, and the Observer page. */
+const TEXT_FILE = /\.(?:json|ndjson|jsonl|md|txt|log|yaml|yml|csv|html)$/i;
+/** Enough for any run directory; a sweep stops there rather than hold up the run's finish. */
+const MAX_SWEPT_ENTRIES = 10_000;
+/**
+ * Rewrite each file of a finished run that names one of its raw sandbox ids, apart from the
+ * receipts, with the label in place of the id. Writers such as a participant's actor.json can
+ * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
+ * Best effort: verify grades a file this misses.
+ */
+export async function scrubRunSandboxIds(paths) {
+    const ids = await readRunSandboxIds(paths);
+    if (ids.length === 0)
+        return;
+    const valid = await validatePreparedRunRootIdentity(paths).then(() => true, () => false);
+    if (!valid)
+        return;
+    const scrub = async (file) => {
+        const bytes = await readContainedRegularFile(paths, file);
+        if (bytes === null)
+            return;
+        const scrubbed = scrubSandboxIdBytes(file, bytes, ids);
+        if (scrubbed !== bytes)
+            await writeContainedOutputFile(paths, file, scrubbed);
+    };
+    let seen = 0;
+    const walk = async (relative) => {
+        const directory = path.join(paths.physicalRunRoot, relative);
+        // A directory replaced by a link after it was listed resolves elsewhere and is not walked.
+        if ((await realpath(directory).catch(() => null)) !== directory)
+            return;
+        const listing = await opendir(directory).catch(() => null);
+        if (listing === null)
+            return;
+        for await (const entry of listing) {
+            // Returning from the loop closes the listing.
+            if (++seen > MAX_SWEPT_ENTRIES)
+                return;
+            const file = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                await walk(file);
+            else if (entry.isFile() && file !== SANDBOX_RECEIPTS_ARTIFACT && TEXT_FILE.test(file))
+                // A file that cannot be scrubbed stays as written; verify names it.
+                await scrub(file).catch(() => { });
+        }
+    };
+    await walk("").catch(() => {
+        // A directory that changed while it was listed ends the sweep; verify names what it missed.
+    });
+}
+/**
+ * A run's result as it may be returned or printed: the same object when it names no sandbox,
+ * otherwise its public view, scrubbed of the ids the run's receipts journal.
+ */
+export async function publicRunResult(result, cwd) {
+    let ids = [];
+    if (typeof result.runId === "string" && isSafeRunIdSegment(result.runId)) {
+        try {
+            ids = await readRunSandboxIds(await bindExistingRunArtifactPaths(cwd, result.runId));
+        }
+        catch {
+            // A run that never created its directory has no receipts; the keys are still redacted.
+        }
+    }
+    return publicSandboxView(result, ids);
+}

package/dist/run/sandbox-receipts.d.ts

@@ -20,6 +20,8 @@ export interface SandboxReceipt {
 export interface ParsedSandboxReceipt extends Omit<SandboxReceipt, "provider"> {
     provider: string;
 }
+/** The ids this process has receipted for `root`, whether or not the journal write landed. */
+export declare function appendedSandboxIds(root: PreparedOutputRoot): string[];
 /**
  * Append one receipt. Best-effort by design: the receipt exists to protect the run, so a failed
  * receipt write must never fail the participant. The only cost of a miss is that `reclaim` cannot see

package/dist/run/sandbox-receipts.js

@@ -4,6 +4,23 @@
 import { appendFile } from "node:fs/promises";
 import { prepareContainedOutputFile } from "./contained-output.js";
 export const SANDBOX_RECEIPTS_ARTIFACT = "sandbox-receipts.ndjson";
+/**
+ * The ids this process has receipted for each run directory, kept even when the append fails, so
+ * the run's other records can still be scrubbed of them. Keyed by the directory's identity, so a
+ * run created later at a deleted run's path starts empty, and only the latest runs are kept.
+ */
+const appended = new Map();
+const MAX_REMEMBERED_RUNS = 64;
+function rootKey(root) {
+    const [where, { dev, ino, birthtimeNs }] = "physicalRunRoot" in root
+        ? [root.physicalRunRoot, root.runRootIdentity]
+        : [root.physicalPath, root.identity];
+    return `${where}\0${dev}:${ino}:${birthtimeNs}`;
+}
+/** The ids this process has receipted for `root`, whether or not the journal write landed. */
+export function appendedSandboxIds(root) {
+    return [...(appended.get(rootKey(root)) ?? [])];
+}
 /**
  * Append one receipt. Best-effort by design: the receipt exists to protect the run, so a failed
  * receipt write must never fail the participant. The only cost of a miss is that `reclaim` cannot see
@@ -11,6 +28,15 @@ export const SANDBOX_RECEIPTS_ARTIFACT = "sandbox-receipts.ndjson";
  * artifact write uses; append (not atomic-replace) keeps racing participants' receipts intact.
  */
 export async function appendSandboxReceipt(root, receipt) {
+    const key = rootKey(root);
+    const ids = appended.get(key) ?? new Set();
+    appended.delete(key);
+    appended.set(key, ids.add(receipt.sandboxId));
+    for (const oldest of appended.keys()) {
+        if (appended.size <= MAX_REMEMBERED_RUNS)
+            break;
+        appended.delete(oldest);
+    }
     try {
         const filePath = await prepareContainedOutputFile(root, SANDBOX_RECEIPTS_ARTIFACT);
         await appendFile(filePath, `${JSON.stringify(receipt)}\n`, "utf8");

package/dist/run/status.js

@@ -12,6 +12,7 @@
 import { isProvenanceField, studyFields } from "./study-provenance.js";
 import { writeContainedOutputFile } from "./contained-output.js";
 import { redactText } from "../evidence/redaction.js";
+import { readRunSandboxIds, scrubSandboxIds } from "./sandbox-ids.js";
 export const RUN_STATUS_SCHEMA = "humanish.run-status.v1";
 /** The file, relative to the run directory. */
 export const RUN_STATUS_FILE = "status.json";
@@ -106,10 +107,12 @@ export function beginRunStatus(runPaths, options) {
             if (finishedRecord === undefined)
                 return;
             // The record is public-safe by construction, so each message passes the shape redaction
-            // again even though the routes scrubbed it.
+            // again even though the routes scrubbed it. A route settles with its own result, so an SDK
+            // error here can still name a sandbox; the receipts give the ids to replace.
+            const ids = await readRunSandboxIds(runPaths);
             const redacted = (failure) => ({
                 kind: failure.kind,
-                message: redactText(failure.message),
+                message: scrubSandboxIds(redactText(failure.message), ids),
             });
             const execution = {
                 succeeded: result.execution.succeeded,

package/dist/run/stored-runs.js

@@ -1,3 +1,4 @@
+import { REDACTED_SANDBOX_ID, sandboxIdDigest } from "../evidence/redaction.js";
 import { lstat, readdir } from "node:fs/promises";
 import { runNotFoundMessage } from "./run-not-found.js";
 import path from "node:path";
@@ -30,7 +31,15 @@ function cleanupRefusal(cwd, runInput, checkedAt, error, bundlePath) {
 }
 /** What the recorded evidence says about one provider resource; nothing is killed from here. */
 function recordedResourceResult(resource) {
-    const base = { provider: resource.provider, kind: resource.kind, id: resource.id };
+    // Named by digest: a run recorded before 0.110 holds the raw id here, which is digested.
+    const raw = resource.id === REDACTED_SANDBOX_ID ? undefined : resource.id;
+    const idDigest = resource.idDigest ?? (raw === undefined ? undefined : sandboxIdDigest(raw));
+    const base = {
+        provider: resource.provider,
+        kind: resource.kind,
+        id: REDACTED_SANDBOX_ID,
+        ...(idDigest === undefined ? {} : { idDigest }),
+    };
     if (resource.provider !== "e2b-desktop" || resource.kind !== "sandbox") {
         return {
             ...base,

package/dist/run-study.js

@@ -19,6 +19,7 @@ import {} from "./routes/shared-world/types.js";
 import { admitTerminalPlan, terminalStudyRefusal } from "./routes/terminal/route.js";
 import {} from "./routes/terminal/types.js";
 import {} from "./run/bundle.js";
+import { publicRunResult } from "./run/sandbox-ids.js";
 import { isLocalBrowserStudy, localBrowserDefaults } from "./substrates/local/runtime-config.js";
 /**
  * Runs a study on its route. The options are checked against the route and mapped into the route's
@@ -100,7 +101,11 @@ export async function prepareStudy(config, options, deps = {}) {
                 // study, so a rebuilt one would leave the participants they start for no finally to close.
                 const outcome = await admitted.run(scorer);
                 outcome.result.warnings.push(...normalized.warnings);
-                return outcome;
+                // The result names each sandbox by digest; the raw ids stay in the run's receipts.
+                return {
+                    ...outcome,
+                    result: await publicRunResult(outcome.result, options.cwd),
+                };
             }
             finally {
                 await vm?.close();

package/dist/study/doctor.js

@@ -227,7 +227,7 @@ async function realEmailCheck(connection, keys, args) {
         message: name === null
             ? "The selected email connection is missing or invalid. Open Connections in the TUI."
             : !args.keyPresent(name)
-                ? `Missing ${name} for the selected email connection. Provide it through process env or --env-file. Authentication has not been checked.`
+                ? `Missing ${name} for the selected email connection. Provide it through process env or --dotenv. Authentication has not been checked.`
                 : "Fresh hosted inbox per participant. Local presence only; run humanish comms check --online to authenticate. Provider permissions/capacity and delivery remain untested.",
     };
 }
@@ -300,7 +300,7 @@ function subjectEnvChecks(names, args) {
         ok: !!args.env[name]?.trim() || args.keyPresent(name),
         message: args.env[name]?.trim() || args.keyPresent(name)
             ? "present; value not shown"
-            : "missing declared subject environment variable; provide it with --env-file",
+            : "missing declared subject environment variable; provide it with --dotenv",
     }));
 }
 /** The post-run analysis: the Codex account, or the OpenAI key and the analysis cost limit. */

package/dist/study/init-templates.js

@@ -245,9 +245,9 @@ title: Computer-use browser study
 description: >-
   A computer-use participant drives your app in a hosted desktop browser and writes its evidence
   to gitignored .humanish/. Starts as a dry run. For a live session, set mode to live
-  and pass OPENAI_API_KEY and E2B_API_KEY with --env-file. The clone subject below serves your
+  and pass OPENAI_API_KEY and E2B_API_KEY with --dotenv. The clone subject below serves your
   repo inside the sandbox, and the env names declared under subject get their values from
-  --env-file without the values being saved. Screenshots keep full fidelity by default; set
+  --dotenv without the values being saved. Screenshots keep full fidelity by default; set
   policies.redactScreenshots: true to blur them at capture for a bundle you can share as is.
   Typed text is recorded as its length only.
 route: computer-use

package/dist/study/types.d.ts

@@ -239,7 +239,7 @@ export interface StudySubject {
     serve?: StudySubjectServe;
     /**
      * Env var names the subject app needs, provisioned into the sandbox from the caller's
-     * environment (--env-file). Names are recorded in evidence; values never are. Consumed
+     * environment (--dotenv). Names are recorded in evidence; values never are. Consumed
      * on the computer-use clone route.
      */
     env?: string[];

package/dist/verify/artifacts.d.ts

@@ -37,6 +37,10 @@ export declare function rawScreenshotStreamIds(bundle: RunBundle, redactedShapeF
 interface RegisteredStreamMedia {
     recordingPaths: Set<string>;
     screenshotPaths: Set<string>;
+    /** The run's raw sandbox ids, from its receipts; any other file holding one is listed below. */
+    sandboxIds?: readonly string[];
+    /** Filled by the scan: files other than the receipts that name a raw sandbox id. */
+    sandboxIdFiles?: string[];
 }
 /**
  * Scans every run file for secret and path patterns and returns the findings. A file that is not

package/dist/verify/artifacts.js

@@ -7,6 +7,8 @@ import { readPlainText } from "../evidence/plain-text.js";
 import { containsSensitive } from "../evidence/redaction.js";
 import { isLocalEvidenceArtifactPath, isRiskyPublicArtifactPath, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { openContainedRegularFile } from "../run/contained-output.js";
+import { holdsKeyedSandboxId } from "../run/sandbox-ids.js";
+import { SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { readSafeRunArtifactBytes, readSafeRunArtifactJson } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
 import { TERMINAL_EVENTS_ARTIFACT } from "../run/terminal-contract.js";
@@ -348,6 +350,12 @@ async function scanRunPublicSafetyDirectory(runPaths, relativeDirectory, finding
             unscanned.push(relativePath);
             continue;
         }
+        // A receipt's id in any other file, or a raw id at a sandbox-id key, which an older run or
+        // export copy can hold with no receipt to name it.
+        if (relativePath !== SANDBOX_RECEIPTS_ARTIFACT &&
+            (media.sandboxIds?.some((id) => decoded.text.includes(id)) ||
+                holdsKeyedSandboxId(relativePath, decoded.text)))
+            media.sandboxIdFiles?.push(relativePath);
         // serve renders observer/index.html from run.json and export regenerates it, so the on-disk
         // copy reaches neither. It embeds the Observer's own base64 fonts and scripts.
         const scan = scanEncodedTextCached(decoded.text, {

package/dist/verify/liveness.js

@@ -1,6 +1,7 @@
 // `humanish verify`'s RUN_NOT_FINISHED warning. Verify checks the integrity of what a run wrote,
 // and a run killed mid-way leaves an in-progress bundle that passes those checks. The warning says
 // what verify saw on disk, so `ok: true` is not read as "the run finished". It never flips `ok`.
+import { sandboxIdDigest } from "../evidence/redaction.js";
 import path from "node:path";
 import { readRunJsonIfExists, readRunTextIfExists } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
@@ -45,12 +46,14 @@ export async function runNotFinishedWarnings(runPaths, bundle, nowMs = Date.now(
 /** What the reclaim receipt says about the sandboxes this run journaled, or what to run. */
 async function reclaimState(runPaths, runId) {
     const journal = await readRunTextIfExists(runPaths, SANDBOX_RECEIPTS_ARTIFACT);
-    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => receipt.sandboxId));
+    // Matched by digest: a reclaim receipt names each sandbox by digest, and one written before it
+    // did holds the raw id, which is digested here.
+    const journaled = new Set((journal === null ? [] : parseSandboxReceipts(journal)).map((receipt) => sandboxIdDigest(receipt.sandboxId)));
     const receipt = await readRunJsonIfExists(runPaths, RECLAIM_RECEIPT_ARTIFACT);
     const outcomes = reclaimOutcomes(receipt, runId);
     if (outcomes !== undefined) {
         const gone = outcomes.filter((outcome) => GONE_STATES.has(outcome.state)).length;
-        const reclaimed = new Set(outcomes.map((outcome) => outcome.sandboxId));
+        const reclaimed = new Set(outcomes.map((outcome) => outcome.digest));
         const missing = [...journaled].filter((id) => !reclaimed.has(id)).length;
         return `${RECLAIM_RECEIPT_ARTIFACT} records ${gone} of ${outcomes.length} sandboxes gone${missing === 0 ? "" : `, and ${missing} journaled sandboxes are not in it`}.`;
     }
@@ -66,10 +69,11 @@ function reclaimOutcomes(receipt, runId) {
     for (const outcome of receipt.outcomes) {
         if (!isRecord(outcome))
             return undefined;
-        const { sandboxId, state } = outcome;
+        const { sandboxId, sandboxIdDigest: recorded, state } = outcome;
         if (typeof sandboxId !== "string" || typeof state !== "string")
             return undefined;
-        outcomes.push({ sandboxId, state });
+        const digest = typeof recorded === "string" ? recorded : sandboxIdDigest(sandboxId);
+        outcomes.push({ digest, state });
     }
     return outcomes;
 }

package/dist/verify/verify.d.ts

@@ -16,7 +16,7 @@ export interface VerifyResult {
     shareSafety: {
         status: "share_ready" | "local_only" | "blocked";
         reasons: Array<{
-            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
+            code: "VERIFY_FAILED" | "PUBLIC_SAFETY_FINDINGS" | "ANALYSIS_UNVERIFIED" | "RAW_SCREENSHOTS" | "RAW_SANDBOX_ID" | "CONTINUOUS_MEDIA" | "REAL_COMMUNICATIONS" | "UNSCANNED_ARTIFACT";
             message: string;
         }>;
     };

package/dist/verify/verify.js

@@ -2,7 +2,8 @@ import path from "node:path";
 import { listAnalysisExecutions } from "../analysis/store-executions.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { analysisSharingProblems } from "../analysis/sharing.js";
-import { containsSensitive } from "../evidence/redaction.js";
+import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
+import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA } from "../run/bundle.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
@@ -83,11 +84,17 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
     }));
     const derivedPublicSafetyFindings = [];
     const unscannedArtifacts = [];
+    const sandboxIdFiles = [];
     const publicSafetyFindings = await scanRunPublicSafetyArtifacts(runPaths, derivedPublicSafetyFindings, {
         recordingPaths: new Set(isRunBundle(bundle)
             ? bundle.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : []))
             : []),
         screenshotPaths: isRunBundle(bundle) ? streamScreenshotPaths(bundle) : new Set(),
+        // A run from before 0.110 with no receipts still names its ids in run.json.
+        sandboxIds: [
+            ...new Set([...(await readRunSandboxIds(runPaths)), ...keyedSandboxIds(bundle)]),
+        ],
+        sandboxIdFiles,
     }, unscannedArtifacts);
     // JSON escapes can hide a sensitive value from the byte scan while the
     // decoded recording exposes it to Observer, feedback, or analysis input.
@@ -146,6 +153,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             publicSafetyFindings,
             unscannedArtifacts,
             redactedShapeFrames,
+            sandboxIdFiles,
         })
         : {
             status: "blocked",
@@ -366,6 +374,18 @@ function buildShareSafety(args) {
             message: `The public-safety scan cannot read ${plural(paths.length, "file")} as text that ${paths.length === 1 ? "is not a stream screenshot under screenshots/ or a registered recording" : "are not stream screenshots under screenshots/ or registered recordings"}: ${shown}${more > 0 ? ` and ${more} more` : ""}. Review them before sharing.`,
         });
     }
+    // Runs from 0.110 keep raw sandbox ids only in sandbox-receipts.ndjson. An earlier run records
+    // them in run.json, and any file that names one is not share-ready as it is.
+    const rawResources = (args.bundle.providerResources ?? []).some((resource) => resource.id !== REDACTED_SANDBOX_ID);
+    if (rawResources || args.sandboxIdFiles.length > 0) {
+        const files = [
+            ...new Set([...(rawResources ? [RUN_BUNDLE_FILE] : []), ...args.sandboxIdFiles]),
+        ];
+        reasons.push({
+            code: "RAW_SANDBOX_ID",
+            message: `Raw sandbox ids appear in ${files.sort().join(", ")}. Runs from 0.110 keep them only in sandbox-receipts.ndjson; \`humanish export --format bundle --redact-screenshots\` writes a copy without them.`,
+        });
+    }
     const rawStreamIds = rawScreenshotStreamIds(args.bundle, args.redactedShapeFrames);
     if (rawStreamIds.length > 0) {
         reasons.push({

package/docs/architecture/restricted-codex-analysis.md

@@ -176,7 +176,7 @@ the following, on Linux x64:
    runs this check; see "The qualifier" below.
 3. One hosted participant study with the candidate first on `PATH` (for example
    `PATH=<evidence>/npm-<version>/node_modules/.bin:$PATH pnpm humanish run <study>
---env-file <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
+--dotenv <file with E2B_API_KEY only>`) reached its goal in the final capture, with a
    verified request receipt, `humanish verify --run <id>` passing and the automatic Codex
    analysis recording the release. Keep `OPENAI_API_KEY` out of that environment so the
    participant stays on ChatGPT-account billing.

package/docs/contracts/run-bundle.md

@@ -525,6 +525,10 @@ bundle is safe to promote into a public issue. Public promotion should branch on
 
 - `share_ready`: feedback draft commands may render public issue payloads;
 - `local_only`: keep the run local; only supported redaction-only cases can produce a shareable derivative;
+  `RAW_SANDBOX_ID` is one: a file other than `sandbox-receipts.ndjson` names one of the run's raw
+  sandbox ids, which verify reads from the receipts and from any raw `providerResources[].id` in
+  `run.json`, or a JSON file holds a raw id at a sandbox-id key. Runs from 0.110 keep raw ids only in the receipts, so it fires on runs recorded
+  before 0.110, whose `run.json` holds them, until they are exported;
 - `blocked`: fix the verification or public-safety failure first.
 
 `ok: true` also does not mean the run finished. A run killed mid-way leaves an
@@ -540,7 +544,9 @@ writing; an older one reads as interrupted. The warning names what verify saw:
   there is no usable record;
 - how many streams are still `running`;
 - what `reclaim-receipt.json` records: how many of the run's sandboxes are gone
-  (killed or already gone), and how many journaled sandboxes it does not cover;
+  (killed or already gone), and how many journaled sandboxes it does not cover. It
+  matches its outcomes to the receipts by `sandboxIdDigest`; a reclaim receipt from
+  before 0.110 names raw ids, which are digested to match;
 - with journaled sandboxes and no reclaim receipt, the command that stops them:
   `humanish reclaim --run <id>`.
 
@@ -634,9 +640,17 @@ finding is true. Its own bytes are not included in its hash inventory. Feedback
 commands can subsequently generate new derivative-local artifacts.
 
 The derivative names no sandbox. In every JSON and NDJSON file it copies, the
-values at `sandboxId`, `subjectSandboxId` and each `providerResources[].id` read
-`[redacted-sandbox-id]`; `sandbox-receipts.ndjson` is omitted. The source keeps
-its raw ids, which cleanup and reclaim read.
+values at `sandboxId`, `subjectSandboxId`, each `providerResources[].id` and each
+cleanup.json `resources[].id` read `[redacted-sandbox-id]`, with the id's digest
+beside them. In every text file it copies, Markdown, logs and YAML included, each
+id the source names becomes `[redacted-sandbox-id <digest>]`: the ids in its
+`sandbox-receipts.ndjson`, and any raw id at one of those keys, which is where a
+run recorded before 0.110 with no receipts names them. Only those exact ids are
+replaced, so the rest of each file is unchanged. In YAML the label is
+`redacted-sandbox-id-<digest>`, without brackets, so a value keeps its type.
+An id that appears only in free text, in a run with no receipts, is not known to
+export. `sandbox-receipts.ndjson` is omitted, and the source keeps its raw ids,
+which reclaim reads.
 
 PNG files that actor traces reference as stream screenshots are re-encoded as
 blurred thumbnails. A PNG that nothing in `run.json` cites is omitted and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.109.1",
+  "version": "0.110.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",
@@ -56,9 +56,10 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && pnpm --filter humanish-observer build && pnpm --filter humanish-tui build && node scripts/finish-build.mjs",
-    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm tui:smoke",
+    "check": "pnpm format:check && pnpm lint && pnpm knip && pnpm prose:check && pnpm vocabulary:check && pnpm site-css:check && pnpm typecheck && pnpm test && pnpm tui:test && pnpm build && pnpm guest-media:startup:proof && pnpm cli:startup:test && pnpm cli:preflight:test && pnpm cli:dotenv:test && pnpm tui:smoke",
     "cli:startup:test": "node scripts/terminal-startup-exit-proof.mjs",
     "cli:preflight:test": "node scripts/task-route-preflight-proof.mjs",
+    "cli:dotenv:test": "node scripts/dotenv-proof.mjs",
     "humanish": "tsx src/cli.ts",
     "pack:dry-run": "npm pack --dry-run",
     "prepack": "pnpm build",

package/skills/humanish/SKILL.md

@@ -16,7 +16,7 @@ patient data, or private upstream artifacts.
 
 Do not edit `.env` or secret files. Do not paste credential values. Use env var
 names only, usually `OPENAI_API_KEY` and `E2B_API_KEY`. For live local runs,
-prefer an explicit ignored env file passed with `--env-file <path>`; do not
+prefer an explicit ignored env file passed with `--dotenv <path>`; do not
 assume broad inherited job env is safe. Stop before live provider spend,
 hosted execution, deploys, public tunnels, or GitHub mutation unless the user
 explicitly approves that exact action.
@@ -442,7 +442,7 @@ Do not paste values into files, prompts, run bundles, issue drafts, or logs.
 Load local values only at invocation time:
 
 ```bash
-npx humanish watch .humanish/studies/local-live.yaml --env-file .humanish/local/provider.env
+npx humanish watch .humanish/studies/local-live.yaml --dotenv .humanish/local/provider.env
 ```
 
 When choosing dogfood targets, prefer apps, CLIs, or agent-facing tools with a