humanish 0.109.1 → 0.110.1

package/dist/evidence/redaction.js

@@ -60,12 +60,65 @@ function redactLocalPaths(text, label) {
  * passes only this value at a sandbox-id key.
  */
 export const REDACTED_SANDBOX_ID = "[redacted-sandbox-id]";
-/** The keys run writers put a sandbox id under; `providerResources` entries hold one as `id`. */
+/** The keys run writers put a sandbox id under; resource entries hold one as `id`. */
 const SANDBOX_ID_KEYS = new Set(["sandboxId", "subjectSandboxId"]);
+/** Arrays of sandbox records: run.json's `providerResources` and cleanup.json's `resources`. */
+const RESOURCE_ARRAY_KEYS = new Set(["providerResources", "resources"]);
+/** A sandbox id's public stand-in: its digest matches a receipt without naming the sandbox. */
+export function sandboxIdDigest(id) {
+    return digestText(id, 16);
+}
+/** The digest field written beside a redacted id: `idDigest`, `sandboxIdDigest`, … */
+const digestKey = (key) => `${key}Digest`;
+/**
+ * The entries of `object` with each raw id at one of `keys` replaced by REDACTED_SANDBOX_ID and its
+ * digest written beside it, unless the object already records one.
+ */
+function redactIdEntries(object, keys) {
+    const entries = Object.entries(object);
+    const present = new Set(entries.map(([key]) => key));
+    return entries.flatMap(([key, child]) => {
+        if (!keys.has(key) || typeof child !== "string" || child === REDACTED_SANDBOX_ID)
+            return [[key, child]];
+        // A label that a text scrub left at the key already carries the id's digest.
+        const digest = SANDBOX_ID_LABEL.exec(child)?.[1] ?? sandboxIdDigest(child);
+        return [
+            [key, REDACTED_SANDBOX_ID],
+            ...(present.has(digestKey(key)) ? [] : [[digestKey(key), digest]]),
+        ];
+    });
+}
+/** How free text names a sandbox: the marker with the id's digest inside it. */
+const SANDBOX_ID_LABEL = /^\[redacted-sandbox-id ([0-9a-f]{16})\]$/;
+const RESOURCE_ID_KEYS = new Set(["id"]);
+/** A raw id at a sandbox-id key: neither the marker nor a label that names its digest. */
+const isRawSandboxId = (value) => typeof value === "string" && value !== REDACTED_SANDBOX_ID && !SANDBOX_ID_LABEL.test(value);
+/** The raw ids at the keys redactSandboxIds replaces, anywhere in `value`. */
+export function collectSandboxIds(value, into = new Set()) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectSandboxIds(item, into);
+        return into;
+    }
+    if (value === null || typeof value !== "object")
+        return into;
+    for (const [key, child] of Object.entries(value)) {
+        if (SANDBOX_ID_KEYS.has(key) && isRawSandboxId(child))
+            into.add(child);
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            for (const resource of child) {
+                const id = resource !== null && typeof resource === "object" ? Reflect.get(resource, "id") : null;
+                if (isRawSandboxId(id))
+                    into.add(id);
+            }
+        collectSandboxIds(child, into);
+    }
+    return into;
+}
 /**
- * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID: strings at `sandboxId` and
- * `subjectSandboxId`, and the `id` of each `providerResources` entry. A run keeps raw ids as local
- * evidence for cleanup; a copy made to be shared names no sandbox.
+ * `value` with every sandbox id replaced by REDACTED_SANDBOX_ID plus its digest: strings at
+ * `sandboxId` and `subjectSandboxId`, and the `id` of each `providerResources` or `resources` entry. Raw ids live
+ * only in a run's sandbox-receipts.ndjson; every record and output names a sandbox by digest.
  */
 export function redactSandboxIds(value) {
     if (Array.isArray(value)) {
@@ -74,28 +127,19 @@ export function redactSandboxIds(value) {
     }
     if (value === null || typeof value !== "object")
         return value;
-    let changed = false;
     // fromEntries keeps a key such as __proto__ an own property, as JSON.parse made it.
-    const entries = Object.entries(value).map(([key, child]) => {
-        let next;
-        if (SANDBOX_ID_KEYS.has(key) && typeof child === "string")
-            next = REDACTED_SANDBOX_ID;
-        else if (key === "providerResources" && Array.isArray(child))
-            next = child.map((resource) => resource !== null &&
-                typeof resource === "object" &&
-                !Array.isArray(resource) &&
-                "id" in resource
-                ? Object.fromEntries(Object.entries(redactSandboxIds(resource)).map(([field, entry]) => [
-                    field,
-                    field === "id" ? REDACTED_SANDBOX_ID : entry,
-                ]))
-                : redactSandboxIds(resource));
-        else
-            next = redactSandboxIds(child);
-        if (next !== child && JSON.stringify(next) !== JSON.stringify(child))
-            changed = true;
-        return [key, next];
+    const entries = redactIdEntries(value, SANDBOX_ID_KEYS).map(([key, child]) => {
+        if (RESOURCE_ARRAY_KEYS.has(key) && Array.isArray(child))
+            return [
+                key,
+                child.map((resource) => resource !== null && typeof resource === "object" && !Array.isArray(resource)
+                    ? Object.fromEntries(redactIdEntries(redactSandboxIds(resource), RESOURCE_ID_KEYS))
+                    : redactSandboxIds(resource)),
+            ];
+        return [key, redactSandboxIds(child)];
     });
+    const changed = entries.length !== Object.keys(value).length ||
+        entries.some(([key, child]) => child !== value[key]);
     return changed ? Object.fromEntries(entries) : value;
 }
 /** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */

package/dist/feedback/export-bundle.js

@@ -8,6 +8,7 @@ import { parse as parseYaml } from "yaml";
 import { ACTOR_TRACE_SCHEMA } from "../actors/contract.js";
 import { renderObserver } from "../observer/render.js";
 import { buildObserverData } from "../observer/data.js";
+import { inventorySandboxIds, scrubSandboxIdBytes } from "../run/sandbox-ids.js";
 import { containsSensitive, redactSandboxIds, redactScreenshot, redactText, } from "../evidence/redaction.js";
 import { decodeEscapes } from "../evidence/encoded-text.js";
 import { readPlainText } from "../evidence/plain-text.js";
@@ -300,6 +301,7 @@ function keptPngPaths(source, bundle) {
 async function writeDerivative(source, stagePaths, bundle) {
     const entries = [];
     const imagePaths = keptPngPaths(source, bundle);
+    const sandboxIds = inventorySandboxIds(source.files);
     let images = 0;
     for (const file of source.files) {
         const isPng = path.extname(file.path).toLowerCase() === ".png";
@@ -343,6 +345,7 @@ async function writeDerivative(source, stagePaths, bundle) {
                 }
                 bytes = jsonBytes(transformed);
             }
+            bytes = scrubSandboxIdBytes(file.path, bytes, sandboxIds);
             action = bytes.equals(file.bytes) ? "copied" : "updated";
         }
         await writeContainedOutputFile(stagePaths, file.path, bytes);
@@ -496,7 +499,9 @@ async function verifyFrozenSource(workspace, source, runId) {
                 verified.shareSafety.reasons.every(
                 // Both are repaired in the copy: frames are blurred, and an unread PNG is dropped or
                 // refused by keptPngPaths. Any other unread file fails as an unsupported format.
-                (reason) => reason.code === "RAW_SCREENSHOTS" || reason.code === "UNSCANNED_ARTIFACT")))) {
+                (reason) => reason.code === "RAW_SCREENSHOTS" ||
+                    reason.code === "RAW_SANDBOX_ID" ||
+                    reason.code === "UNSCANNED_ARTIFACT")))) {
         return { shareSafety: verified.shareSafety };
     }
     const loaded = await loadRunBundlePrepared(rawSnapshot.physicalPath, snapshotPaths);

package/dist/feedback/export.js

@@ -384,6 +384,9 @@ function shareSafetyRemedy(codes) {
     if (codes.includes("RAW_SCREENSHOTS")) {
         steps.push("Re-run with policies.redactScreenshots: true to blur screenshots at capture.");
     }
+    if (codes.includes("RAW_SANDBOX_ID")) {
+        steps.push("Export with --format bundle --redact-screenshots, which writes a copy without raw sandbox ids, and share from that copy.");
+    }
     if (codes.includes("UNSCANNED_ARTIFACT")) {
         steps.push("verify cannot read the files that `humanish verify --json` lists under UNSCANNED_ARTIFACT as text: remove them from the run folder, or keep only images an actor trace references as stream screenshots.");
     }

package/dist/keys/env-file.d.ts

@@ -11,5 +11,9 @@ export interface EnvFileLoadResult {
         message: string;
     };
 }
+/** Records in `env` the names a `--dotenv` file set there. */
+export declare function recordDotenvNames(env: NodeJS.ProcessEnv, names: readonly string[]): void;
+/** The names `--dotenv` set in `env`, as recordDotenvNames recorded them. */
+export declare function dotenvSetNames(env: Readonly<Record<string, string | undefined>>): Set<string>;
 export declare function loadEnvFile(cwd: string, envFile: string, env?: NodeJS.ProcessEnv): Promise<EnvFileLoadResult>;
 export {};

package/dist/keys/env-file.js

@@ -2,6 +2,23 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 const ENV_FILE_RESULT_SCHEMA = "humanish.env-file-result.v1";
 const envNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Names a `--dotenv` file set, kept as a comma list in the environment the values went into, so a
+ * process humanish starts with that environment (a run the TUI launches) knows them too. A
+ * host-side participant (the Claude Code local agent) never gets these names, even ones it would
+ * otherwise keep, such as a proxy.
+ */
+const DOTENV_NAMES = "HUMANISH_DOTENV_NAMES";
+/** Records in `env` the names a `--dotenv` file set there. */
+export function recordDotenvNames(env, names) {
+    if (names.length === 0)
+        return;
+    env[DOTENV_NAMES] = [...new Set([...dotenvSetNames(env), ...names])].join(",");
+}
+/** The names `--dotenv` set in `env`, as recordDotenvNames recorded them. */
+export function dotenvSetNames(env) {
+    return new Set((env[DOTENV_NAMES] ?? "").split(",").filter((name) => name.length > 0));
+}
 export async function loadEnvFile(cwd, envFile, env = process.env) {
     const resolvedCwd = path.resolve(cwd);
     const envPath = path.resolve(resolvedCwd, envFile);

package/dist/keys/key-resolution.d.ts

@@ -22,6 +22,11 @@ export declare function discoverProviderKeys(args: {
     deps?: KeyResolutionDeps;
     announced?: ReadonlySet<string>;
 }): Promise<ResolvedKeyFill[]>;
+/** What `--dotenv` loaded: the path as given, and the names it set because they were unset. */
+export interface DotenvLoad {
+    path: string;
+    names: readonly string[];
+}
 export interface KeySourceProbe {
     name: string;
     /** The source that supplies the key right now, or null when missing everywhere. */
@@ -43,6 +48,8 @@ export declare function probeKeySources(names: readonly string[], args: {
     cwd: string;
     env: NodeJS.ProcessEnv;
     deps?: KeyResolutionDeps;
+    /** The names `--dotenv` put into `env`, so their rows name the file, not the process env. */
+    dotenv?: DotenvLoad;
 }): Promise<KeySourceProbe[]>;
 /** Resolve a `humanish keys set` target: a vendor alias or a raw env name. Null = invalid. */
 export declare function resolveKeyName(vendorOrName: string): string | null;

package/dist/keys/key-resolution.js

@@ -1,8 +1,8 @@
 // Provider-key discovery: resolve the keys a live run needs through each vendor's
-// native chain instead of demanding a per-repo --env-file that operators hand-copy keys into.
+// native chain instead of demanding a per-repo --dotenv that operators hand-copy keys into.
 //
 // The chain, per key, fill-only (a rung never overrides anything already present):
-//   1. process env, including whatever --env-file just loaded (explicit always wins);
+//   1. process env, including whatever --dotenv just loaded (explicit always wins);
 //   2. `.humanish/local/provider.env`, the project-local overlay this CLI's own --help
 //      examples document;
 //   3. the owning vendor's native store, where one exists:
@@ -24,7 +24,7 @@ import { loadEnvFile } from "./env-file.js";
 /** The only names implicit discovery may fill (and `humanish keys set` may store). Everything
  *  else in an overlay/store file is ignored-and-named: a repo-planted NODE_OPTIONS/LD_PRELOAD
  *  must never enter process env off a file the operator did not explicitly pass (an explicit
- *  --env-file remains the operator's own full-file load). */
+ *  --dotenv remains the operator's own full-file load). */
 const KNOWN_PROVIDER_KEYS = [
     "OPENAI_API_KEY",
     "ANTHROPIC_API_KEY",
@@ -213,7 +213,7 @@ export async function discoverProviderKeys(args) {
         if (announced === undefined || announced.has(fill_.name))
             announce(`humanish keys: ${fill_.name} from ${fill_.source}`);
     for (const name of ignored)
-        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --env-file to load every name in it.`);
+        announce(`humanish keys: ignored ${name}, which is not a provider key. Discovery loads provider keys only; pass the file with --dotenv to load every name in it.`);
     return fills;
 }
 /** True when the file's parent directory is (or traverses) a symlink at its last component:
@@ -253,7 +253,7 @@ export function describeMissingKeys(names, env) {
     const hints = names.map((name) => `${name}: ${missingKeyHint(name)}`).join("; ");
     const strict = env.HUMANISH_STRICT_KEYS?.trim() === "1";
     const chain = strict
-        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --env-file are read"
+        ? "key discovery is disabled (HUMANISH_STRICT_KEYS=1); only process env and --dotenv are read"
         : `also checked ${PROJECT_OVERLAY_RELATIVE}, ~/.e2b/config.json, gh auth token, and ${path.join("~", ".config", "humanish", "keys.env")}`;
     return `${chain}. Fill: ${hints}.`;
 }
@@ -278,7 +278,9 @@ export async function probeKeySources(names, args) {
             args.env.GITHUB_TOKEN !== undefined &&
             args.env.GITHUB_TOKEN.trim() !== "";
         const source = inEnv
-            ? "process env"
+            ? args.dotenv?.names.includes(name)
+                ? `--dotenv ${args.dotenv.path}`
+                : "process env"
             : aliasInEnv
                 ? "process env (GITHUB_TOKEN)"
                 : (bySource.get(name) ?? null);
@@ -307,7 +309,7 @@ export function setUserKey(name, value, env, deps = {}) {
         throw new Error(`Not a valid env name: ${name}`);
     }
     if (!PROVIDER_KEY_SET.has(name)) {
-        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --env-file.`);
+        throw new Error(`The store holds provider keys only (${[...PROVIDER_KEY_SET].join(", ")}). For anything else, use an explicit --dotenv.`);
     }
     const storePath = userKeyStorePath(env, deps);
     const dir = path.dirname(storePath);
@@ -325,7 +327,7 @@ export function setUserKey(name, value, env, deps = {}) {
     // would silently resolve to a different secret on the next run.
     const roundTrip = parseStoreLine(`${name}=${trimmed}`);
     if (roundTrip === null || roundTrip[0] !== name || roundTrip[1] !== trimmed) {
-        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --env-file instead.");
+        throw new Error("The value does not round-trip the store format (avoid leading quotes and '#'); pass it via --dotenv instead.");
     }
     writeStore(storePath, entries);
     return { path: storePath };

package/dist/observer/data.d.ts

@@ -1,5 +1,6 @@
 import { type ActorEnding } from "../actors/stop-cause.js";
 import type { RunBundle, RunCostSummary, RunEvent, RunSimulation } from "../run/bundle.js";
+import { type RunDisplay } from "../run/display.js";
 import type { RunStream, RunStreamKind } from "../run/streams.js";
 export declare const OBSERVER_DATA_SCHEMA = "humanish.observer-data.v1";
 interface ObserverArtifactLink {
@@ -20,7 +21,14 @@ export interface ObserverData {
     run: {
         runId: string;
         mode: RunBundle["mode"];
+        /** The participants' verdict. `display` says whether the run passed. */
         status: RunBundle["review"]["verdict"];
+        /**
+         * How the run reads (runDisplay in src/run/display.ts): `passed` only when the verdict is pass
+         * and run.json's outcome does not say the run failed. Absent in observer-data.json written
+         * before it existed.
+         */
+        display?: RunDisplay;
         title: string;
         createdAt: string;
         simCount: number;
@@ -109,7 +117,12 @@ interface ObserverLaneGroup {
     surface?: string;
     caseGroup?: string;
 }
-export declare function buildObserverData(bundle: RunBundle, generatedAt?: string): ObserverData;
+/**
+ * The Observer's projection of a bundle. `statusRecord` is the run's status.json, read for a
+ * bundle with no outcome in run.json: a run in progress, interrupted, or recorded before run.json
+ * carried its outcome.
+ */
+export declare function buildObserverData(bundle: RunBundle, generatedAt?: string, statusRecord?: unknown): ObserverData;
 /** Refresh presentation from recorded actor evidence, including older exported snapshots. */
 export declare function withObserverEndings(data: ObserverData): ObserverData;
 export {};

package/dist/observer/data.js

@@ -2,6 +2,7 @@ import { actorEnding } from "../actors/stop-cause.js";
 import { isCommsReceivingEvidence, receivingAnalysisContext } from "../comms/receiving-evidence.js";
 import { formatParticipantOutcomes, formatRunTaskFunnel, participantOutcomeDetails, withCuaReviewProvenance, } from "../run/outcomes.js";
 import { cuaGoalSource, CUA_COMPLETION_NOTE } from "../actors/goal-source.js";
+import { bundleDisplayFacts, runDisplay } from "../run/display.js";
 export const OBSERVER_DATA_SCHEMA = "humanish.observer-data.v1";
 /** Discard a forged or stale runtime grant before projecting persisted evidence. */
 export function recordedStreamEmbed(embed) {
@@ -19,7 +20,12 @@ const allKinds = [
     "artifact",
     "summary",
 ];
-export function buildObserverData(bundle, generatedAt = new Date().toISOString()) {
+/**
+ * The Observer's projection of a bundle. `statusRecord` is the run's status.json, read for a
+ * bundle with no outcome in run.json: a run in progress, interrupted, or recorded before run.json
+ * carried its outcome.
+ */
+export function buildObserverData(bundle, generatedAt = new Date().toISOString(), statusRecord) {
     const byKind = Object.fromEntries(allKinds.map((kind) => [kind, 0]));
     const events = [...(bundle.events ?? [])];
     // Analysis cites this source-backed aggregate as context, not a participant
@@ -32,14 +38,17 @@ export function buildObserverData(bundle, generatedAt = new Date().toISOString()
     const streams = (bundle.streams ?? []).map((stream) => {
         const sim = bundle.simulations.find((candidate) => candidate.id === stream.simId) ??
             fallbackSimulation(bundle, stream);
-        // A natural session can finish its protocol while the participant explicitly reports a
-        // blocker. Match the review's typed-outcome rule without rewriting the raw trace or
-        // guessing from prose. Never turn an active or failed harness into a participant outcome.
-        const status = (stream.status === "passed" || stream.status === "complete") &&
-            stream.actor?.completionReason === "goal_satisfied" &&
-            stream.actor.declaredOutcome === "blocked"
-            ? "blocked"
-            : stream.status;
+        // The judge's status for the participant wins where the run recorded one, so a participant
+        // the verdict counted as blocked or as never engaging shows that way here. A bundle written
+        // before the judge's status was recorded keeps the typed-outcome reading: a natural session
+        // that finished while declaring a blocker. Never turn an active or failed harness into a
+        // participant outcome.
+        const status = stream.judgedStatus ??
+            ((stream.status === "passed" || stream.status === "complete") &&
+                stream.actor?.completionReason === "goal_satisfied" &&
+                stream.actor.declaredOutcome === "blocked"
+                ? "blocked"
+                : stream.status);
         byKind[stream.kind] += 1;
         return {
             ...stream,
@@ -77,6 +86,7 @@ export function buildObserverData(bundle, generatedAt = new Date().toISOString()
             runId: bundle.runId,
             mode: bundle.mode,
             status: bundle.review.verdict,
+            display: runDisplay(bundleDisplayFacts(bundle, statusRecord)),
             title: `${bundle.scenario.title} - ${bundle.persona.name}`,
             createdAt: bundle.createdAt,
             simCount: bundle.simCount ?? bundle.simulations.length,

package/dist/observer/library.d.ts

@@ -1,3 +1,4 @@
+import type { RunDisplay } from "../run/display.js";
 export interface LibraryHistory {
     latestRunId: string | null;
     runs: Array<{
@@ -5,7 +6,10 @@ export interface LibraryHistory {
         createdAt: string | null;
         mode: string | null;
         href: string;
+        /** The participants' verdict. `display` says whether the run passed. */
         status: string;
+        /** How the run reads (runDisplay in src/run/display.ts); absent when its data could not be read. */
+        display?: RunDisplay;
         /** Current contained status-record observation, separate from the evidence verdict. */
         runtimeState?: "running" | "finished" | "interrupted" | "unknown";
         streamCount: number;

package/dist/observer/library.js

@@ -1,9 +1,10 @@
-const STATUS_TONES = {
-    passed: "#3fb970",
-    running: "#4f8ff7",
-    failed: "#e5534b",
-    blocked: "#d29922",
-    timed_out: "#d29922",
+// The pip color for each RunDisplay tone; a run with no display gets the neutral gray.
+const DISPLAY_TONES = {
+    pass: "#3fb970",
+    live: "#4f8ff7",
+    fail: "#e5534b",
+    warn: "#d29922",
+    neutral: "#57606f",
 };
 export function renderLibraryHtml(history, opts) {
     const emptyState = opts.safe
@@ -83,7 +84,7 @@ main { padding: 1rem 1.1rem 3rem; max-width: 44rem; margin: 0 auto; }
 }
 // prose-check: script (the library page's JavaScript)
 function libraryClientJs() {
-    const tones = JSON.stringify(STATUS_TONES);
+    const tones = JSON.stringify(DISPLAY_TONES);
     return `
 (function () {
   var TONES = ${tones};
@@ -103,9 +104,11 @@ function libraryClientJs() {
       link.href = run.href;
       var top = document.createElement("div");
       top.className = "run-top";
+      var display = run.display || null;
+      var live = display !== null && display.state === "running";
       var pip = document.createElement("span");
-      pip.className = run.status === "running" ? "pip running" : "pip";
-      pip.style.background = TONES[run.status] || "#57606f";
+      pip.className = live ? "pip running" : "pip";
+      pip.style.background = (display && TONES[display.tone]) || TONES.neutral;
       var id = document.createElement("span");
       id.className = "run-id";
       id.textContent = run.runId;
@@ -116,15 +119,15 @@ function libraryClientJs() {
         latest.className = "badge latest";
         latest.textContent = "latest";
         top.appendChild(latest);
-      } else if (run.status === "running") {
-        var live = document.createElement("span");
-        live.className = "badge";
-        live.textContent = "live";
-        top.appendChild(live);
+      } else if (live) {
+        var badge = document.createElement("span");
+        badge.className = "badge";
+        badge.textContent = "live";
+        top.appendChild(badge);
       }
       var meta = document.createElement("div");
       meta.className = "run-meta";
-      var metaBits = [run.mode || "unknown", run.streamCount + " participants", run.createdAt || ""];
+      var metaBits = [display ? display.label : "", run.mode || "unknown", run.streamCount + " participants", run.createdAt || ""];
       // Labeled cost token: ALWAYS "~$X est." (never a bare "$X"), so the library never implies an
       // authoritative charge. Null = omitted (advisory, fail-open on display).
       if (run.costLabel) {

package/dist/observer/render.js

@@ -11,7 +11,8 @@ import { projectShareCheckedAnalysis } from "../analysis/sharing.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { physicalCwdOf, runIdOf, bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveLatestRunDirectory, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { writeContainedOutputFile } from "../run/contained-output.js";
-import { loadRunBundlePrepared } from "../run/locate.js";
+import { loadRunBundlePrepared, readRunJsonIfExists } from "../run/locate.js";
+import { RUN_STATUS_FILE } from "../run/status.js";
 import { verifyRunPrepared } from "../verify/verify.js";
 import { renderObserverHtml } from "./artifact.js";
 import { buildObserverData } from "./data.js";
@@ -99,7 +100,12 @@ export async function renderObserver(cwdInput, runInput, options = {}) {
         ...projectShareCheckedAnalysis(await loadAnalysis(preparedRunPaths)),
         ...(spend === null ? {} : { spend }),
     };
-    const observerData = buildObserverData(loaded.bundle);
+    // A run.json without an outcome is in progress, interrupted, or older than the field: its
+    // status.json says which, and holds an older run's ok.
+    const statusRecord = loaded.bundle.outcome === undefined
+        ? await readRunJsonIfExists(preparedRunPaths, RUN_STATUS_FILE)
+        : undefined;
+    const observerData = buildObserverData(loaded.bundle, undefined, statusRecord);
     observerData.publicSafety.share = {
         status: verified.shareSafety.status,
         verifiedAt: new Date().toISOString(),

package/dist/observer/run-routes.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RunDisplay } from "../run/display.js";
 import { type ObserverData } from "./data.js";
 import { type PinnedDirectory } from "./pinned-files.js";
 export interface ObserverRuntimeStreamUrl {
@@ -22,6 +23,7 @@ export declare function buildHistoryIndex(proofRoot: PinnedDirectory, admitRun?:
         mode: string | null;
         href: string;
         status: string;
+        display?: RunDisplay;
         runtimeState?: NonNullable<ObserverData["runtime"]>["state"];
         streamCount: number;
         estimatedCostUsd: number | null;

package/dist/observer/run-routes.js

@@ -8,7 +8,7 @@ import { listRuns } from "../run/stored-runs.js";
 import { readAnalysisAccounting } from "../run/costs.js";
 import { bindExistingRunArtifactPaths, isPathInside, isSafeRunIdSegment, } from "../run/paths.js";
 import { analysisCostOf, runCost, runCostLabel } from "../run/run-cost.js";
-import { RUN_STATUS_FILE, RUN_STATUS_STALE_MS, isRunStatusRecord } from "../run/status.js";
+import { RUN_STATUS_FILE, RUN_STATUS_STALE_MS, isRunStatusRecord, } from "../run/status.js";
 import { renderObserverHtml } from "./artifact.js";
 import { buildObserverData, recordedStreamEmbed, withObserverEndings, } from "./data.js";
 import { buildArtifactSecurityHeaders } from "./http.js";
@@ -120,6 +120,7 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
     }
 }
 async function readObserverData(runRoot, runtimeStreamUrls = []) {
+    const record = await readLocalRunStatus(runRoot);
     // Best-effort load from either source. Both reads swallow all errors on
     // purpose: this runs on every browser poll of a live run, where run.json may
     // be absent, still being written (a partial-JSON parse error), or superseded
@@ -130,57 +131,64 @@ async function readObserverData(runRoot, runtimeStreamUrls = []) {
         if (!bundleBytes)
             throw new Error("run.json unavailable");
         const bundle = JSON.parse(bundleBytes.toString("utf8"));
-        return withRuntimeStreamUrls(await withLocalRunStatus(runRoot, buildObserverData(bundle)), runtimeStreamUrls);
+        return withRuntimeStreamUrls(withLocalRunStatus(record, buildObserverData(bundle, undefined, record)), runtimeStreamUrls);
     }
     catch { }
     try {
         const observerBytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, "observer", "observer-data.json"));
         if (!observerBytes)
             throw new Error("observer-data.json unavailable");
-        return withRuntimeStreamUrls(await withLocalRunStatus(runRoot, withObserverEndings(JSON.parse(observerBytes.toString("utf8")))), runtimeStreamUrls);
+        return withRuntimeStreamUrls(withLocalRunStatus(record, withObserverEndings(JSON.parse(observerBytes.toString("utf8")))), runtimeStreamUrls);
     }
     catch { }
     return null;
 }
-/**
- * Liveness is a current read of a contained local status record, separate from run evidence.
- * A stale heartbeat means unknown: neither an old timestamp nor a persisted PID proves that a
- * process died (the evidence may have been copied from another machine). No PID is served/probed.
- */
-async function withLocalRunStatus(runRoot, input) {
-    // A served observation must never be inherited from a persisted projection or export.
-    const { runtime: _persistedRuntime, ...data } = input;
+/** The run directory's own status record, when it is well formed and names that directory. */
+async function readLocalRunStatus(runRoot) {
     try {
         const bytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, RUN_STATUS_FILE));
         if (!bytes)
-            return data;
+            return undefined;
         const record = JSON.parse(bytes.toString("utf8"));
-        if (!isRunStatusRecord(record) ||
-            record.runId !== data.run.runId ||
-            record.mode !== data.run.mode ||
-            record.runId !== path.basename(runRoot.physicalPath))
-            return data;
-        const now = Date.now();
-        const started = Date.parse(record.startedAt);
-        const updated = Date.parse(record.updatedAt);
-        const timestampsValid = Number.isFinite(started) && Number.isFinite(updated) && started <= updated && updated <= now;
-        let state = "unknown";
-        if (timestampsValid) {
-            if (record.state === "finished") {
-                state = "finished";
-            }
-            else if (record.state === "running" && now - updated <= RUN_STATUS_STALE_MS) {
-                state = "running";
-            }
-        }
-        return {
-            ...data,
-            runtime: { state, observedAt: new Date(now).toISOString(), source: "local-run-status" },
-        };
+        return isRunStatusRecord(record) && record.runId === path.basename(runRoot.physicalPath)
+            ? record
+            : undefined;
     }
     catch {
+        return undefined;
+    }
+}
+/**
+ * Liveness is a current read of a contained local status record, separate from run evidence.
+ * A stale heartbeat means unknown: neither an old timestamp nor a persisted PID proves that a
+ * process died (the evidence may have been copied from another machine). A record its stopped
+ * process wrote is interrupted. No PID is served/probed.
+ */
+function withLocalRunStatus(record, input) {
+    // A served observation must never be inherited from a persisted projection or export.
+    const { runtime: _persistedRuntime, ...data } = input;
+    if (record === undefined || record.runId !== data.run.runId || record.mode !== data.run.mode)
         return data;
+    const now = Date.now();
+    const started = Date.parse(record.startedAt);
+    const updated = Date.parse(record.updatedAt);
+    const timestampsValid = Number.isFinite(started) && Number.isFinite(updated) && started <= updated && updated <= now;
+    let state = "unknown";
+    if (timestampsValid) {
+        if (record.state === "finished") {
+            state = "finished";
+        }
+        else if (record.state === "interrupted") {
+            state = "interrupted";
+        }
+        else if (record.state === "running" && now - updated <= RUN_STATUS_STALE_MS) {
+            state = "running";
+        }
     }
+    return {
+        ...data,
+        runtime: { state, observedAt: new Date(now).toISOString(), source: "local-run-status" },
+    };
 }
 /** internal: exported for the stream lifecycle tests. */
 export function withRuntimeStreamUrls(data, runtimeStreamUrls) {
@@ -249,6 +257,7 @@ admitRun) {
             mode: admitRun ? (data?.run.mode ?? null) : run.mode,
             href: `/_humanish/runs/${encodeURIComponent(run.runId)}/observer/index.html`,
             status: data?.run.status ?? "unknown",
+            ...(data?.run.display === undefined ? {} : { display: data.run.display }),
             ...(data?.runtime ? { runtimeState: data.runtime.state } : {}),
             streamCount: data?.streams.length ?? 0,
             // Labeled run-total cost estimate (advisory; null when the run carries no cost summary).