humanish 0.111.0 → 0.111.1

package/dist/evidence/encoded-text.d.ts

@@ -4,8 +4,8 @@ export declare function decodeEscapes(text: string): string;
 export interface EncodedTextScanOptions {
     /** Do not count an encoded binary run as opaque. */
     readonly allowOpaqueBase64?: boolean;
-    /** Match secret shapes only, leaving local paths out, as a URL's path may look like one. */
-    readonly secretsOnly?: boolean;
+    /** What counts as sensitive in the text and in each decoding of it; containsSensitive by default. */
+    readonly matches?: (text: string) => boolean;
 }
 export interface EncodedTextScan {
     /** A secret or private path, in the text or in a decoding of it. */
@@ -27,4 +27,4 @@ export declare function scanEncodedText(text: string, options?: EncodedTextScanO
  * scan of the same string would give. Repeated verifies of an unchanged file, as serve admission
  * and the Observer render do, skip the scan.
  */
-export declare function scanEncodedTextCached(text: string, options?: EncodedTextScanOptions): EncodedTextScan;
+export declare function scanEncodedTextCached(text: string, options?: Pick<EncodedTextScanOptions, "allowOpaqueBase64">): EncodedTextScan;

package/dist/evidence/encoded-text.js

@@ -4,7 +4,7 @@
 // judge the same decoded text.
 import { createHash } from "node:crypto";
 import { readPlainText } from "./plain-text.js";
-import { containsSecret, containsSensitive } from "./redaction.js";
+import { containsSensitive } from "./redaction.js";
 // HTML5 named references that stand for printable ASCII. Letters and digits have only numeric
 // references, which decodeEscapes handles.
 const ASCII_ENTITIES = {
@@ -189,7 +189,7 @@ function decodeTransferEscapes(text) {
         .replace(/=\r?\n/g, "")
         .replace(/=([0-9A-F]{2})/g, (match, hex) => codePoint(Number.parseInt(hex, 16), match));
 }
-const matcherOf = (options) => options.secretsOnly === true ? containsSecret : containsSensitive;
+const matcherOf = (options) => options.matches ?? containsSensitive;
 const CLEAN = Object.freeze({ sensitive: false, opaque: false });
 const SENSITIVE = Object.freeze({ sensitive: true, opaque: false });
 function inspectDecoded(bytes, run, options, depth) {
@@ -261,7 +261,13 @@ export function scanEncodedText(text, options = {}, depth = 0) {
     for (const bytes of slashStarts)
         if (inspectDecoded(bytes, "", { ...options, allowOpaqueBase64: true }, depth).sensitive)
             return SENSITIVE;
-    for (const [match] of expanded.matchAll(HEX_RUN)) {
+    // Hex is read before transfer escapes too: the quoted-printable pass reads `=68` in `state=6874...`
+    // as one byte, which shifts every hex pair after it.
+    const hexRuns = new Set([
+        ...[...expanded.matchAll(HEX_RUN)].map(([match]) => match),
+        ...(expanded === decoded ? [] : [...decoded.matchAll(HEX_RUN)].map(([match]) => match)),
+    ]);
+    for (const match of hexRuns) {
         const plain = readPlainText(Buffer.from(match, "hex"));
         if (plain.ok && depth < MAX_DEPTH && scanEncodedText(plain.text, options, depth + 1).sensitive)
             return SENSITIVE;
@@ -271,7 +277,7 @@ export function scanEncodedText(text, options = {}, depth = 0) {
 // Bump when scanEncodedText, decodeEscapes or the sensitive patterns change what they return. The
 // cache lives in one process, so the version guards results across a hot reload or a test that
 // swaps the scanner.
-const ENCODED_SCAN_VERSION = 2;
+const ENCODED_SCAN_VERSION = 3;
 // Distinct files one process verifies in a burst (a run's files, a serve library's runs).
 const SCAN_CACHE_LIMIT = 256;
 const scanCache = new Map();
@@ -286,7 +292,6 @@ export function scanEncodedTextCached(text, options = {}) {
     const key = [
         ENCODED_SCAN_VERSION,
         options.allowOpaqueBase64 === true ? "opaque-allowed" : "opaque-unscanned",
-        options.secretsOnly === true ? "secrets-only" : "secrets-and-paths",
         createHash("sha256").update(Buffer.from(text, "utf16le")).digest("hex"),
     ].join(":");
     const cached = scanCache.get(key);

package/dist/evidence/redaction.d.ts

@@ -1,7 +1,7 @@
 /** Every pattern containsSensitive tests. A test pins each to ASCII, which scanEncodedText relies on. */
 export declare function sensitivePatterns(): readonly RegExp[];
-/** True if the text contains a secret-shaped token. Local paths do not count. */
-export declare function containsSecret(text: string): boolean;
+/** True if the text contains a credential. Local paths and a URL on an E2B host alone do not count. */
+export declare function containsCredential(text: string): boolean;
 /** True if the text contains any secret-shaped token or known local path. */
 export declare function containsSensitive(text: string): boolean;
 /**

package/dist/evidence/redaction.js

@@ -68,6 +68,14 @@ const E2B_PUBLIC_PAGE = [
     String.raw `(?:www\.)?e2b\.dev\/dashboard\/?(?:\?tab=[a-z]{1,16})?`,
     String.raw `(?:docs\.e2b\.dev|(?:www\.)?e2b\.dev\/docs)(?:\/[a-z][a-z-]{0,39}){0,8}\/?`,
 ].join("|");
+// Any URL on an E2B host: a sandbox host names its sandbox, and a stream URL carries its auth
+// key. The slashes may be JSON-escaped (`https:\/\/`). User info runs to its last `@`, as a URL
+// parser reads it, and may hold any character but a slash or space. The host part stops at a
+// backslash, quote or angle bracket, so a URL followed by an escaped line break and an `E2B_...`
+// variable in JSON text is not read as an E2B host. A public page followed by `)@` is user info.
+// A stream URL's auth key rides its `password` parameter, 16 characters from the SDK, which the
+// credential parameter pattern matches as well.
+const SANDBOX_URL = new RegExp(String.raw `(?!https:\/\/(?:${E2B_PUBLIC_PAGE})[.,;:!?'")]*(?:\s|$))https?:\\?\/\\?\/(?:[^/\s@]*@)*[^/\s\\"'<>@]*e2b[^)\s]+`, "gi");
 // A pattern that matches a credential by its context puts the context in a `keep` group, which
 // redaction leaves in place: `?token=[REDACTED_SECRET]`. Context goes in a group and not in a
 // lookbehind, because a pattern that starts with a lookbehind is tried at every position of the
@@ -115,12 +123,7 @@ const SECRET_PATTERNS = [
     // such as humanish-egress-auth-placeholder and JSON numbers do not count. The lookaheads are
     // bounded, so a long run of `TOKEN=` costs linear time.
     new RegExp(String.raw `(?<keep>${CREDENTIAL_VARIABLE}${QUOTE}[ \t]{0,4}[:=][ \t]{0,4}${QUOTE})${notAPlaceholder(VARIABLE_END)}${NOT_A_NUMBER}(?=[^\s"'\\,;&]{0,255}[0-9])(?=[^\s"'\\,;&]{0,255}[A-Za-z])[^\s"'\\,;&]{16}[^\s"'\\,;&]*`, "g"),
-    // Any URL on an E2B host: a sandbox host names its sandbox, and a stream URL carries its auth
-    // key. The slashes may be JSON-escaped (`https:\/\/`). User info runs to its last `@`, as a URL
-    // parser reads it, and may hold any character but a slash or space. The host part stops at a
-    // backslash, quote or angle bracket, so a URL followed by an escaped line break and an `E2B_...`
-    // variable in JSON text is not read as an E2B host. A public page followed by `)@` is user info.
-    new RegExp(String.raw `(?!https:\/\/(?:${E2B_PUBLIC_PAGE})[.,;:!?'")]*(?:\s|$))https?:\\?\/\\?\/(?:[^/\s@]*@)*[^/\s\\"'<>@]*e2b[^)\s]+`, "gi"),
+    SANDBOX_URL,
     /BEGIN (RSA|OPENSSH|PRIVATE) KEY/gi,
 ];
 const LOCAL_PATH_PATTERNS = [
@@ -148,9 +151,17 @@ function matchesPattern(pattern, text) {
     return pattern.test(text);
 }
 /** True if the text contains a secret-shaped token. Local paths do not count. */
-export function containsSecret(text) {
+function containsSecret(text) {
     return SECRET_PATTERNS.some((pattern) => matchesPattern(pattern, text));
 }
+// Every secret pattern but the sandbox URL. A URL on an E2B host names a sandbox, which verify
+// keeps out of a shared run, but the host is no credential: a key, token, password or signature in
+// such a URL matches one of these patterns on its own.
+const CREDENTIAL_PATTERNS = SECRET_PATTERNS.filter((pattern) => pattern !== SANDBOX_URL);
+/** True if the text contains a credential. Local paths and a URL on an E2B host alone do not count. */
+export function containsCredential(text) {
+    return CREDENTIAL_PATTERNS.some((pattern) => matchesPattern(pattern, text));
+}
 /** True if the text contains any secret-shaped token or known local path. */
 export function containsSensitive(text) {
     return (containsSecret(text) || LOCAL_PATH_PATTERNS.some(([pattern]) => matchesPattern(pattern, text)));

package/dist/guest/browser-tools.js

@@ -60,7 +60,11 @@ export function createGuestBrowserTools(native, content) {
                     }
                     catch (error) {
                         // Ctrl+L itself is input. No content fallback after that dispatch.
-                        throw new ComputerUseExecutorError(isComputerUseExecutorError(error) ? error.code : "execution_failed", "outcome_uncertain");
+                        throw isComputerUseExecutorError(error)
+                            ? new ComputerUseExecutorError(error.code, "outcome_uncertain", {
+                                diagnostic: error.diagnostic,
+                            })
+                            : new ComputerUseExecutorError("execution_failed", "outcome_uncertain");
                     }
                 },
                 async close() {

package/dist/guest/chromium-text.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { ComputerUseExecutorError, isComputerUseExecutorError, } from "../actors/computer-use/executor-error.js";
+import { classifyExecutorFailure, } from "../actors/computer-use/executor-diagnostic.js";
 const DEADLINE_MS = 5_000;
 // These expressions execute only in this port's isolated world. Actor text is
 // never interpolated into JavaScript, a selector, a world name, or a CDP method.
@@ -107,20 +108,26 @@ function checkScope(settings, state, expected) {
     if (state.generation !== expected)
         throw new ComputerUseExecutorError("session_revoked", "not_dispatched");
     const pages = context.pages();
-    if (state.dialogSeen ||
-        page.isClosed() ||
-        page.context() !== context ||
-        pages.length !== 1 ||
-        pages[0] !== page)
+    if (state.dialogSeen || page.isClosed() || page.context() !== context || !pages.includes(page))
         throw new ComputerUseExecutorError("action_rejected", "not_dispatched");
+    // Playwright emulates focus in every page it drives, so the focus probe passes in a background
+    // tab too and cannot say which tab is in front. The participant learns why, and can close the
+    // other tab.
+    if (pages.length !== 1)
+        throw new ComputerUseExecutorError("action_rejected", "not_dispatched", {
+            reason: "extra_tab",
+        });
 }
 /**
  * One bounded operation: a 5 s deadline, the caller's abort, and any interrupt race every step.
- * A failure after a dispatching step makes the port unusable and reports outcome_uncertain.
+ * A failure after a dispatching step makes the port unusable and reports outcome_uncertain. An
+ * undeclared error becomes transport_failed with a diagnostic naming the failing step and a
+ * category; its message is classified and dropped.
  */
 async function runOperation(settings, state, signal, expected, body) {
     let dispatched = false;
     let stopped;
+    let phase;
     const controller = new AbortController();
     let rejectStop;
     const stop = new Promise((_resolve, reject) => {
@@ -151,11 +158,13 @@ async function runOperation(settings, state, signal, expected, body) {
         return await body({
             signal: controller.signal,
             check,
-            async step(call, dispatch = false) {
+            async step(name, call, dispatch = false) {
                 check();
                 if (dispatch)
                     dispatched = true;
+                phase = name;
                 const value = await Promise.race([call(), stop]);
+                phase = undefined;
                 check();
                 return value;
             },
@@ -165,8 +174,18 @@ async function runOperation(settings, state, signal, expected, body) {
         controller.abort();
         if (dispatched)
             state.unusable = true;
-        const code = stopped ?? (isComputerUseExecutorError(error) ? error.code : "transport_failed");
-        throw new ComputerUseExecutorError(code, dispatched ? "outcome_uncertain" : "not_dispatched");
+        const declared = isComputerUseExecutorError(error);
+        const code = stopped ?? (declared ? error.code : "transport_failed");
+        const reason = !dispatched && stopped === undefined && declared ? error.reason : undefined;
+        const diagnostic = stopped !== undefined
+            ? undefined
+            : declared
+                ? error.diagnostic
+                : classifyExecutorFailure(phase ?? "text_port", error);
+        throw new ComputerUseExecutorError(code, dispatched ? "outcome_uncertain" : "not_dispatched", {
+            reason,
+            diagnostic,
+        });
     }
     finally {
         clearTimeout(timer);
@@ -191,9 +210,11 @@ function sessionDetacher(state) {
                     }),
                 ]);
             }
-            catch {
+            catch (error) {
                 state.unusable = true;
-                throw new ComputerUseExecutorError("transport_failed", "not_dispatched");
+                throw new ComputerUseExecutorError("transport_failed", "not_dispatched", {
+                    diagnostic: classifyExecutorFailure("cdp_detach", error),
+                });
             }
             finally {
                 clearTimeout(timer);
@@ -209,11 +230,11 @@ function sessionDetacher(state) {
 /** The owner's native window check, as one step of an operation. */
 async function assertOwnerReady(settings, op) {
     const { assertFocusedWindow } = settings;
-    await op.step(() => assertFocusedWindow(op.signal));
+    await op.step("owner_window_check", () => assertFocusedWindow(op.signal));
 }
 /** One fixed probe in the isolated world; anything but a boolean true refuses the action. */
 async function probeElement(op, session, contextId, expression) {
-    const result = await op.step(() => session.send("Runtime.evaluate", evaluateParams(expression, contextId)));
+    const result = await op.step("focus_probe", () => session.send("Runtime.evaluate", evaluateParams(expression, contextId)));
     if (!probeAccepted(result))
         throw new ComputerUseExecutorError("action_rejected", "not_dispatched");
 }
@@ -224,17 +245,17 @@ async function probeElement(op, session, contextId, expression) {
  */
 async function acquireIsolatedWorld(settings, state, detach, prepared, op) {
     await assertOwnerReady(settings, op);
-    prepared.session = await op.step(() => settings.context.newCDPSession(settings.page).then((acquired) => {
+    prepared.session = await op.step("cdp_session", () => settings.context.newCDPSession(settings.page).then((acquired) => {
         state.sessions.add(acquired);
         if (op.signal.aborted || state.closed)
             void detach(acquired).catch(() => { });
         return acquired;
     }));
-    const tree = await op.step(() => prepared.session.send("Page.getFrameTree"));
+    const tree = await op.step("frame_tree", () => prepared.session.send("Page.getFrameTree"));
     const frameId = ownedFrameId(tree);
     if (frameId === undefined)
         throw new ComputerUseExecutorError("invalid_response", "not_dispatched");
-    const world = await op.step(() => prepared.session.send("Page.createIsolatedWorld", {
+    const world = await op.step("isolated_world", () => prepared.session.send("Page.createIsolatedWorld", {
         frameId,
         worldName: settings.worldName,
     }));
@@ -255,7 +276,10 @@ function disposePrepared(state, detach, prepared, self) {
                     await detach(prepared.session);
             }
             catch (error) {
-                throw new ComputerUseExecutorError(isComputerUseExecutorError(error) ? error.code : "transport_failed", prepared.dispatchedText ? "outcome_uncertain" : "not_dispatched");
+                const declared = isComputerUseExecutorError(error);
+                throw new ComputerUseExecutorError(declared ? error.code : "transport_failed", prepared.dispatchedText ? "outcome_uncertain" : "not_dispatched", {
+                    diagnostic: declared ? error.diagnostic : classifyExecutorFailure("cdp_detach", error),
+                });
             }
             finally {
                 state.busy = false;
@@ -281,7 +305,7 @@ function preparedHandle(settings, state, prepared, dispose) {
                 await probeElement(op, prepared.session, prepared.contextId, RECHECK);
                 await assertOwnerReady(settings, op);
                 op.check();
-                await op.step(() => {
+                await op.step("insert_text", () => {
                     prepared.dispatchedText = true;
                     return prepared.session.send("Input.insertText", { text: prepared.text });
                 }, true);

package/dist/guest/desktop-executor.js

@@ -171,7 +171,11 @@ export function failureEndsSession(progress, error, signal) {
  */
 export function failureError(dispatched, error, signal) {
     if (dispatched)
-        return new ComputerUseExecutorError(isComputerUseExecutorError(error) ? error.code : "execution_failed", "outcome_uncertain");
+        return isComputerUseExecutorError(error)
+            ? new ComputerUseExecutorError(error.code, "outcome_uncertain", {
+                diagnostic: error.diagnostic,
+            })
+            : new ComputerUseExecutorError("execution_failed", "outcome_uncertain");
     if (signal.aborted)
         return new ComputerUseExecutorError("session_revoked", "not_dispatched");
     return isComputerUseExecutorError(error)

package/dist/keys/key-resolution.d.ts

@@ -33,6 +33,9 @@ export interface KeySourceProbe {
     source: string | null;
     /** The command/path that would fill it when missing. */
     hint: string;
+    /** Set when the env holds the inert value a terminal study's sandbox gets in place of a key, and
+     *  no other source supplies one. `source` is then null. */
+    placeholder?: true;
 }
 /** The nearest fill instruction for a missing key. Doctor rows use it, and it is appended to
  *  *_KEYS_MISSING errors so the failure names the fix. */

package/dist/keys/key-resolution.js

@@ -22,6 +22,7 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { loadEnvFile } from "./env-file.js";
 import { cli } from "../cli/invocation.js";
+import { OPENAI_EGRESS_PLACEHOLDER } from "../routes/terminal/runtime-auth.js";
 /** The only names implicit discovery may fill (and `humanish keys set` may store). Everything
  *  else in an overlay/store file is ignored-and-named: a repo-planted NODE_OPTIONS/LD_PRELOAD
  *  must never enter process env off a file the operator did not explicitly pass (an explicit
@@ -263,7 +264,14 @@ export function describeMissingKeys(names, env) {
  * Runs the same chain against a scratch copy of env so nothing observable changes.
  */
 export async function probeKeySources(names, args) {
+    // A terminal study's sandbox sets CODEX_API_KEY to an inert placeholder so Codex starts; the key
+    // itself stays in the host-side egress proxy. The placeholder is no key, so it counts as unset and
+    // discovery may still find a real one.
+    const placeholder = (name) => args.env[name]?.trim() === OPENAI_EGRESS_PLACEHOLDER;
     const scratch = { ...args.env };
+    for (const name of names)
+        if (placeholder(name))
+            delete scratch[name];
     const fills = await discoverProviderKeys({
         cwd: args.cwd,
         env: scratch,
@@ -272,7 +280,7 @@ export async function probeKeySources(names, args) {
     });
     const bySource = new Map(fills.map((fill) => [fill.name, fill.source]));
     return names.map((name) => {
-        const inEnv = args.env[name] !== undefined && args.env[name]?.trim() !== "";
+        const inEnv = args.env[name] !== undefined && args.env[name]?.trim() !== "" && !placeholder(name);
         // GH_TOKEN and GITHUB_TOKEN are one credential with two spellings; a doctor row that says
         // "missing" while GITHUB_TOKEN sits in the env would be wrong.
         const aliasInEnv = name === "GH_TOKEN" &&
@@ -285,7 +293,12 @@ export async function probeKeySources(names, args) {
             : aliasInEnv
                 ? "process env (GITHUB_TOKEN)"
                 : (bySource.get(name) ?? null);
-        return { name, source, hint: missingKeyHint(name) };
+        return {
+            name,
+            source,
+            hint: missingKeyHint(name),
+            ...(source === null && placeholder(name) ? { placeholder: true } : {}),
+        };
     });
 }
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;

package/dist/routes/computer-use/bundle-parts.d.ts

@@ -43,6 +43,10 @@ export declare function providerResourcesForOutcome(args: {
     ids: ParticipantIds;
     participantId: string;
 }): RunProviderResource[];
+/**
+ * The app URL as a run records it: the URL, or its digest when verify would flag it. verify reads the
+ * URL decoded, so an E2B URL percent-encoded in a parameter gets the digest too.
+ */
 export declare function publicSafeAppUrlLabel(url: string): string;
 /** Short id-safe suffix for a subject-phase RunEvent: drops the shared prefix/suffix so each
  *  phase gets a distinct bundle event id (e.g. "clone", "state-before-build"). */

package/dist/routes/computer-use/bundle-parts.js

@@ -3,7 +3,8 @@
 // public-safe app URL label, the URL digest and the subject-phase event id suffix. The builders are bundle.ts (the dispatcher and the judge),
 // single-bundle.ts and fanout-bundle.ts.
 import { feedbackProofCommands } from "../../feedback/proof.js";
-import { containsSensitive, digestText, redactText } from "../../evidence/redaction.js";
+import { scanEncodedText } from "../../evidence/encoded-text.js";
+import { digestText, redactText } from "../../evidence/redaction.js";
 import {} from "../../run/bundle.js";
 import { participantResourceIds } from "../../run/participant-records.js";
 import { resolveSelfReportedFriction } from "./self-report.js";
@@ -169,8 +170,12 @@ export function providerResourcesForOutcome(args) {
         },
     ];
 }
+/**
+ * The app URL as a run records it: the URL, or its digest when verify would flag it. verify reads the
+ * URL decoded, so an E2B URL percent-encoded in a parameter gets the digest too.
+ */
 export function publicSafeAppUrlLabel(url) {
-    return containsSensitive(url) ? `[target-url:${digestUrl(url)}]` : url;
+    return scanEncodedText(url).sensitive ? `[target-url:${digestUrl(url)}]` : url;
 }
 /** Short id-safe suffix for a subject-phase RunEvent: drops the shared prefix/suffix so each
  *  phase gets a distinct bundle event id (e.g. "clone", "state-before-build"). */

package/dist/routes/computer-use/fanout-bundle.js

@@ -4,7 +4,7 @@ import { actorEnding } from "../../actors/stop-cause.js";
 import { redactText } from "../../evidence/redaction.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, tallyParticipantOutcomes, withCuaReviewProvenance, } from "../../run/outcomes.js";
-import { participantFeedbackCandidates, providerResourcesForOutcome } from "./bundle-parts.js";
+import { participantFeedbackCandidates, providerResourcesForOutcome, publicSafeAppUrlLabel, } from "./bundle-parts.js";
 import { participantFactsOf } from "./participant-facts.js";
 import { participantPassed, participantStatus } from "../../run/judge.js";
 import { buildRunCostSummary, desktopSpanToMinutes } from "../../run/cost-summary.js";
@@ -72,10 +72,12 @@ function fanoutReview(args, streams) {
         verdict,
         ...(participants === undefined ? {} : { participants }),
         ...(runTasks === undefined ? {} : { tasks: runTasks }),
+        // The app URL is named as the participant records name it: one on an E2B host names a
+        // sandbox, so the summary carries its digest, which verify accepts in a shared run.
         summary: args.inProgress === true
             ? `Live computer-use fan-out is running (${specs.length} participants, one world each); terminal participant evidence has not been written yet.`
             : args.dryRun
-                ? `${args.rerun ? `Rerun from ${args.rerun.sourceRunId}: ` : ""}Dry-run fan-out: ${specs.length} participants composed for ${args.descriptor.id} against ${args.appUrl}, one world each; no desktops launched, $0 spend.`
+                ? `${args.rerun ? `Rerun from ${args.rerun.sourceRunId}: ` : ""}Dry-run fan-out: ${specs.length} participants composed for ${args.descriptor.id} against ${publicSafeAppUrlLabel(args.appUrl)}, one world each; no desktops launched, $0 spend.`
                 : `${args.rerun ? `Rerun from ${args.rerun.sourceRunId}: ` : ""}Computer-use fan-out (${specs.length} participants, one world each): ${passedParticipants}/${plural(specs.length, "participant")} reached a terminal, engaged verdict${participants ? `: ${formatParticipantOutcomes(participants, participantEndings)}` : ""}${runTasks ? `; tasks: ${formatRunTaskFunnel(runTasks)}` : ""}.`,
         gaps: args.inProgress === true
             ? ["Live fan-out session is still running."]

package/dist/routes/computer-use/local-vm.js

@@ -10,7 +10,6 @@ import { createRestrictedCodexParticipant } from "../../actors/codex/restricted-
 import { withCloseReport } from "./participant-model.js";
 import { guestMediaConfigSchema } from "../../guest/media-config.js";
 import { startLocalCapturedInbox } from "../../substrates/local/captured-inbox.js";
-import { actorOf } from "../../study/study-fields.js";
 function guestMedia(config) {
     const declaredMedia = config.execution?.desktop?.media;
     return declaredMedia === undefined
@@ -165,7 +164,7 @@ export function prepareLocalVmRun(options) {
     const media = guestMedia(config);
     // A caller-supplied provider replaces the Codex account participant, so the account is
     // neither checked nor used.
-    const account = actorOf(config)?.type === "local-agent" && options.createProvider === undefined;
+    const account = config.actor?.type === "local-agent" && options.createProvider === undefined;
     const state = { sessions: [], participants: [], cleanupUnconfirmed: false };
     const context = {
         config,

package/dist/routes/computer-use/participant-model.js

@@ -228,10 +228,15 @@ export async function recordParticipantTrace(spec, deps, session, warnings) {
  * carried it on every request. It says why, and how many early turns became a text summary.
  */
 export function explicitContextWarning(conversation) {
+    const answer = conversation.rejection === "stored_item"
+        ? " (a stored item the request referenced was not found)"
+        : conversation.rejection === "previous_response"
+            ? " (the previous response was refused or not found)"
+            : "";
     const why = conversation.explicitReason === "zdr_rejection"
         ? `The OpenAI organization rejected server-side conversation state (zero data retention)${conversation.switchedAtRequest === undefined
             ? ""
-            : ` on request ${conversation.switchedAtRequest}`}`
+            : ` on request ${conversation.switchedAtRequest}`}${answer}`
         : "zeroDataRetention is set";
     const summarized = conversation.summarizedTurns === 0
         ? ""

package/dist/routes/computer-use/plan.js

@@ -16,7 +16,6 @@ import { isLocalBrowserStudy } from "../../substrates/local/runtime-config.js";
 import { boundedConcurrency, defaultSessionTimeoutMs, resolveParticipantSandboxMs, } from "./participant-runs.js";
 import { MAX_SANDBOX_MS } from "../../substrates/e2b/lifetime.js";
 import {} from "./types.js";
-import { actorOf, declaresSharedWorld } from "../../study/study-fields.js";
 /** The registered descriptor for a planned actor id; planComputerUseStudy checked the registry. */
 export function cuaDescriptorOf(actor) {
     const descriptor = actorRegistry[actor];
@@ -87,7 +86,7 @@ function unsupportedDeclarationReason(config, hasRunSession, driving, { inProces
     const reason = desktopMediaValidationReason(config) || outputTokenLimitValidationReason(config);
     if (reason)
         return invalid(reason);
-    if (actorOf(config)?.maxOutputTokens !== undefined &&
+    if (config.actor?.maxOutputTokens !== undefined &&
         (hasRunSession || driving.createProvider || driving.inProcess))
         return invalid("maxOutputTokens cannot be enforced by a custom runSession/provider/executor route.");
     const receivingReason = receivingEmailValidationReason(config);
@@ -219,7 +218,7 @@ export function planComputerUseStudy(config, input) {
     if (tasksReason)
         return refuse("before-scope", "HUMANISH_STUDY_TASKS_UNSUPPORTED", tasksReason);
     // The parser checks the actor too; a library caller skips the parser.
-    const actorType = actorOf(config)?.type ?? "";
+    const actorType = config.actor?.type ?? "";
     const descriptor = actorRegistry[actorType];
     if (!descriptor || !isCuaActorDescriptor(descriptor))
         return refuse("in-scope", "HUMANISH_COMPUTER_USE_ACTOR_UNSUPPORTED", `actor.type "${actorType}" is not a registered computer-use actor.`);
@@ -230,7 +229,7 @@ export function planComputerUseStudy(config, input) {
     // A shared world runs every participant against one app; this route would run them as separate
     // participants. It comes after the rules above, so a shared-world config that breaks one of them,
     // which runStudyWith sends here, still gets that rule's message.
-    if (declaresSharedWorld(config))
+    if (config.route === "shared-world")
         return refuse("in-scope", "HUMANISH_COMPUTER_USE_SUBJECT_INVALID", "route: shared-world studies run every participant against one shared app on the shared-world route; this route runs independent participants. The shared-world route takes subject.source clone or local-tree, or app-url with policies.allowPublicTargets: true, on execution.target e2b-desktop.", actor);
     // The in-process route drives subject.appUrl on this machine and creates no desktop, so it would
     // skip the subject a clone, local-tree or desktop-cli study declares.

package/dist/routes/computer-use/route.js

@@ -32,7 +32,6 @@ import { runStudyParticipants } from "./live-phase.js";
 import { admitCuaRun, refuseCuaStudy, startCuaRun } from "./setup.js";
 import {} from "./types.js";
 import { studyResultIdentity } from "../../run/study-result.js";
-import { actorOf } from "../../study/study-fields.js";
 /**
  * A refused computer-use study's result, at the refusal's stage: a before-scope refusal has its own
  * envelope and no analysis record; the others come after the cwd checks, and the participant cap after
@@ -45,7 +44,7 @@ export async function computerUseStudyRefusal(options, refusal) {
             ...studyResultIdentity("computer-use", config.id),
             ok: false,
             cwd: path.resolve(options.cwd),
-            actor: actorOf(config)?.type ?? "",
+            actor: config.actor?.type ?? "",
             dryRun,
             runId: options.runId ?? "not-created",
             appUrl: config.subject.appUrl ?? config.subject.serve?.url ?? "",

package/dist/routes/computer-use/setup.js

@@ -25,7 +25,6 @@ import { projectParticipantSubjects, subjectProvenanceArg } from "./subject-proj
 import { participantSubjectEnv, } from "./types.js";
 import { studyPersonaIds } from "../../study/persona-resolve.js";
 import { studyResultIdentity } from "../../run/study-result.js";
-import { actorOf } from "../../study/study-fields.js";
 /** The physical project, bound before any caller hook runs. */
 async function bindProject(cwd) {
     // Capture the physical project before reading or invoking any caller hook. A supported
@@ -48,7 +47,7 @@ export async function refuseCuaStudy(options, refusal) {
         ...studyResultIdentity("computer-use", config.id),
         ok: false,
         cwd: projectRoot.physicalPath,
-        actor: refusal.actor ?? actorOf(config)?.type ?? "",
+        actor: refusal.actor ?? config.actor?.type ?? "",
         appUrl: declaredAppUrl(config),
         dryRun,
         runId: options.runId ?? "not-created",
@@ -214,6 +213,7 @@ export async function startCuaRun(plan, input, admitted, scope) {
         mintRunId: makeCuaRunId,
         mode: dryRun ? "dry-run" : "live",
         study: plan.study,
+        warnings: plan.warnings,
         renderReview: renderCuaReviewMarkdown,
         observer: { open: input.open === true, render: seams.renderObserver },
     });

package/dist/routes/preview.js

@@ -30,6 +30,7 @@ export function admitPreviewPlan(plan, input) {
 function runPreviewPlan(plan, input) {
     return runDryRun({
         ...(plan.study === undefined ? {} : { study: plan.study }),
+        ...(plan.warnings === undefined ? {} : { warnings: plan.warnings }),
         cwd: input.cwd,
         dryRun: true,
         participantCount: plan.participantCount,

package/dist/routes/scripted/plan.js

@@ -7,7 +7,6 @@ import { browserSurfaces } from "../../actors/scripted-browser/types.js";
 import { resolveAutomaticAnalysis } from "../../analysis/automatic-config.js";
 import { isNonEmpty, planBase, provisionedSubject } from "../../study/plan-base.js";
 import { cloneTargetValidationReason, desktopMediaValidationReason, taskProtocolValidationReason, } from "../../study/validation.js";
-import { actorOf, surfaceCount, scenarioRefOf } from "../../study/study-fields.js";
 // Default surface roster is 1 (desktop only): the defaults-table single-participant row governs;
 // `count: 2` is the declared override that adds the mobile surface.
 const DEFAULT_SURFACE_COUNT = 1;
@@ -43,7 +42,7 @@ export function planScriptedStudy(config, input) {
     const cloneTargetReason = cloneTargetValidationReason(config);
     if (cloneTargetReason)
         return refuse("HUMANISH_SCRIPTED_SUBJECT_UNSAFE", cloneTargetReason);
-    const actorType = actorOf(config)?.type ?? "";
+    const actorType = config.actor?.type ?? "";
     const descriptor = actorRegistry[actorType];
     if (!descriptor || !isScriptedBrowserActorDescriptor(descriptor))
         return refuse("HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED", `actor.type "${actorType}" is not a registered scripted-browser actor.`);
@@ -64,7 +63,7 @@ export function planScriptedStudy(config, input) {
         subject = { kind: "loopback", appUrl };
     }
     // The steps are the actor, so there is no built-in journey to fall back on.
-    const scenarioRef = scenarioRefOf(config);
+    const scenarioRef = config.scenario;
     if (!scenarioRef?.trim())
         return refuse("HUMANISH_SCRIPTED_SCENARIO_INVALID", "A scripted-browser study needs `scenario`: the actor runs the browser steps in that scenario file.", { actor, appUrl: evidenceAppUrlOf(subject) });
     const requirements = [];
@@ -76,7 +75,7 @@ export function planScriptedStudy(config, input) {
     // The browser runs on this machine on both subjects; a clone's is pointed at its getHost URL.
     if (!input.dryRun && input.injectedBrowser !== true)
         requirements.push({ kind: "host-browser" });
-    const persona = actorOf(config)?.persona;
+    const persona = config.actor?.persona;
     const timeoutMs = config.execution?.timeoutMs;
     return {
         ok: true,
@@ -89,7 +88,7 @@ export function planScriptedStudy(config, input) {
             actor,
             subject,
             scenarioRef,
-            surfaces: browserSurfaces.slice(0, surfaceCount(config) ?? DEFAULT_SURFACE_COUNT),
+            surfaces: browserSurfaces.slice(0, config.surfaces?.length ?? DEFAULT_SURFACE_COUNT),
             ...(persona === undefined ? {} : { personaId: persona }),
             ...(timeoutMs === undefined ? {} : { sessionTimeoutMs: timeoutMs }),
             requirements,

package/dist/routes/scripted/route.js

@@ -31,7 +31,6 @@ import { ScriptedSubject } from "./subject.js";
 import { runScriptedSessions, writeSurfaceTraces } from "./surface-sessions.js";
 import {} from "./types.js";
 import { studyResultIdentity } from "../../run/study-result.js";
-import { actorOf } from "../../study/study-fields.js";
 /**
  * A refused scripted study's result, at the refusal's stage: a before-scope refusal has its own field
  * order and no analysis record; the others come after the output directory checks.
@@ -39,7 +38,7 @@ import { actorOf } from "../../study/study-fields.js";
 export async function scriptedStudyRefusal(options, refusal) {
     const { config, dryRun } = options;
     const cwd = path.resolve(options.cwd);
-    const actorType = actorOf(config)?.type ?? "";
+    const actorType = config.actor?.type ?? "";
     if (refusal.beforeScope)
         return {
             ...studyResultIdentity("scripted", config.id),
@@ -95,6 +94,7 @@ async function runScriptedPlanInScope(plan, input, scope) {
         mintRunId: makeScriptedRunId,
         mode: dryRun ? "dry-run" : "live",
         study: plan.study,
+        warnings: plan.warnings,
         // Only a clone subject is served from a sandbox; an app-url run drives a local browser.
         sandboxes: setup.clone ? undefined : "none",
         renderReview: renderScriptedReviewMarkdown,