humanish 0.111.0 → 0.111.2

package/dist/study/plan-base.js

@@ -1,7 +1,6 @@
 // What every route planner shares: the plan fields common to all routes, the frozen residual config,
 // and the requirement and subject helpers.
 import { DEFAULT_OPENAI_CU_MODEL } from "../actors/computer-use/openai-provider.js";
-import { actorOf, capsOf } from "./study-fields.js";
 // A YAML alias can make a parsed record contain itself (an inline persona that names its own
 // anchor), and structuredClone keeps the cycle, so each object is frozen once.
 function deepFreeze(value, frozen = new WeakSet()) {
@@ -44,7 +43,7 @@ export function isNonEmpty(values) {
     return values.length > 0;
 }
 export function planCaps(config) {
-    const caps = capsOf(config);
+    const caps = config.caps;
     return {
         ...(caps?.maxUsd === undefined ? {} : { maxUsd: caps.maxUsd }),
         ...(caps?.maxTotalUsd === undefined ? {} : { maxTotalUsd: caps.maxTotalUsd }),
@@ -86,7 +85,7 @@ export function desktopRequirements(config, args) {
     return requirements;
 }
 export function brainOf(config, callerProvider) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     if (callerProvider)
         return callerBrainOf(config);
     const declared = declaredModelOf(config);
@@ -99,7 +98,7 @@ export function callerBrainOf(config) {
     return { kind: "caller", ...declaredModelOf(config) };
 }
 function declaredModelOf(config) {
-    const model = actorOf(config)?.model;
+    const model = config.actor?.model;
     return model === undefined ? {} : { declaredModel: model };
 }
 /** The model a participant's spend is priced at when its provider reports none. */

package/dist/study/plan-participants.js

@@ -2,9 +2,9 @@
 // Computer-use and shared-world participants share the desktop fields; each kind adds its own.
 import { resolveParticipantDevice } from "./device-presets.js";
 import { isSharedWorldComposition, participantIdAt } from "./routing.js";
-import { actorOf, participantList, declaredParticipantCount, participantInstruction, } from "./study-fields.js";
+import { participantList, declaredParticipantCount, participantInstruction, } from "./study-fields.js";
 function desktopParticipant(config, entry, index, kind, focus) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     const device = resolveParticipantDevice(config, entry?.device);
     const personaId = entry?.persona ?? actor?.persona;
     const mission = actor?.mission;
@@ -39,7 +39,7 @@ function desktopParticipant(config, entry, index, kind, focus) {
  * override (`--count`) applies only when no roster is declared.
  */
 export function computerUseParticipants(config, countOverride) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     const roster = participantList(config);
     const count = roster
         ? roster.length

package/dist/study/plan-types.d.ts

@@ -63,6 +63,8 @@ interface PlanBase {
     /** The study's declared title, which bundles record. */
     readonly title?: string;
     readonly study?: RunStudyProvenance;
+    /** Warnings about the study's own fields, which the run records in its bundle as warn events. */
+    readonly warnings?: readonly string[];
     /** A frozen copy owned by the plan. */
     readonly residual: Readonly<ResidualConfig>;
     readonly dryRun: boolean;

package/dist/study/plan.js

@@ -11,17 +11,18 @@ import { THIS_REPO_DRY_RUN_ONLY } from "./composition-rules.js";
 import { planBase } from "./plan-base.js";
 import { routeOf } from "./routing.js";
 import { automaticAnalysisRouteReason, taskProtocolValidationReason } from "./validation.js";
-import { declaredParticipantCount, modeOf } from "./study-fields.js";
+import { declaredParticipantCount } from "./study-fields.js";
+import { egressAllowIgnoredWarning } from "./warnings.js";
 export { routeOf } from "./routing.js";
 /** Resolve dry-run: explicit override wins, else the scenario mode, else the given fallback. */
 export function resolveStudyDryRun(config, override, fallback) {
     if (override !== undefined) {
         return override;
     }
-    if (modeOf(config) === "live") {
+    if (config.mode === "live") {
         return false;
     }
-    if (modeOf(config) === "dry-run") {
+    if (config.mode === "dry-run") {
         return true;
     }
     return fallback;
@@ -73,8 +74,13 @@ export function planStudy(config, options, deps = {}) {
     if (!result.ok)
         return result;
     // The manifest the CLI resolved enters the plan here and nowhere else; the routes read
-    // plan.study for the run's status record and bundle.
-    const plan = options.study === undefined ? result.plan : { ...result.plan, study: options.study };
+    // plan.study for the run's status record and bundle, and plan.warnings for its bundle events.
+    const warning = egressAllowIgnoredWarning(study);
+    const plan = {
+        ...result.plan,
+        ...(options.study === undefined ? {} : { study: options.study }),
+        ...(warning === undefined ? {} : { warnings: [warning] }),
+    };
     return { ok: true, planned: { plan } };
 }
 function planRoute(route, study, options, input, deps) {

package/dist/study/routing.js

@@ -1,6 +1,6 @@
 import { actorRegistry } from "../actors/registry.js";
 import { isLoopbackUrl } from "./parse/subject.js";
-import { actorOf, participantList, declaredParticipantCount, declaresSharedWorld, } from "./study-fields.js";
+import { participantList, declaredParticipantCount } from "./study-fields.js";
 // Hard cap on computer-use participants. No setting raises it: each participant is a paid desktop,
 // and they all run at once.
 export const MAX_COMPUTER_USE_PARTICIPANTS = 16;
@@ -74,7 +74,7 @@ export function isComputerUseComposition(config) {
     // local-app drives the cua loop in-process (a custom executor + a non-vision provider), so it
     // routes to the computer-use route exactly like an app-url subject with a computer-use actor.
     if (config.subject.source === "app-url" || config.subject.source === "local-app") {
-        return actorResolvesToComputerUse(actorOf(config)?.type);
+        return actorResolvesToComputerUse(config.actor?.type);
     }
     // desktop-cli hands the participant a terminal instead of a served page, but it is the
     // same route: same desktop, same actor, same prompt fields. Leaving it out of this predicate told
@@ -82,13 +82,13 @@ export function isComputerUseComposition(config) {
     // person reads a screen.
     if (config.subject.source === "desktop-cli") {
         return ((config.execution?.target === undefined || config.execution.target === "e2b-desktop") &&
-            actorResolvesToComputerUse(actorOf(config)?.type));
+            actorResolvesToComputerUse(config.actor?.type));
     }
     // local-tree packs+uploads the working tree, then serves it exactly like a computer-use clone
     // subject: same e2b-desktop + computer-use-actor gate.
     return ((config.subject.source === "clone" || config.subject.source === "local-tree") &&
         config.execution?.target === "e2b-desktop" &&
-        actorResolvesToComputerUse(actorOf(config)?.type));
+        actorResolvesToComputerUse(config.actor?.type));
 }
 /**
  * True when this config routes to the shared-world route: a clone or local-tree subject
@@ -105,9 +105,9 @@ export function isSharedWorldComposition(config) {
 /** The getHost provisioned-subject shared-world shape (clone/local-tree served + exposed in-sandbox). */
 export function isProvisionedSharedWorldComposition(config) {
     return ((config.subject.source === "clone" || config.subject.source === "local-tree") &&
-        declaresSharedWorld(config) &&
+        config.route === "shared-world" &&
         config.execution?.target === "e2b-desktop" &&
-        actorResolvesToComputerUse(actorOf(config)?.type));
+        actorResolvesToComputerUse(config.actor?.type));
 }
 /**
  * The external-public shared-world shape: a real public deployment used directly as
@@ -120,9 +120,9 @@ export function isProvisionedSharedWorldComposition(config) {
  */
 export function isExternalPublicSharedWorldComposition(config) {
     return (config.subject.source === "app-url" &&
-        declaresSharedWorld(config) &&
+        config.route === "shared-world" &&
         config.execution?.target === "e2b-desktop" &&
-        actorResolvesToComputerUse(actorOf(config)?.type) &&
+        actorResolvesToComputerUse(config.actor?.type) &&
         config.policies?.allowPublicTargets === true);
 }
 /**
@@ -159,12 +159,12 @@ export function isScriptedBrowserComposition(config) {
     return (isLocalScriptedBrowserComposition(config) || isProvisionedScriptedBrowserComposition(config));
 }
 function isLocalScriptedBrowserComposition(config) {
-    return (config.subject.source === "app-url" && actorResolvesToScriptedBrowser(actorOf(config)?.type));
+    return config.subject.source === "app-url" && actorResolvesToScriptedBrowser(config.actor?.type);
 }
 export function isProvisionedScriptedBrowserComposition(config) {
     return (config.subject.source === "clone" &&
         config.execution?.target === "e2b-desktop" &&
-        actorResolvesToScriptedBrowser(actorOf(config)?.type));
+        actorResolvesToScriptedBrowser(config.actor?.type));
 }
 /**
  * True when this config routes to the terminal-product backend: a terminal-product subject whose
@@ -173,7 +173,7 @@ export function isProvisionedScriptedBrowserComposition(config) {
  * the single source of truth for routeOf and the warning logic.
  */
 export function isTerminalProductComposition(config) {
-    return (config.subject.source === "terminal-product" && actorResolvesToTerminal(actorOf(config)?.type));
+    return (config.subject.source === "terminal-product" && actorResolvesToTerminal(config.actor?.type));
 }
 /**
  * The route a config takes. It never refuses: a config no route can run still gets the route

package/dist/study/run-study-options.js

@@ -7,7 +7,7 @@ import { isLocalBrowserStudy } from "../substrates/local/runtime-config.js";
 import { resolveStudyDryRun } from "./plan.js";
 import { knownSecretValues, studyEventEmitter } from "./run-study-events.js";
 import { studyResultIdentity } from "../run/study-result.js";
-import { actorOf, participantList } from "./study-fields.js";
+import { participantList } from "./study-fields.js";
 const unsupported = (option, route, reason) => ({
     ok: false,
     code: "HUMANISH_STUDY_OPTION_UNSUPPORTED",
@@ -105,7 +105,7 @@ export function normalizeRunStudyOptions(config, route, options) {
 export function optionRefusalOutcome(config, route, options, refusal) {
     const cwd = path.resolve(options.cwd);
     const error = { code: refusal.code, message: refusal.message };
-    const actor = actorOf(config)?.type ?? "";
+    const actor = config.actor?.type ?? "";
     const dryRun = resolveStudyDryRun(config, options.dryRun, true) ?? true;
     const runId = options.runId ?? "not-created";
     const common = { ok: false, cwd, actor, dryRun, runId, warnings: [], error };

package/dist/study/study-fields.d.ts

@@ -1,19 +1,7 @@
-import type { StudyActor, StudyCaps, StudyConfig, StudyParticipantEntry } from "./types.js";
-/** The actor that runs. */
-export declare function actorOf(config: StudyConfig): StudyActor | undefined;
+import type { StudyConfig, StudyParticipantEntry } from "./types.js";
 /** The participants listed one by one: a `participants` list. Undefined when none is listed. */
 export declare function participantList(config: StudyConfig): readonly StudyParticipantEntry[] | undefined;
 /** The declared number of identical participants: `participants: <n>` or `participants.count`. */
 export declare function declaredParticipantCount(config: StudyConfig): number | undefined;
 /** The steer each of a counted group of participants gets: `participants.instruction`. */
 export declare function participantInstruction(config: StudyConfig): string | undefined;
-/** How many scripted surfaces run, 1 for desktop and 2 with mobile. */
-export declare function surfaceCount(config: StudyConfig): number | undefined;
-/** The declared run mode. */
-export declare function modeOf(config: StudyConfig): StudyConfig["mode"];
-/** The scripted route's scenario id or path. */
-export declare function scenarioRefOf(config: StudyConfig): string | undefined;
-/** The spend caps the route enforces. parseStudy refuses a key the route does not read. */
-export declare function capsOf(config: StudyConfig): StudyCaps | undefined;
-/** True when the participants share one app: `route: shared-world`. */
-export declare function declaresSharedWorld(config: StudyConfig): boolean;

package/dist/study/study-fields.js

@@ -2,10 +2,6 @@
 // study declares them as a count, as `{ count, instruction }` or as a list, and the accessors below
 // read each form. tests/surface/study-config-reads.test.ts refuses a direct read of a humanish.lab.v2
 // field anywhere outside migrate.
-/** The actor that runs. */
-export function actorOf(config) {
-    return config.actor;
-}
 /** The participants listed one by one: a `participants` list. Undefined when none is listed. */
 export function participantList(config) {
     return Array.isArray(config.participants) ? config.participants : undefined;
@@ -21,26 +17,6 @@ export function declaredParticipantCount(config) {
 export function participantInstruction(config) {
     return isGroup(config.participants) ? config.participants.instruction : undefined;
 }
-/** How many scripted surfaces run, 1 for desktop and 2 with mobile. */
-export function surfaceCount(config) {
-    return config.surfaces?.length;
-}
-/** The declared run mode. */
-export function modeOf(config) {
-    return config.mode;
-}
-/** The scripted route's scenario id or path. */
-export function scenarioRefOf(config) {
-    return config.scenario;
-}
-/** The spend caps the route enforces. parseStudy refuses a key the route does not read. */
-export function capsOf(config) {
-    return config.caps;
-}
-/** True when the participants share one app: `route: shared-world`. */
-export function declaresSharedWorld(config) {
-    return config.route === "shared-world";
-}
 function isGroup(participants) {
     return typeof participants === "object" && participants !== null && !Array.isArray(participants);
 }

package/dist/study/summary.js

@@ -18,7 +18,7 @@ import { inspectStudyManifest } from "./discover.js";
 import { isComputerUseComposition } from "./routing.js";
 import { probeKeySources } from "../keys/key-resolution.js";
 import { receivingRequiredKey } from "../comms/setup.js";
-import { actorOf, participantList, declaredParticipantCount, capsOf, surfaceCount, } from "./study-fields.js";
+import { participantList, declaredParticipantCount } from "./study-fields.js";
 export const STUDY_SUMMARY_SCHEMA = "humanish.study-summary.v1";
 /**
  * The effort every participant will run at, or `"per-lane"` when they differ. A participant that declares nothing
@@ -26,7 +26,7 @@ export const STUDY_SUMMARY_SCHEMA = "humanish.study-summary.v1";
  * reported as the resolved value, exactly as `model` reports its default rather than hiding it.
  */
 function reasoningEffortOf(config) {
-    const fallback = actorOf(config)?.reasoningEffort ?? DEFAULT_OPENAI_CU_REASONING_EFFORT;
+    const fallback = config.actor?.reasoningEffort ?? DEFAULT_OPENAI_CU_REASONING_EFFORT;
     const roster = participantList(config) ?? [];
     const resolved = new Set(roster.map((entry) => entry.reasoningEffort ?? fallback));
     if (resolved.size > 1)
@@ -47,7 +47,7 @@ function subjectOf(config) {
 }
 /** How many participants, and who; collapsed when they are all the same persona. */
 function participantsOf(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     if (actor === undefined)
         return undefined;
     const rosterPersonas = (participantList(config) ?? [])
@@ -56,7 +56,7 @@ function participantsOf(config) {
     const personas = rosterPersonas.length > 0 ? rosterPersonas : actor.persona === undefined ? [] : [actor.persona];
     // A scripted study's participants are its surfaces, one replay on each.
     const count = declaredParticipantCount(config) ??
-        surfaceCount(config) ??
+        config.surfaces?.length ??
         participantList(config)?.length ??
         personas.length ??
         1;
@@ -71,7 +71,7 @@ function participantsOf(config) {
 function summaryCapsOf(config) {
     if (!isComputerUseComposition(config))
         return {};
-    const caps = capsOf(config);
+    const caps = config.caps;
     return {
         ...(typeof caps?.maxUsd === "number" ? { laneUsd: caps.maxUsd } : {}),
         ...(typeof caps?.maxTotalUsd === "number" ? { studyUsd: caps.maxTotalUsd } : {}),
@@ -139,7 +139,7 @@ export async function readStudySummary(cwd, study, options = {}) {
         : undefined;
     const participantReadiness = options.checkKeys === true &&
         isLocalBrowserStudy(inspected.config) &&
-        actorOf(inspected.config)?.type === "local-agent"
+        inspected.config.actor?.type === "local-agent"
         ? await localCodexParticipantCheck({ env: options.env ?? process.env })
         : undefined;
     return {
@@ -166,7 +166,7 @@ export async function readStudySummary(cwd, study, options = {}) {
         ...(typeof config.description === "string" ? { description: config.description.trim() } : {}),
         ...(subject === undefined ? {} : { subject }),
         ...(participants === undefined ? {} : { participants }),
-        model: actorOf(inspected.config)?.model ?? DEFAULT_OPENAI_CU_MODEL,
+        model: inspected.config.actor?.model ?? DEFAULT_OPENAI_CU_MODEL,
         reasoningEffort: reasoningEffortOf(inspected.config),
         caps: summaryCapsOf(inspected.config),
         ...(keysReady === undefined ? {} : { keysReady }),

package/dist/study/types.d.ts

@@ -511,6 +511,7 @@ export interface StudyExecution {
     };
     /**
      * `terminal-product` route: outbound routing allowlist passed to E2B with a deny-all fallback.
+     * Every other route leaves egress open and ignores it with a warning; 0.112.0 refuses it there.
      * Domain filtering is a routing control, not strict destination isolation on shared hosting.
      * It does not constrain spending through an allowed runtime provider, including when
      * openai-egress keeps the raw runtime key outside the sandbox.

package/dist/study/validation.js

@@ -3,7 +3,7 @@ import { PARTICIPANT_ID_MAX_CHARS, PARTICIPANT_ID_PATTERN } from "./parse/actors
 import { isHttpUrl, isLoopbackUrl } from "./parse/subject.js";
 import { declaredTargets } from "./plan-participants.js";
 import { actorResolvesToComputerUse, computerUseParticipantCount, MAX_COMPUTER_USE_PARTICIPANTS, registeredComputerUseActors, resolveEntryUrl, isComputerUseComposition, isScriptedBrowserComposition, isSharedWorldComposition, isTerminalProductComposition, } from "./routing.js";
-import { actorOf, participantList, declaresSharedWorld } from "./study-fields.js";
+import { participantList } from "./study-fields.js";
 /**
  * Cross-validate the computer-use fan-out declaration (`per-lane-worlds`). Returns the failure
  * message, or null when valid. The parser enforces it, and runStudyWith checks it again for a config
@@ -53,7 +53,7 @@ export function computerUseValidationReason(config) {
     if (participantCount > 1 &&
         config.policies?.allowPublicTargets === true &&
         declaredTargets(config).length === 0 &&
-        !declaresSharedWorld(config)) {
+        config.route !== "shared-world") {
         return "`policies.allowPublicTargets` with more than one participant sends them all to one public app, which is a shared world. Set `route: shared-world` to run them together there, give each `participants[]` entry its own `target`, or run one participant.";
     }
     return null;
@@ -119,7 +119,7 @@ function provisionedSharedWorldStructureReason(config) {
     if (config.execution?.target !== "e2b-desktop") {
         return "`route: shared-world` requires `execution.target: e2b-desktop`: the role participants drive hosted desktop browsers against one in-sandbox app.";
     }
-    if (!actorResolvesToComputerUse(actorOf(config)?.type)) {
+    if (!actorResolvesToComputerUse(config.actor?.type)) {
         return `\`route: shared-world\` requires a registered computer-use actor (one of: ${registeredComputerUseActors().join(", ")}); each role participant runs a computer-use session.`;
     }
     const serve = config.subject.serve;
@@ -142,7 +142,7 @@ function provisionedSharedWorldStructureReason(config) {
 }
 /** SMTP capture runs only where each participant has its own world, so a shared world refuses it. */
 export function smtpValidationReason(config) {
-    return config.comms?.email?.smtp && declaresSharedWorld(config)
+    return config.comms?.email?.smtp && config.route === "shared-world"
         ? "SMTP capture is not supported yet for shared-world studies. Use the default per-lane-worlds topology for SMTP, or configure supported HTTP email capture for concurrent shared-world studies."
         : undefined;
 }
@@ -153,7 +153,7 @@ export function smtpValidationReason(config) {
  */
 export function desktopMediaValidationReason(config, supportsMedia = isComputerUseComposition(config)) {
     if (config.execution?.desktop?.recording !== undefined &&
-        (!supportsMedia || declaresSharedWorld(config) || config.subject.source === "local-app")) {
+        (!supportsMedia || config.route === "shared-world" || config.subject.source === "local-app")) {
         return "execution.desktop.recording is supported only for computer-use participants on independent desktops. Remove the declaration or select a supported route.";
     }
     const media = config.execution?.desktop?.media;
@@ -162,7 +162,7 @@ export function desktopMediaValidationReason(config, supportsMedia = isComputerU
     if (media.microphone !== undefined && media.microphone.source !== "speech") {
         return "execution.desktop.media.microphone.source must be speech. Microphone source-file injection is unsupported.";
     }
-    if (declaresSharedWorld(config)) {
+    if (config.route === "shared-world") {
         return "execution.desktop.media is unsupported on shared-world routes; declared capture devices would not be provisioned. Use independent computer-use browser participants or remove the declaration.";
     }
     if (!supportsMedia ||
@@ -174,7 +174,7 @@ export function desktopMediaValidationReason(config, supportsMedia = isComputerU
         return "execution.desktop.media requires Chrome or Chromium; Firefox cannot receive the declared synthetic capture device. Set execution.desktop.browser: chrome or chromium.";
     }
     if (media.microphone !== undefined) {
-        const actor = actorOf(config);
+        const actor = config.actor;
         if (actor !== undefined &&
             (actor.type !== "local-agent" ||
                 (actor.localAgent !== undefined && actor.localAgent !== "codex"))) {
@@ -194,7 +194,7 @@ export function receivingEmailValidationReason(config) {
         !["app-url", "clone", "local-tree"].includes(config.subject.source)) {
         return "Real email receiving requires a hosted computer-use browser study with an app-url, clone, or local-tree subject. Scripted, terminal, desktop-cli and local-app routes are unsupported.";
     }
-    if (actorOf(config)?.type === "local-agent") {
+    if (config.actor?.type === "local-agent") {
         return "Real email receiving is unavailable for local-agent: its host process does not isolate the inbox management credential. Use a hosted first-party computer-use actor.";
     }
     return undefined;
@@ -202,7 +202,7 @@ export function receivingEmailValidationReason(config) {
 /** Refuse task declarations that the selected execution path would discard.
  * Direct runners pass their actual support rather than trusting the config's dispatch shape. */
 export function taskProtocolValidationReason(config, supportsTasks = isComputerUseComposition(config) && !isSharedWorldComposition(config)) {
-    if (actorOf(config)?.tasks !== undefined && !supportsTasks) {
+    if (config.actor?.tasks !== undefined && !supportsTasks) {
         return "actor.tasks is unsupported on this execution path. Task protocols require the computer-use route, with one world per participant; shared-world, terminal-product, scripted-browser and synthetic routes do not consume them. Remove tasks only if a mission-only study is intended.";
     }
     return null;
@@ -223,7 +223,7 @@ export function cloneTargetValidationReason(config) {
 }
 /** Refuse a claimed output bound when the route cannot pass it to the first-party provider. */
 export function outputTokenLimitValidationReason(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     if (actor?.maxOutputTokens === undefined)
         return null;
     if (!isMaxOutputTokens(actor.maxOutputTokens))
@@ -302,7 +302,7 @@ export function externalPublicSharedWorldValidationReason(config) {
     if (config.execution?.target !== "e2b-desktop") {
         return "the external-public shared-world route requires `execution.target: e2b-desktop`: the role participants drive hosted desktop browsers against the one public deployment.";
     }
-    if (!actorResolvesToComputerUse(actorOf(config)?.type)) {
+    if (!actorResolvesToComputerUse(config.actor?.type)) {
         return `the external-public shared-world route requires a registered computer-use actor (one of: ${registeredComputerUseActors().join(", ")}); each role participant runs a computer-use session.`;
     }
     const roster = participantList(config);

package/dist/study/warnings.d.ts

@@ -9,4 +9,12 @@ export declare function inertFieldLabels(config: StudyConfig): string[];
  * `participants[].entry` or `execution.timeoutMs`. `humanish migrate` drops each one.
  */
 export declare function inertFieldPaths(config: StudyConfig): string[];
+/**
+ * The warning for `execution.egressAllow` on a route that ignores it, or undefined. Only the
+ * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
+ * study author would trust a list that blocks nothing. `humanish study check` and every run print
+ * it, and the run records it in its bundle.
+ * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ */
+export declare function egressAllowIgnoredWarning(config: StudyConfig): string | undefined;
 export declare function forwardDeclaredWarnings(config: StudyConfig): string[];

package/dist/study/warnings.js

@@ -1,7 +1,7 @@
 import { isComputerUseComposition, isScriptedBrowserComposition, isSharedWorldComposition, isTerminalProductComposition, } from "./routing.js";
 import { declaredParticipantIds } from "./plan-participants.js";
 import { addressedRecipients } from "./parse/comms.js";
-import { actorOf, participantList, declaredParticipantCount, scenarioRefOf, } from "./study-fields.js";
+import { participantList, declaredParticipantCount } from "./study-fields.js";
 // The computer-use and terminal routes consume mission/persona/model (they compose the agent prompt
 // and bundle provenance).
 const promptRoute = (routes) => routes.cua || routes.terminal;
@@ -29,25 +29,25 @@ const ACTOR_ROWS = [
     {
         field: "actor.mission",
         reason: "the scripted-browser actor runs no model",
-        applies: (config, routes) => scriptedRoute(routes) && Boolean(actorOf(config)?.mission),
+        applies: (config, routes) => scriptedRoute(routes) && Boolean(config.actor?.mission),
     },
     {
         field: "actor.model",
         reason: "the scripted-browser actor runs no model",
-        applies: (config, routes) => scriptedRoute(routes) && Boolean(actorOf(config)?.model),
+        applies: (config, routes) => scriptedRoute(routes) && Boolean(config.actor?.model),
     },
     // On every other route the prompt fields and persona are inert.
     {
         field: "actor.mission",
-        applies: (config, routes) => otherRoute(routes) && Boolean(actorOf(config)?.mission),
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.mission),
     },
     {
         field: "actor.persona",
-        applies: (config, routes) => otherRoute(routes) && Boolean(actorOf(config)?.persona),
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.persona),
     },
     {
         field: "actor.model",
-        applies: (config, routes) => otherRoute(routes) && Boolean(actorOf(config)?.model),
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.model),
     },
 ];
 const TERMINAL_ONLY = "needs subject.source: terminal-product + a registered terminal actor";
@@ -205,7 +205,7 @@ const CONFIG_ROWS = [
     // everywhere else.
     {
         field: "scenario",
-        applies: (config, routes) => Boolean(scenarioRefOf(config)) && !routes.scripted,
+        applies: (config, routes) => Boolean(config.scenario) && !routes.scripted,
     },
     // review.{scoring,milestones,vocabulary} stay forward-declared on every route.
     // review.scorer is consumed (loaded + wired, or fail-closed at load) on every scorer-capable
@@ -265,6 +265,18 @@ export function inertFieldLabels(config) {
 export function inertFieldPaths(config) {
     return inertRows(config).map((row) => row.field);
 }
+/**
+ * The warning for `execution.egressAllow` on a route that ignores it, or undefined. Only the
+ * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
+ * study author would trust a list that blocks nothing. `humanish study check` and every run print
+ * it, and the run records it in its bundle.
+ * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ */
+export function egressAllowIgnoredWarning(config) {
+    if (config.execution?.egressAllow === undefined || config.route === "terminal")
+        return undefined;
+    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: humanish 0.112.0 refuses it on every route except terminal.`;
+}
 // Report fields that are present but not yet consumed by the engine, so a user never trusts a
 // setting that silently does nothing.
 export function forwardDeclaredWarnings(config) {
@@ -275,6 +287,9 @@ export function forwardDeclaredWarnings(config) {
         : [
             `These fields are set, but no route reads them yet, so they have no effect: ${inert.join(", ")}.`,
         ];
+    const egressIgnored = egressAllowIgnoredWarning(config);
+    if (egressIgnored !== undefined)
+        warnings.push(egressIgnored);
     // A declared cap below the participant count is legal but loud: the roster promises N live actors
     // and the cap delivers waves of M. Say so up front (inspect + dry-run + run): a green run in
     // waves is otherwise indistinguishable from the all-live run the author meant.

package/dist/substrates/local/runtime-config.js

@@ -1,15 +1,15 @@
-import { actorOf, capsOf, participantList } from "../../study/study-fields.js";
+import { participantList } from "../../study/study-fields.js";
 // The runtime image enforces a 30-minute lifetime; reserve setup/teardown room.
 export const LOCAL_BROWSER_LIFETIME_MS = 30 * 60_000;
 const MAX_SESSION_MS = 20 * 60_000;
 export function isLocalBrowserStudy(config) {
     return (config.subject.source === "app-url" &&
         config.execution?.target === "local" &&
-        ["local-agent", "openai-computer-use"].includes(actorOf(config)?.type ?? ""));
+        ["local-agent", "openai-computer-use"].includes(config.actor?.type ?? ""));
 }
 /** Defaults for the explicitly selected local substrate; hosted configurations are untouched. */
 export function localBrowserDefaults(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     if (!isLocalBrowserStudy(config) || actor === undefined)
         return config;
     return {
@@ -33,7 +33,7 @@ export function localBrowserDefaults(config) {
     };
 }
 export function localBrowserUnsupportedReason(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     const desktop = config.execution?.desktop;
     if ((config.execution?.timeoutMs ?? MAX_SESSION_MS) > MAX_SESSION_MS) {
         return "Local browser sessions currently support at most 20 minutes, within the runtime's 30-minute lifetime.";
@@ -63,8 +63,8 @@ export function localBrowserUnsupportedReason(config) {
             actor.reasoningEffort !== "low" ||
             participantList(config)?.some((entry) => entry.reasoningEffort !== undefined && entry.reasoningEffort !== "low") ||
             actor.maxOutputTokens !== undefined ||
-            capsOf(config)?.maxUsd !== undefined ||
-            capsOf(config)?.maxTotalUsd !== undefined)) {
+            config.caps?.maxUsd !== undefined ||
+            config.caps?.maxTotalUsd !== undefined)) {
         return "Local Codex participants currently use gpt-6-astra at low effort. Account dollar/output-token caps are unavailable; use API participants for those controls.";
     }
     for (const target of [

package/docs/architecture/browser-control.md

@@ -62,8 +62,15 @@ runtime-management method. Initial target navigation remains an adapter-owned
 operation.
 
 Replies acknowledge completion or contain a finite `ComputerUseExecutorError` code and
-`not_dispatched` / `outcome_uncertain` disposition. They never include raw
+`not_dispatched` / `outcome_uncertain` disposition. An `action_rejected` /
+`not_dispatched` refusal may add a `reason` from a fixed list (`extra_tab`), which
+the study loop turns into a hint the participant can act on. They never include raw
 exception prose, typed text, page URLs, or browser errors in their error fields.
+A failure the driver did not declare may add a `diagnostic` of two fixed words: the
+step that failed (such as `insert_text`) and a category (`target_closed`,
+`detached`, `navigation`, `timeout`, `protocol_error`, `channel_closed` or
+`unknown`). The guest picks the category from the error's class and known message
+shapes and then drops the message; the host prints a fixed sentence for each word.
 A generic driver exception after invocation is uncertain; only a genuine typed
 driver declaration can attest that input was never dispatched.
 
@@ -96,7 +103,10 @@ Observation requires a PNG and state signature. It may include bounded URL,
 title, text, fractional scroll position and heard speech; those remain
 runtime-only under the existing loop contract. Arbitrary `appState` is refused
 because v1 has no closed schema for it. The protocol does not truncate strings,
-round coordinates, or silently drop unsupported state.
+round coordinates, or silently drop unsupported state. A Codex participant's
+`humanish_ui` call is checked before it reaches the protocol: a wait longer than 30 seconds is
+shortened to 30 seconds there, and the trace records a `wait shortened` notice with both
+durations.
 
 Click, double-click, move, scroll and drag may carry `heldKeys`, which the
 OpenAI provider maps from its computer tool's `keys`. The Codex participant's

package/docs/architecture/guest-desktop.md

@@ -38,6 +38,11 @@ world checks actual document focus and binds preparation to the editable element
 page changes, additional tabs, dialogs, iframe focus and ambiguous focus are
 refused. The owner acquires the one page and native window before untrusted
 navigation. The driver never chooses another tab or brings one to the front.
+Playwright emulates focus in every page it drives, so the focus probe also passes
+in a background tab and cannot tell which tab is in front; text therefore needs the
+owned page to be the context's only page. That refusal carries the fixed reason
+`extra_tab` over browser control, and the study loop tells the participant to close
+the other tab.
 Focus can change between protocol messages; this is not atomic element-targeted
 input or a general multi-window driver.
 
@@ -56,7 +61,8 @@ text paths likewise need application readback to establish task outcomes.
 Native children use fixed paths and a minimal explicit environment. Operator
 credentials and inherited Xauthority are not forwarded. Native address-bar text travels over the
 helper's stdin; web text travels over the private browser pipe, never a shell. Helpers have bounded deadlines and output;
-raw diagnostic text is never returned as an executor error. Only an acquired,
+raw diagnostic text is never returned as an executor error. A text port failure the
+driver did not declare carries only a fixed step and category. Only an acquired,
 still-live child handle authorizes termination. If capture-helper exit cannot
 be confirmed, its private files stay for runtime-owner reclamation.
 

package/docs/architecture/terminal-product-route.md

@@ -104,8 +104,9 @@ execution:
 Codex command receives the nonsecret value `humanish-egress-auth-placeholder`
 under `CODEX_API_KEY`, plus `CODEX_CA_CERTIFICATE` pointing at E2B's existing
 system CA bundle (`/etc/ssl/certs/ca-certificates.crt`) so TLS verification trusts
-the platform's proxy CA. humanish does not disable TLS verification or download
-an unauthenticated CA. The sandbox receives no raw runtime key in command env, sandbox env,
+the platform's proxy CA. `humanish doctor` run inside the sandbox reports that
+`CODEX_API_KEY` holds this placeholder and that no usable key is available.
+humanish does not disable TLS verification or download an unauthenticated CA. The sandbox receives no raw runtime key in command env, sandbox env,
 files, metadata, or captured evidence. The host still scrubs the actual key from
 output and errors, including errors during sandbox creation.