humanish 0.111.1 → 0.111.3

package/ARCHITECTURE.md

@@ -129,7 +129,7 @@ comments name an invariant by its rule.
 | The run bundle is the source of truth, and the Observer derives from it                                                  | `verifyRun` grades only `run.json` and its artifacts (`src/verify/verify.ts`). It reads `status.json` and the sandbox and reclaim receipts only for the `RUN_NOT_FINISHED` warning (`runNotFinished` in `src/verify/liveness.ts`), which changes no check and no grade. `buildObserverData` takes the bundle (`src/observer/data.ts`)                                                                                                                    | `tests/observer/data-contract.test.ts`; `tests/verify/run-not-finished.test.ts` checks that the grades are the same when `status.json` contradicts the bundle or is gone; `docs/decisions/0001-run-bundle-is-the-source-of-truth.md`                                                                                                                                                                                                                                             |
 | Unsupported execution is refused before side effects                                                                     | `parseStudy` (`src/study/config.ts`), `taskProtocolValidationReason` (`src/study/validation.ts`), `planComputerUseStudy` (`src/routes/computer-use/plan.ts`)                                                                                                                                                                                                                                                                                             | `tests/admission/library.test.ts` checks each library refusal for a run directory, a desktop module load, a caller executor or provider, and a subprocess; `tests/admission/cli.test.ts` checks each CLI refusal for a run directory, a started process and a scorer's host code; `tests/study/task-route-preflight.test.ts`; `pnpm cli:preflight:test` runs `scripts/task-route-preflight-proof.mjs` with `tests/fixtures/task-route-preflight/deny-side-effects.mjs` preloaded |
 | A sandbox id is recorded before any work runs in it                                                                      | `acquireE2BDesktopSandbox` and `acquireE2BShellSandbox` (`src/substrates/e2b/sandbox.ts`) tag the sandbox with its run's owner tags, register the create with `beginSandboxCreate` (`src/run/sandbox-creates.ts`) and write the receipt before they return the handle, and every route that creates a sandbox calls them; `reclaimRunSandboxes` (`src/run/reclaim.ts`) switches on the receipt's provider, kills by exact id and by the run's exact tags | `tests/substrates/e2b/sandbox.test.ts`, which also checks that `Sandbox.create` has one call site in `src/`, `tests/routes/terminal/acquisition-boundary.test.ts`, `tests/run/reclaim.test.ts`; `tests/routes/scripted/route.test.ts` checks create, receipt, then first work                                                                                                                                                                                                    |
-| Bundles carry no secrets                                                                                                 | `redactText` and `scrubLiterals` (`src/evidence/redaction.ts`); `scanRunPublicSafetyArtifacts` (`src/verify/artifacts.ts`); `buildShareSafety` (`src/verify/verify.ts`) grades `share_ready`, `local_only` or `blocked`                                                                                                                                                                                                                                  | `tests/evidence/redaction-hooks.test.ts`, `tests/run/transient-comms-secrets.test.ts`, `tests/verify/evidence-refs.test.ts`                                                                                                                                                                                                                                                                                                                                                      |
+| Bundles carry no secrets                                                                                                 | `redactText` and `scrubLiterals` (`src/evidence/redaction.ts`); `RunSecrets` (`src/run/secrets.ts`) holds the literal values each run scrubs; `scanRunPublicSafetyArtifacts` (`src/verify/artifacts.ts`); `buildShareSafety` (`src/verify/verify.ts`) grades `share_ready`, `local_only` or `blocked`                                                                                                                                                    | `tests/evidence/redaction-hooks.test.ts`, `tests/routes/known-secrets.test.ts`, `tests/run/transient-comms-secrets.test.ts`, `tests/verify/evidence-refs.test.ts`                                                                                                                                                                                                                                                                                                                |
 | Goldens pin route output                                                                                                 | `runDirSnapshot` (`tests/helpers/run-golden.ts`) snapshots a whole run folder                                                                                                                                                                                                                                                                                                                                                                            | `tests/golden/routes/`, `tests/golden/observer-data/`, `tests/golden/labs/`; `tests/study/plan-lab.test.ts` checks that every `StudyRoute` has a dry-run golden                                                                                                                                                                                                                                                                                                                  |
 | A run is closed on every exit, only a published run is analyzed, and `latest.json` moves only after its run is published | `runScope` and `FinishedRun` (`src/run/run.ts`); `completeAutomaticAnalysis` requires an issued `FinishedRun` for the result's run; `Run.finish` writes `latest.json` last through `writePreparedRunLatestPointer` (`src/run/contained-output.ts`)                                                                                                                                                                                                       | `tests/run/run-lifecycle.test.ts`, which also checks that `src/run/run.ts` is the pointer's one writer, `tests/analysis/automatic-analysis.test.ts`                                                                                                                                                                                                                                                                                                                              |
 

package/CHANGELOG.md

@@ -8,6 +8,35 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.111.3: Shared-world feedback candidates, scripted E2B key scrubbed, subject sandbox warnings (2026-10-06)
+
+humanish 0.111.3 gives shared-world runs feedback candidates and repairs seven places where one
+route's warnings, refusals, secret scrubbing or run directory checks differed from the other
+routes'. A shared-world participant who reports friction or gives up becomes a candidate that
+`humanish feedback` drafts, and each candidate from a run with several participants shows that
+participant's own instructions as `expected`. A scripted run scrubs the value of `E2B_API_KEY` from
+the errors and subject setup output it records, and writes `[REDACTED_SECRET]` where it wrote
+`[redacted]`. A shared-world study with `caps.maxUsd` and no `caps.maxTotalUsd` warns that the cap
+applies to each participant. The subject sandbox of a scripted clone study or a provisioned
+shared-world study warns when its create was retried or E2B reports no size. A scripted clone study
+missing a `subject.env` value, and a provisioned shared-world study missing `OPENAI_API_KEY`,
+refuse with the wording computer use gives. Computer-use and shared-world runs check the run
+directory again after a `prepareDesktop` hook and an Observer render.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.111.3)
+
+## 0.111.2: A taller Observer frame, even grid cards, a notice when the server stops (2026-10-06)
+
+humanish 0.111.2 changes the Observer and nothing else. The focus view's heading line holds the
+Back button, the participant pager, the name, the status and the inspector toggle, and the assigned
+task and participant background move into the Details tab, so the frame at 1600x1000 is 171 px
+taller. Every grid card has a 44 px caption, so phone-sized and desktop cards in one row end at the
+same height. An open Observer page whose server stopped shows one notice with the run id and two
+ways back to the recording, where 0.111.1 showed "Frame unavailable" on every tile. The CLI, the
+library and the study routes are the same as in 0.111.1.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.111.2)
+
 ## 0.111.1: E2B URLs in study URLs, fan-out dry runs verify, zero-data-retention cache holds (2026-10-06)
 
 humanish 0.111.1 fixes a study URL refusal and two verify problems that an adopter met on 0.111.0,

package/dist/cli/commands/study-route-computer-use.js

@@ -12,7 +12,7 @@ import { exposureRequestFromOptions, followDecision, followObserver, planObserve
 import { writeRunFindings } from "../findings.js";
 import { formatCuaStudyHuman } from "./study-format.js";
 import { resolveRouteShouldOpen } from "./study-route-open.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 import { declaredParticipantCount } from "../../study/study-fields.js";
 /**
  * The computer-use route's CLI setup: its settings, the watch and exposure plan, the runStudyWith options
@@ -51,17 +51,12 @@ export function computerUseRouteRun(args) {
     };
 }
 function refuseCua(args, dryRun, code, message) {
-    const result = {
-        ...studyResultIdentity("computer-use", args.config.id),
-        ok: false,
-        cwd: args.options.cwd,
+    const result = refusedResult("computer-use", { studyId: args.config.id, cwd: args.options.cwd, error: { code, message } }, {
         actor: args.config.actor?.type ?? "",
         appUrl: "",
         dryRun,
         runId: args.options.runId ?? "not-created",
-        warnings: [],
-        error: { code, message },
-    };
+    });
     writeResult(args.command, args.io, result, formatCuaStudyHuman);
     args.io.setExitCode(2);
 }

package/dist/cli/commands/study-route-preview.js

@@ -1,5 +1,5 @@
 import { Command } from "commander";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 import { formatRunHuman, parseStudyCount, writeResult, } from "../io.js";
 import { planObserver, showObserver, staticObserverOpen } from "../observer-follow.js";
 import { declaredParticipantCount } from "../../study/study-fields.js";
@@ -10,16 +10,14 @@ import { declaredParticipantCount } from "../../study/study-fields.js";
 export function previewRouteRun(args) {
     const participantCount = parseStudyCount(args.options.count, declaredParticipantCount(args.config) ?? 4);
     if (participantCount === null) {
-        const result = {
-            ...studyResultIdentity("preview", args.config.id),
-            ok: false,
+        const result = refusedResult("preview", {
+            studyId: args.config.id,
             cwd: args.options.cwd,
-            warnings: [],
             error: {
                 code: "HUMANISH_INVALID_PARTICIPANT_COUNT",
                 message: "--count must be a positive integer.",
             },
-        };
+        }, {});
         writeResult(args.command, args.io, result, formatRunHuman);
         args.io.setExitCode(2);
         return undefined;

package/dist/cli/commands/study-route-shared-world.js

@@ -9,7 +9,7 @@ import { followDecision, followObserver, showObserver, staticObserverOpen, withO
 import { writeRunFindings } from "../findings.js";
 import { formatConcurrentSharedWorldStudyHuman } from "./study-format.js";
 import { resolveRouteShouldOpen, watchFinishedPlan } from "./study-route-open.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 import { participantList } from "../../study/study-fields.js";
 /**
  * The shared-world route's CLI setup: dry run, open and follow semantics, the live Observer server
@@ -30,10 +30,11 @@ export function sharedWorldRouteRun(args) {
         followDecision({ wantsMachine, detach: args.options.detach, serve: args.options.serve }).follow;
     const port = parseObserverPort(args.options.port ?? "0");
     const failConcurrent = (message, runId) => {
-        const result = {
-            ...studyResultIdentity("shared-world", args.config.id),
-            ok: false,
+        const result = refusedResult("shared-world", {
+            studyId: args.config.id,
             cwd: args.options.cwd,
+            error: { code: "HUMANISH_SHARED_WORLD_FAILED", message },
+        }, {
             actor: args.config.actor?.type ?? "",
             topology: "shared-world",
             topologyMode: "concurrent",
@@ -42,9 +43,7 @@ export function sharedWorldRouteRun(args) {
             dryRun,
             runId: runId ?? args.options.runId ?? "not-created",
             roles: [],
-            warnings: [],
-            error: { code: "HUMANISH_SHARED_WORLD_FAILED", message },
-        };
+        });
         writeResult(args.command, args.io, result, formatConcurrentSharedWorldStudyHuman);
         args.io.setExitCode(2);
     };

package/dist/evidence/redaction.d.ts

@@ -112,11 +112,11 @@ export interface RedactionHooks {
 /** The default hooks wired into every actor: redaction.ts is the source of truth. */
 export declare const defaultRedactionHooks: RedactionHooks;
 /**
- * Replace each literal value with [REDACTED_SECRET]. For values that have no secret shape to
+ * Replace each literal value with `marker`. For values that have no secret shape to
  * pattern-match, such as provisioned keys and subject env values. `values` is read on each call,
  * so a value registered later is scrubbed too.
  */
-export declare function scrubLiterals(values: readonly string[]): (text: string) => string;
+export declare function scrubLiterals(values: readonly string[], marker?: string): (text: string) => string;
 /**
  * Coerce an unknown thrown value to its message string. Prefer this over the
  * inline `error instanceof Error ? error.message : String(error)` so error

package/dist/evidence/redaction.js

@@ -522,12 +522,12 @@ function blurPass(src, width, height, radius, horizontal) {
     return out;
 }
 /**
- * Replace each literal value with [REDACTED_SECRET]. For values that have no secret shape to
+ * Replace each literal value with `marker`. For values that have no secret shape to
  * pattern-match, such as provisioned keys and subject env values. `values` is read on each call,
  * so a value registered later is scrubbed too.
  */
-export function scrubLiterals(values) {
-    return (text) => values.reduce((current, value) => current.split(value).join("[REDACTED_SECRET]"), text);
+export function scrubLiterals(values, marker = "[REDACTED_SECRET]") {
+    return (text) => values.reduce((current, value) => current.split(value).join(marker), text);
 }
 /**
  * Coerce an unknown thrown value to its message string. Prefer this over the