humanish 0.111.1 → 0.111.3

package/dist/routes/scripted/result.d.ts

@@ -6,6 +6,7 @@ import type { RunBundle } from "../../run/bundle.js";
 import type { RunScope } from "../../run/run.js";
 import { type ExecutionFailure } from "../../run/judge.js";
 import type { ScriptedSubject } from "./subject.js";
+import type { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import { type ScriptedBrowserStudyResult } from "./types.js";
 /** What the finish reads from the run. */
 export interface ScriptedFinishInputs {
@@ -44,6 +45,6 @@ export declare function scriptedExecutionFailures(args: {
     sessionError: string | undefined;
     expected: number;
     sessionResults: readonly Pick<ScriptedBrowserSessionResult, "completionReason" | "reason">[];
-    subject: Pick<ScriptedSubject, "sandboxId" | "killed" | "releaseWarning"> | undefined;
+    subject: Pick<E2BSubjectSandbox, "sandboxId" | "killed" | "releaseWarning"> | undefined;
 }): ExecutionFailure[];
 export declare function finishScriptedRun(inputs: ScriptedFinishInputs): Promise<ScriptedBrowserStudyResult>;

package/dist/routes/scripted/result.js

@@ -53,11 +53,11 @@ export async function finishScriptedRun(inputs) {
     const { actor, dryRun } = plan;
     const { runId, paths: runPaths } = run;
     const subjectCommit = scriptedSubject?.commit;
-    const subjectSandboxId = scriptedSubject?.sandboxId;
-    const subjectKilled = scriptedSubject?.killed ?? false;
+    const subjectSandboxId = scriptedSubject?.sandbox.sandboxId;
+    const subjectKilled = scriptedSubject?.sandbox.killed ?? false;
     const hostDigest = scriptedSubject?.hostDigest;
     const stateStepRecords = scriptedSubject?.stateStepRecords ?? [];
-    const subjectDesktop = scriptedSubject?.desktopUsage();
+    const subjectDesktop = scriptedSubject?.sandbox.desktopUsage();
     const screenshotsBySurface = new Map();
     for (const result of sessionResults) {
         screenshotsBySurface.set(result.capture.surface.id, await existingScreenshots(runPaths, result));
@@ -114,7 +114,7 @@ export async function finishScriptedRun(inputs) {
         sessionError,
         expected: surfaces.length,
         sessionResults,
-        subject: scriptedSubject,
+        subject: scriptedSubject?.sandbox,
     }), policy);
     const finished = await run.finish(bundle, {
         ok: resultOk({ judgment, execution, scorerFailures: [], policy }),

package/dist/routes/scripted/route.js

@@ -14,11 +14,9 @@
 // subject, so its build provenance is unpinned and the evidence binds to the scenario digest. A
 // clone run records commit, env names, state provenance and a host digest, never the raw getHost
 // URL or a secret value.
-import { randomBytes } from "node:crypto";
 import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { redactText, toErrorMessage } from "../../evidence/redaction.js";
-import { buildRunSource } from "../../run/bundle.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import {} from "../../run/run.js";
 import { admitRoute, completeRefusalAnalysis } from "../../run/route-shell.js";
@@ -30,7 +28,7 @@ import { prepareScriptedRun } from "./setup.js";
 import { ScriptedSubject } from "./subject.js";
 import { runScriptedSessions, writeSurfaceTraces } from "./surface-sessions.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 /**
  * A refused scripted study's result, at the refusal's stage: a before-scope refusal has its own field
  * order and no analysis record; the others come after the output directory checks.
@@ -39,34 +37,25 @@ export async function scriptedStudyRefusal(options, refusal) {
     const { config, dryRun } = options;
     const cwd = path.resolve(options.cwd);
     const actorType = config.actor?.type ?? "";
+    const error = { code: refusal.code, message: refusal.message };
     if (refusal.beforeScope)
-        return {
-            ...studyResultIdentity("scripted", config.id),
-            ok: false,
-            cwd,
+        return refusedResult("scripted", { studyId: config.id, cwd, error }, {
             actor: actorType,
             dryRun,
             runId: options.runId ?? "not-created",
             appUrl: config.subject.appUrl ?? "",
             sessions: [],
-            warnings: [],
-            error: { code: refusal.code, message: refusal.message },
-        };
+        });
     // The other refusals come after the output directory checks and carry the analysis record.
     const physicalCwd = await realpath(cwd);
     await prepareSelectedOutputDirectory(path.dirname(physicalCwd), physicalCwd);
-    const refused = {
-        ...studyResultIdentity("scripted", config.id),
-        ok: false,
-        cwd,
+    const refused = refusedResult("scripted", { studyId: config.id, cwd, error }, {
         actor: refusal.actor ?? actorType,
         appUrl: refusal.appUrl ?? config.subject.appUrl ?? "",
         dryRun,
         runId: options.runId ?? "not-created",
         sessions: [],
-        warnings: [],
-        error: { code: refusal.code, message: refusal.message },
-    };
+    });
     return completeRefusalAnalysis(refused, config, options);
 }
 /**
@@ -88,30 +77,20 @@ async function runScriptedPlanInScope(plan, input, scope) {
         return prepared.result;
     const { dryRun } = plan;
     const { setup } = prepared;
-    const started = await scope.startRun({
+    const started = await scope.startRun(plan, input, {
         cwd: setup.physicalCwd,
-        runId: input.runId,
-        mintRunId: makeScriptedRunId,
-        mode: dryRun ? "dry-run" : "live",
-        study: plan.study,
-        warnings: plan.warnings,
+        prefix: "scripted",
         // Only a clone subject is served from a sandbox; an app-url run drives a local browser.
         sandboxes: setup.clone ? undefined : "none",
         renderReview: renderScriptedReviewMarkdown,
-        observer: { open: input.open === true, render: setup.deps.renderObserver },
+        secrets: setup.secrets,
     });
     if (!started.ok) {
         return setup.failed(started.code, started.message);
     }
     const { run } = started;
-    const { createdAt, paths: runPaths } = run;
+    const { paths: runPaths, source } = run;
     const artifactRoot = runPaths.physicalRunRoot;
-    const source = await buildRunSource({
-        capturedAt: createdAt,
-        cwd: setup.physicalCwd,
-        humanishSource: "present",
-        packageName: "humanish",
-    });
     const scriptedSubject = setup.clone
         ? new ScriptedSubject({
             plan,
@@ -124,7 +103,7 @@ async function runScriptedPlanInScope(plan, input, scope) {
             timeoutMs: setup.timeoutMs,
             subjectEnvNames: setup.subjectEnvNames,
             hasGithubToken: setup.hasGithubToken,
-            scrubKnownValues: setup.scrubKnownValues,
+            scrubKnownValues: run.secrets.scrub,
             now: setup.deps.now ?? Date.now,
             warnings: setup.warnings,
         })
@@ -156,10 +135,10 @@ async function runScriptedPlanInScope(plan, input, scope) {
             }
             // The session itself maps launch failures to harness_error; reaching here means the
             // harness around it failed. Redacted at this boundary before persisting anywhere.
-            sessionError = redactText(setup.scrubKnownValues(toErrorMessage(error)));
+            sessionError = redactText(run.secrets.scrub(toErrorMessage(error)));
         }
         finally {
-            await scriptedSubject?.teardown();
+            await scriptedSubject?.sandbox.release();
         }
         await writeSurfaceTraces(runPaths, sessionResults);
     }
@@ -182,7 +161,3 @@ async function runScriptedPlanInScope(plan, input, scope) {
         scriptedSubject,
     });
 }
-function makeScriptedRunId() {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    return `scripted-${stamp}-${randomBytes(4).toString("hex")}`;
-}

package/dist/routes/scripted/setup.d.ts

@@ -1,6 +1,7 @@
 import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { BrowserPersonaJourney, ScriptedBrowserEvidenceUrlPolicy } from "../../actors/scripted-browser/types.js";
 import type { ScriptedPlan } from "../../study/plan-types.js";
+import { RunSecrets } from "../../run/secrets.js";
 import { type ScriptedBrowserStudyResult, type ScriptedRunInput } from "./types.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 /** What setup hands the run: the plan's subject and scenario, keys and the browser to launch. */
@@ -20,7 +21,7 @@ export interface ScriptedRunSetup {
     e2bApiKey: string;
     hasGithubToken: boolean;
     redactRepoLabel: boolean;
-    scrubKnownValues: (text: string) => string;
+    secrets: RunSecrets;
     /** The loopback app URL, or the clone's serve URL until its getHost URL replaces it. */
     appUrl: string;
     scenario: {

package/dist/routes/scripted/setup.js

@@ -1,16 +1,16 @@
 // What a scripted run needs before it starts: the checks the plan cannot make (the scenario file,
 // the E2B key and subject env of a live clone, a browser to launch) and the values the run reads
-// (the evidence URL policy, the scrubber for clone values, the persona and the session budget).
+// (the evidence URL policy, the run's known secrets, the persona and the session budget).
 import { realpath } from "node:fs/promises";
-import { missingKeys, missingSubjectEnv } from "../../study/requirements.js";
+import { firstLiveRefusal, keysCheck, subjectEnvCheck } from "../../study/requirements.js";
 import path from "node:path";
 import { resolveBrowserCommand } from "../../actors/scripted-browser/browser-command.js";
-import { describeMissingKeys } from "../../keys/key-resolution.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
+import { RunSecrets } from "../../run/secrets.js";
 import { evidenceAppUrlOf } from "./plan.js";
 import { resolveScriptedScenario } from "./scenario.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 // Journey wall-clock budget per surface: 5 minutes. A scripted surface has zero model cost and
 // sandbox-seconds are pennies; a short default only truncated slow-loading subjects.
 const DEFAULT_SESSION_TIMEOUT_MS = 300_000;
@@ -27,17 +27,12 @@ export async function prepareScriptedRun(plan, input) {
     const warnings = [];
     const clone = plan.subject.kind === "clone" ? plan.subject : undefined;
     const evidenceAppUrl = evidenceAppUrlOf(plan.subject);
-    const failed = (code, message) => ({
-        ...studyResultIdentity("scripted", plan.studyId),
-        ok: false,
-        cwd,
+    const failed = (code, message) => refusedResult("scripted", { studyId: plan.studyId, cwd, warnings, error: { code, message } }, {
         actor: plan.actor,
         appUrl: evidenceAppUrl,
         dryRun,
         runId: input.runId ?? "not-created",
         sessions: [],
-        warnings,
-        error: { code, message },
     });
     const urlPolicy = clone
         ? { kind: "provisioned-subject", evidenceOrigin: evidenceAppUrl }
@@ -47,11 +42,11 @@ export async function prepareScriptedRun(plan, input) {
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     const hasGithubToken = subjectEnvNames.includes("GITHUB_TOKEN");
     const redactRepoLabel = plan.residual.policies?.redactRepos ?? hasGithubToken;
-    const scrubSourceValues = [
+    const secrets = new RunSecrets([
+        e2bApiKey,
         ...(clone ? [clone.repo] : []),
         ...subjectEnvNames.map((name) => env[name] ?? ""),
-    ].filter(Boolean);
-    const scrubKnownValues = (text) => scrubSourceValues.reduce((acc, value) => acc.split(value).join("[redacted]"), text);
+    ]);
     // A clone's URL is replaced by its getHost URL once it is served.
     let appUrl = plan.subject.kind === "clone" ? plan.subject.serve.url : plan.subject.appUrl;
     const scenario = await resolveScriptedScenario(projectRoot, plan.scenarioRef);
@@ -63,20 +58,18 @@ export async function prepareScriptedRun(plan, input) {
     }
     const journey = scenario.journey;
     // The plan lists E2B_API_KEY and the subject env only for a live clone.
-    const missing = missingKeys(plan.requirements, env);
-    if (missing.length > 0) {
-        return {
-            ok: false,
-            result: failed("HUMANISH_SCRIPTED_KEYS_MISSING", `Live clone scripted-browser studies require ${missing.join(" and ")} (dry-run remains $0 and does not provision a subject). ${describeMissingKeys(missing, env)}`),
-        };
-    }
-    const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
-    if (unsetSubjectEnv.length > 0) {
-        return {
-            ok: false,
-            result: failed("HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING", `Subject env values missing for a live clone scripted-browser study: ${unsetSubjectEnv.join(", ")}.`),
-        };
-    }
+    const { requirements } = plan;
+    const refusal = await firstLiveRefusal([
+        () => keysCheck({
+            requirements,
+            env,
+            code: "HUMANISH_SCRIPTED_KEYS_MISSING",
+            need: (names) => `Live clone scripted-browser studies require ${names} (dry-run remains $0 and does not provision a subject).`,
+        }),
+        () => subjectEnvCheck({ requirements, env, code: "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" }),
+    ]);
+    if (refusal)
+        return { ok: false, result: failed(refusal.code, refusal.message) };
     const surfaces = plan.surfaces;
     const timeoutMs = plan.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
     const persona = {
@@ -114,7 +107,7 @@ export async function prepareScriptedRun(plan, input) {
             e2bApiKey,
             hasGithubToken,
             redactRepoLabel,
-            scrubKnownValues,
+            secrets,
             appUrl,
             scenario,
             journey,

package/dist/routes/scripted/subject.d.ts

@@ -1,7 +1,7 @@
 import type { ScriptedPlan } from "../../study/plan-types.js";
 import { type PreparedRunArtifactPaths } from "../../run/paths.js";
 import type { RunSubjectStateStepRecord } from "../../run/bundle.js";
-import { type DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
 type ScriptedCloneSubject = Extract<ScriptedPlan["subject"], {
@@ -22,33 +22,18 @@ export interface ScriptedSubjectInputs {
     hasGithubToken: boolean;
     scrubKnownValues: (text: string) => string;
     now: () => number;
-    /** The run's warnings. Teardown appends to it. */
+    /** The run's warnings. The subject sandbox's release appends to it. */
     warnings: string[];
 }
 /** The subject sandbox and what provisioning it recorded. */
 export declare class ScriptedSubject {
-    sandboxId: string | undefined;
-    killed: boolean;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning: string | undefined;
+    readonly sandbox: E2BSubjectSandbox;
     commit: string | undefined;
     hostDigest: string | undefined;
     readonly stateStepRecords: RunSubjectStateStepRecord[];
     private readonly inputs;
-    private allocation;
-    private createdAtMs;
-    private tornDownAtMs;
-    private resources;
     constructor(inputs: ScriptedSubjectInputs);
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     provision(): Promise<string>;
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    teardown(): Promise<void>;
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage(): {
-        durationMs: number | undefined;
-        observation: DesktopResourceObservation | undefined;
-        killed: boolean;
-    } | undefined;
 }
 export {};

package/dist/routes/scripted/subject.js

@@ -5,11 +5,9 @@ import { commandDigestOf } from "../../subject/state.js";
 import { validatePreparedRunArtifactPaths, } from "../../run/paths.js";
 import { provisionCloneSubject } from "../../subject/clone.js";
 import { loadE2BDesktopModule } from "../../substrates/e2b/sdk.js";
-import { observeDesktopResources, } from "../../substrates/e2b/desktop-resources.js";
-import { acquireE2BDesktopSandbox, readE2BRelease } from "../../substrates/e2b/sandbox.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import { e2bShell } from "../../substrates/e2b/shell.js";
-import { e2bRequestTimeoutMs, SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
-import { DEFAULT_STATE_STEP_TIMEOUT_MS } from "../../subject/state.js";
+import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
 function servePort(serveUrl) {
     const url = new URL(serveUrl);
     if (url.port)
@@ -35,65 +33,44 @@ function hostOriginDigest(url) {
 }
 /** The subject sandbox and what provisioning it recorded. */
 export class ScriptedSubject {
-    sandboxId;
-    killed = false;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning;
+    sandbox;
     commit;
     hostDigest;
     stateStepRecords = [];
     inputs;
-    allocation;
-    createdAtMs;
-    tornDownAtMs;
-    resources;
     constructor(inputs) {
         this.inputs = inputs;
+        this.sandbox = new E2BSubjectSandbox({
+            warnings: inputs.warnings,
+            scrub: inputs.scrubKnownValues,
+            now: inputs.now,
+        });
     }
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     async provision() {
         const { plan, clone, deps, prepareDesktop, env, e2bApiKey, runPaths, timeoutMs } = this.inputs;
-        const { subjectEnvNames, hasGithubToken, scrubKnownValues, now } = this.inputs;
+        const { subjectEnvNames, hasGithubToken, scrubKnownValues } = this.inputs;
         const requestTimeoutMs = e2bRequestTimeoutMs(env);
         const timers = deps.detachedTimers ?? {};
-        const subjectSandboxTimeoutMs = timeoutMs +
-            SUBJECT_PROVISION_BUDGET_MS +
-            (clone.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0) +
-            SANDBOX_TIMEOUT_BUFFER_MS;
         const subjectModule = await (deps.desktopModule ?? loadE2BDesktopModule)();
         await validatePreparedRunArtifactPaths(runPaths);
-        // The receipt is on disk before any work on the sandbox, so `humanish reclaim` can kill
-        // it by exact id when this process dies mid-run; the finally block below only runs while
-        // the process is alive.
-        const subject = await acquireE2BDesktopSandbox({
+        const subjectDesktop = await this.sandbox.acquire({
             module: subjectModule,
-            options: {
-                apiKey: e2bApiKey,
-                requestTimeoutMs,
-                timeoutMs: subjectSandboxTimeoutMs,
-                metadata: {
-                    mode: "scripted-browser-lab",
-                    tool: "humanish",
-                    labId: plan.studyId,
-                    kind: "subject",
-                    actor: plan.actor,
-                },
-                ...(subjectEnvNames.length > 0
-                    ? {
-                        envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
-                    }
-                    : {}),
-                dpi: 96,
-                lifecycle: { onTimeout: "kill" },
+            apiKey: e2bApiKey,
+            requestTimeoutMs,
+            sessionTimeoutMs: timeoutMs,
+            seed: clone.state?.seed ?? [],
+            metadata: {
+                mode: "scripted-browser-lab",
+                tool: "humanish",
+                labId: plan.studyId,
+                kind: "subject",
+                actor: plan.actor,
             },
+            envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
             template: plan.residual.execution?.desktop?.template,
-            receipt: { root: runPaths, participantId: "subject" },
+            root: runPaths,
         });
-        const subjectDesktop = subject.sandbox;
-        this.allocation = subject.allocation;
-        this.sandboxId = subject.allocation.resourceId;
-        this.createdAtMs = now();
-        this.resources = await observeDesktopResources(subjectDesktop);
         if (prepareDesktop) {
             await prepareDesktop(subjectDesktop, { kind: "subject" });
             await validatePreparedRunArtifactPaths(runPaths);
@@ -125,37 +102,4 @@ export class ScriptedSubject {
         this.hostDigest = hostOriginDigest(hostUrl);
         return hostUrl;
     }
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    async teardown() {
-        const { warnings, scrubKnownValues, now } = this.inputs;
-        if (this.allocation === undefined)
-            return;
-        const released = await this.allocation.close();
-        const reading = readE2BRelease(released, {
-            label: "Subject sandbox",
-            scrub: scrubKnownValues,
-            costSpan: true,
-        });
-        this.killed = reading.released;
-        if (reading.warning)
-            warnings.push(reading.warning);
-        if (!reading.released)
-            this.releaseWarning = reading.warning ?? "Subject sandbox release is unconfirmed.";
-        // Without a kill method, or in E2B debug mode, no kill reached E2B, so there is no teardown
-        // time to record.
-        if (released.status !== "unconfirmed" || released.reason !== "release_unavailable")
-            this.tornDownAtMs = now();
-    }
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage() {
-        if (this.sandboxId === undefined)
-            return undefined;
-        return {
-            durationMs: this.createdAtMs === undefined || this.tornDownAtMs === undefined
-                ? undefined
-                : Math.max(0, this.tornDownAtMs - this.createdAtMs),
-            observation: this.resources,
-            killed: this.killed,
-        };
-    }
 }

package/dist/routes/scripted/types.d.ts

@@ -5,7 +5,7 @@ import type { ObserverResult } from "../../observer/render.js";
 import type { RunSubjectProvenance } from "../../run/bundle.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
-import { type StudyResultIdentity } from "../../run/study-result.js";
+import { type StudyResultErrorCode, type StudyResultIdentity } from "../../run/study-result.js";
 /** What a scripted run takes besides its plan. The plan carries the config, dry run and study. */
 export interface ScriptedRunInput {
     /** Cancels post-run analysis only. */
@@ -58,7 +58,7 @@ export interface ScriptedBrowserStudyResult extends AutomaticAnalysisResult, Stu
     observer?: ObserverResult;
     warnings: string[];
     error?: {
-        code: "HUMANISH_STUDY_ANALYSIS_INVALID" | "HUMANISH_STUDY_TASKS_UNSUPPORTED" | "HUMANISH_STUDY_OPTION_UNSUPPORTED" | "HUMANISH_STUDY_V2_UNSUPPORTED" | "HUMANISH_STUDY_INVALID" | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE" | "HUMANISH_RUN_ID_IN_USE";
+        code: StudyResultErrorCode | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE";
         message: string;
     };
 }

package/dist/routes/shared-world/bundle.js

@@ -8,6 +8,7 @@ import { SHARED_WORLD_SCHEMA, concurrencyFacts, sharedWorldParticipantKeys, } fr
 import { commandDigestOf } from "../../subject/state.js";
 import { buildRunCostSummary, desktopSpanToMinutes } from "../../run/cost-summary.js";
 import { participantFactsOf } from "../computer-use/participant-facts.js";
+import { participantFeedbackCandidates } from "../computer-use/participant-feedback.js";
 import { judgeSharedWorld, participantPassed, sharedWorldShortfall, verdictText, } from "../../run/judge.js";
 import { reviewOutcome } from "../../run/display.js";
 import { combineCheckpointDigest } from "./checkpoints.js";
@@ -369,7 +370,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         },
         artifacts: bundleArtifacts(),
         review,
-        feedbackCandidates: [],
+        feedbackCandidates: sharedWorldFeedbackCandidates(args),
         // Custom desktop image provenance (subject + every actor sandbox launched on it); omitted on the default.
         ...(plan.residual.execution?.desktop?.template === undefined
             ? {}
@@ -380,6 +381,40 @@ export function buildConcurrentSharedWorldBundle(args) {
         ...(cost === undefined ? {} : { cost }),
     };
 }
+/**
+ * What the participants reported, built by the same builder as a computer-use fan-out: one
+ * candidate per participant who reported friction or abandoned the goal, named by its participant
+ * id, with that participant's own instructions as `expected`. Dry-run and in-progress bundles
+ * carry none: there is no participant yet to quote. The comms thread belongs to the one shared
+ * app, so each candidate cites it.
+ */
+function sharedWorldFeedbackCandidates(args) {
+    if (args.dryRun || args.inProgress === true)
+        return [];
+    return participantFeedbackCandidates({
+        runId: args.run.runId,
+        scenarioId: `concurrent-shared-world-${args.plan.studyId}`,
+        adapterId: args.plan.studyId,
+        // planSharedWorldStudy refuses any target other than e2b-desktop on both planes.
+        substrate: "e2b-desktop",
+        participants: args.actorSpecs.map((spec, index) => {
+            const outcome = args.actorResults[index]?.outcome;
+            return {
+                participantId: spec.planned.id,
+                streamId: spec.streamId,
+                personaId: spec.persona.id,
+                goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                ...(outcome?.session === undefined
+                    ? {}
+                    : { session: outcome.session, traceArtifactPath: spec.traceArtifactPath }),
+                screenshots: outcome?.screenshots ?? [],
+                ...(args.commsArtifactPath === undefined
+                    ? {}
+                    : { commsArtifactPath: args.commsArtifactPath }),
+            };
+        }),
+    });
+}
 /**
  * Priced like `per-lane-worlds`: each participant's model tokens and desktop, plus the provisioned plane's
  * desktop. Absent when nothing ran, so dry runs and in-progress snapshots stay byte-stable.

package/dist/routes/shared-world/comms.d.ts

@@ -3,6 +3,7 @@ import type { SharedWorldPlan } from "../../study/plan-types.js";
 import type { CommsReceivingRun } from "../../comms/receiving.js";
 import { type DeployedCommsCatch } from "../../comms/sandbox-catch.js";
 import type { StudyCommsEmail, StudyConfig } from "../../study/types.js";
+import type { RunSecrets } from "../../run/secrets.js";
 import type { Shell } from "../../substrates/shell.js";
 import type { ConcurrentSharedWorldPlaneClass, ExternalCommsWiring, PlaneContext } from "./types.js";
 /** The in-sandbox email catch a provisioned plane deploys, when the study declares one. */
@@ -58,7 +59,7 @@ export declare function prepareEmailReceiving(args: {
     env: Record<string, string | undefined>;
     participants: string[];
     runPaths: PlaneContext["runPaths"];
-    knownSecretValues: string[];
+    secrets: RunSecrets;
     dryRun: boolean;
 }): Promise<{
     ok: true;

package/dist/routes/shared-world/comms.js

@@ -116,7 +116,7 @@ export async function drainExternalComms(ctx, comms) {
         email: comms.email,
         env: ctx.env,
         runPaths: ctx.runPaths,
-        knownSecretValues: ctx.knownSecretValues,
+        knownSecretValues: ctx.run.secrets.values(),
     });
     ctx.warnings.push(...warnings);
     return path;
@@ -136,7 +136,7 @@ export function receivingSourceOf(residual, env) {
  * when setup fails.
  */
 export async function prepareEmailReceiving(args) {
-    const { source, knownSecretValues } = args;
+    const { source, secrets } = args;
     if (args.dryRun || source.comms?.email?.kind !== "real")
         return { ok: true, receiving: undefined };
     try {
@@ -147,11 +147,7 @@ export async function prepareEmailReceiving(args) {
             env: args.env,
             participants: args.participants,
             runPaths: args.runPaths,
-            registerSecrets: (values) => {
-                for (const value of values)
-                    if (value.length >= 4 && !knownSecretValues.includes(value))
-                        knownSecretValues.push(value);
-            },
+            registerSecrets: (values) => secrets.add(values),
         });
         return { ok: true, receiving };
     }

package/dist/routes/shared-world/handoff.d.ts

@@ -1,9 +1,9 @@
 import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
-import { type ParticipantRunDeps } from "./participant-specs.js";
+import type { DesktopParticipantDeps } from "../computer-use/participant-deps.js";
 import type { ActorRunResult, ExternalCommsWiring } from "./types.js";
 /** What the host and follower participants need besides the handoff. */
 export interface HandoffParticipantDeps {
-    runDeps: ParticipantRunDeps;
+    runDeps: DesktopParticipantDeps;
     publicAppUrl: string;
     inbox: ExternalCommsWiring | undefined;
     now: () => number;

package/dist/routes/shared-world/handoff.js

@@ -14,7 +14,7 @@ import { withInboxMission } from "../computer-use/participant-prompt.js";
 import { runCuaParticipant } from "../computer-use/participant-execution.js";
 import { extractLobbyCode, extractLobbyCodeFromNarration } from "./lobby-code.js";
 import { hostOriginDigest } from "./provenance.js";
-import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./participant-specs.js";
+import { makeBlockedFollowerOutcome, withLobbyCodeMission } from "./participant-specs.js";
 // The floor for the host-first handoff barrier deadline (ms). The host must surface a
 // shared-session (/lobby/CODE) URL within the deadline or the run fails closed and no follower
 // opens. The effective deadline scales with the per-participant run budget (execution.timeoutMs): a

package/dist/routes/shared-world/participant-specs.d.ts

@@ -1,7 +1,8 @@
 import type { SharedWorldPlan } from "../../study/plan-types.js";
 import type { Participant, SharedWorldParticipant } from "../../study/plan-participants.js";
 import type { RunBundle } from "../../run/bundle.js";
-import type { CuaParticipantDeps, DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
+import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
+import { type DesktopParticipantDeps } from "../computer-use/participant-deps.js";
 import type { LiveParticipants, PlaneContext } from "./types.js";
 export declare function defaultSessionTimeoutMs(plan: SharedWorldPlan): number;
 /** Resolve an actor's participant URL against the harness-minted getHost base (entry is a
@@ -16,8 +17,6 @@ export declare function withLobbyCodeMission(spec: DesktopParticipantRun, code:
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
  * keep the actual reason rather than turning every upstream failure into a timeout. */
 export declare function makeBlockedFollowerOutcome(spec: DesktopParticipantRun, reason: string, timedOut: boolean): ParticipantRunOutcome;
-/** The computer-use runner deps every participant shares, on either plane. */
-export type ParticipantRunDeps = Omit<CuaParticipantDeps, "signalProvisioned" | "appUrl" | "onObservedUrl">;
 /**
  * A live run publishes an in-progress bundle before its participants start, whether or not an
  * Observer is attached, and the participants' live traces rewrite it as they go, as on the
@@ -30,9 +29,9 @@ export declare function startParticipantFlush(ctx: PlaneContext, live: LiveParti
  * out of every actor sandbox: the subject env names' values, the GitHub token, and clone
  * or local-tree provisioning. The committed subject.envValues still reach it, non-secret by parse.
  * `scrubKnownValues` is the plane's scrub: the external-public plane also scrubs the latched lobby
- * code.
+ * code. A plane calls this once per run, since the deps carry the run's one budget.
  */
-export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): ParticipantRunDeps;
+export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): DesktopParticipantDeps;
 /**
  * Each participant's actor spec, with committed personas compiled in so each prompt carries real
  * behavioral directives. Evidence copies of the assignment, instructions and persona are