humanish 0.111.2 → 0.111.3

package/dist/routes/scripted/subject.d.ts

@@ -1,7 +1,7 @@
 import type { ScriptedPlan } from "../../study/plan-types.js";
 import { type PreparedRunArtifactPaths } from "../../run/paths.js";
 import type { RunSubjectStateStepRecord } from "../../run/bundle.js";
-import { type DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
 type ScriptedCloneSubject = Extract<ScriptedPlan["subject"], {
@@ -22,33 +22,18 @@ export interface ScriptedSubjectInputs {
     hasGithubToken: boolean;
     scrubKnownValues: (text: string) => string;
     now: () => number;
-    /** The run's warnings. Teardown appends to it. */
+    /** The run's warnings. The subject sandbox's release appends to it. */
     warnings: string[];
 }
 /** The subject sandbox and what provisioning it recorded. */
 export declare class ScriptedSubject {
-    sandboxId: string | undefined;
-    killed: boolean;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning: string | undefined;
+    readonly sandbox: E2BSubjectSandbox;
     commit: string | undefined;
     hostDigest: string | undefined;
     readonly stateStepRecords: RunSubjectStateStepRecord[];
     private readonly inputs;
-    private allocation;
-    private createdAtMs;
-    private tornDownAtMs;
-    private resources;
     constructor(inputs: ScriptedSubjectInputs);
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     provision(): Promise<string>;
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    teardown(): Promise<void>;
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage(): {
-        durationMs: number | undefined;
-        observation: DesktopResourceObservation | undefined;
-        killed: boolean;
-    } | undefined;
 }
 export {};

package/dist/routes/scripted/subject.js

@@ -5,11 +5,9 @@ import { commandDigestOf } from "../../subject/state.js";
 import { validatePreparedRunArtifactPaths, } from "../../run/paths.js";
 import { provisionCloneSubject } from "../../subject/clone.js";
 import { loadE2BDesktopModule } from "../../substrates/e2b/sdk.js";
-import { observeDesktopResources, } from "../../substrates/e2b/desktop-resources.js";
-import { acquireE2BDesktopSandbox, readE2BRelease } from "../../substrates/e2b/sandbox.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import { e2bShell } from "../../substrates/e2b/shell.js";
-import { e2bRequestTimeoutMs, SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
-import { DEFAULT_STATE_STEP_TIMEOUT_MS } from "../../subject/state.js";
+import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
 function servePort(serveUrl) {
     const url = new URL(serveUrl);
     if (url.port)
@@ -35,65 +33,44 @@ function hostOriginDigest(url) {
 }
 /** The subject sandbox and what provisioning it recorded. */
 export class ScriptedSubject {
-    sandboxId;
-    killed = false;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning;
+    sandbox;
     commit;
     hostDigest;
     stateStepRecords = [];
     inputs;
-    allocation;
-    createdAtMs;
-    tornDownAtMs;
-    resources;
     constructor(inputs) {
         this.inputs = inputs;
+        this.sandbox = new E2BSubjectSandbox({
+            warnings: inputs.warnings,
+            scrub: inputs.scrubKnownValues,
+            now: inputs.now,
+        });
     }
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     async provision() {
         const { plan, clone, deps, prepareDesktop, env, e2bApiKey, runPaths, timeoutMs } = this.inputs;
-        const { subjectEnvNames, hasGithubToken, scrubKnownValues, now } = this.inputs;
+        const { subjectEnvNames, hasGithubToken, scrubKnownValues } = this.inputs;
         const requestTimeoutMs = e2bRequestTimeoutMs(env);
         const timers = deps.detachedTimers ?? {};
-        const subjectSandboxTimeoutMs = timeoutMs +
-            SUBJECT_PROVISION_BUDGET_MS +
-            (clone.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0) +
-            SANDBOX_TIMEOUT_BUFFER_MS;
         const subjectModule = await (deps.desktopModule ?? loadE2BDesktopModule)();
         await validatePreparedRunArtifactPaths(runPaths);
-        // The receipt is on disk before any work on the sandbox, so `humanish reclaim` can kill
-        // it by exact id when this process dies mid-run; the finally block below only runs while
-        // the process is alive.
-        const subject = await acquireE2BDesktopSandbox({
+        const subjectDesktop = await this.sandbox.acquire({
             module: subjectModule,
-            options: {
-                apiKey: e2bApiKey,
-                requestTimeoutMs,
-                timeoutMs: subjectSandboxTimeoutMs,
-                metadata: {
-                    mode: "scripted-browser-lab",
-                    tool: "humanish",
-                    labId: plan.studyId,
-                    kind: "subject",
-                    actor: plan.actor,
-                },
-                ...(subjectEnvNames.length > 0
-                    ? {
-                        envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
-                    }
-                    : {}),
-                dpi: 96,
-                lifecycle: { onTimeout: "kill" },
+            apiKey: e2bApiKey,
+            requestTimeoutMs,
+            sessionTimeoutMs: timeoutMs,
+            seed: clone.state?.seed ?? [],
+            metadata: {
+                mode: "scripted-browser-lab",
+                tool: "humanish",
+                labId: plan.studyId,
+                kind: "subject",
+                actor: plan.actor,
             },
+            envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
             template: plan.residual.execution?.desktop?.template,
-            receipt: { root: runPaths, participantId: "subject" },
+            root: runPaths,
         });
-        const subjectDesktop = subject.sandbox;
-        this.allocation = subject.allocation;
-        this.sandboxId = subject.allocation.resourceId;
-        this.createdAtMs = now();
-        this.resources = await observeDesktopResources(subjectDesktop);
         if (prepareDesktop) {
             await prepareDesktop(subjectDesktop, { kind: "subject" });
             await validatePreparedRunArtifactPaths(runPaths);
@@ -125,37 +102,4 @@ export class ScriptedSubject {
         this.hostDigest = hostOriginDigest(hostUrl);
         return hostUrl;
     }
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    async teardown() {
-        const { warnings, scrubKnownValues, now } = this.inputs;
-        if (this.allocation === undefined)
-            return;
-        const released = await this.allocation.close();
-        const reading = readE2BRelease(released, {
-            label: "Subject sandbox",
-            scrub: scrubKnownValues,
-            costSpan: true,
-        });
-        this.killed = reading.released;
-        if (reading.warning)
-            warnings.push(reading.warning);
-        if (!reading.released)
-            this.releaseWarning = reading.warning ?? "Subject sandbox release is unconfirmed.";
-        // Without a kill method, or in E2B debug mode, no kill reached E2B, so there is no teardown
-        // time to record.
-        if (released.status !== "unconfirmed" || released.reason !== "release_unavailable")
-            this.tornDownAtMs = now();
-    }
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage() {
-        if (this.sandboxId === undefined)
-            return undefined;
-        return {
-            durationMs: this.createdAtMs === undefined || this.tornDownAtMs === undefined
-                ? undefined
-                : Math.max(0, this.tornDownAtMs - this.createdAtMs),
-            observation: this.resources,
-            killed: this.killed,
-        };
-    }
 }

package/dist/routes/scripted/types.d.ts

@@ -5,7 +5,7 @@ import type { ObserverResult } from "../../observer/render.js";
 import type { RunSubjectProvenance } from "../../run/bundle.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
-import { type StudyResultIdentity } from "../../run/study-result.js";
+import { type StudyResultErrorCode, type StudyResultIdentity } from "../../run/study-result.js";
 /** What a scripted run takes besides its plan. The plan carries the config, dry run and study. */
 export interface ScriptedRunInput {
     /** Cancels post-run analysis only. */
@@ -58,7 +58,7 @@ export interface ScriptedBrowserStudyResult extends AutomaticAnalysisResult, Stu
     observer?: ObserverResult;
     warnings: string[];
     error?: {
-        code: "HUMANISH_STUDY_ANALYSIS_INVALID" | "HUMANISH_STUDY_TASKS_UNSUPPORTED" | "HUMANISH_STUDY_OPTION_UNSUPPORTED" | "HUMANISH_STUDY_V2_UNSUPPORTED" | "HUMANISH_STUDY_INVALID" | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE" | "HUMANISH_RUN_ID_IN_USE";
+        code: StudyResultErrorCode | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE";
         message: string;
     };
 }

package/dist/routes/shared-world/bundle.js

@@ -8,6 +8,7 @@ import { SHARED_WORLD_SCHEMA, concurrencyFacts, sharedWorldParticipantKeys, } fr
 import { commandDigestOf } from "../../subject/state.js";
 import { buildRunCostSummary, desktopSpanToMinutes } from "../../run/cost-summary.js";
 import { participantFactsOf } from "../computer-use/participant-facts.js";
+import { participantFeedbackCandidates } from "../computer-use/participant-feedback.js";
 import { judgeSharedWorld, participantPassed, sharedWorldShortfall, verdictText, } from "../../run/judge.js";
 import { reviewOutcome } from "../../run/display.js";
 import { combineCheckpointDigest } from "./checkpoints.js";
@@ -369,7 +370,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         },
         artifacts: bundleArtifacts(),
         review,
-        feedbackCandidates: [],
+        feedbackCandidates: sharedWorldFeedbackCandidates(args),
         // Custom desktop image provenance (subject + every actor sandbox launched on it); omitted on the default.
         ...(plan.residual.execution?.desktop?.template === undefined
             ? {}
@@ -380,6 +381,40 @@ export function buildConcurrentSharedWorldBundle(args) {
         ...(cost === undefined ? {} : { cost }),
     };
 }
+/**
+ * What the participants reported, built by the same builder as a computer-use fan-out: one
+ * candidate per participant who reported friction or abandoned the goal, named by its participant
+ * id, with that participant's own instructions as `expected`. Dry-run and in-progress bundles
+ * carry none: there is no participant yet to quote. The comms thread belongs to the one shared
+ * app, so each candidate cites it.
+ */
+function sharedWorldFeedbackCandidates(args) {
+    if (args.dryRun || args.inProgress === true)
+        return [];
+    return participantFeedbackCandidates({
+        runId: args.run.runId,
+        scenarioId: `concurrent-shared-world-${args.plan.studyId}`,
+        adapterId: args.plan.studyId,
+        // planSharedWorldStudy refuses any target other than e2b-desktop on both planes.
+        substrate: "e2b-desktop",
+        participants: args.actorSpecs.map((spec, index) => {
+            const outcome = args.actorResults[index]?.outcome;
+            return {
+                participantId: spec.planned.id,
+                streamId: spec.streamId,
+                personaId: spec.persona.id,
+                goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                ...(outcome?.session === undefined
+                    ? {}
+                    : { session: outcome.session, traceArtifactPath: spec.traceArtifactPath }),
+                screenshots: outcome?.screenshots ?? [],
+                ...(args.commsArtifactPath === undefined
+                    ? {}
+                    : { commsArtifactPath: args.commsArtifactPath }),
+            };
+        }),
+    });
+}
 /**
  * Priced like `per-lane-worlds`: each participant's model tokens and desktop, plus the provisioned plane's
  * desktop. Absent when nothing ran, so dry runs and in-progress snapshots stay byte-stable.

package/dist/routes/shared-world/comms.d.ts

@@ -3,6 +3,7 @@ import type { SharedWorldPlan } from "../../study/plan-types.js";
 import type { CommsReceivingRun } from "../../comms/receiving.js";
 import { type DeployedCommsCatch } from "../../comms/sandbox-catch.js";
 import type { StudyCommsEmail, StudyConfig } from "../../study/types.js";
+import type { RunSecrets } from "../../run/secrets.js";
 import type { Shell } from "../../substrates/shell.js";
 import type { ConcurrentSharedWorldPlaneClass, ExternalCommsWiring, PlaneContext } from "./types.js";
 /** The in-sandbox email catch a provisioned plane deploys, when the study declares one. */
@@ -58,7 +59,7 @@ export declare function prepareEmailReceiving(args: {
     env: Record<string, string | undefined>;
     participants: string[];
     runPaths: PlaneContext["runPaths"];
-    knownSecretValues: string[];
+    secrets: RunSecrets;
     dryRun: boolean;
 }): Promise<{
     ok: true;

package/dist/routes/shared-world/comms.js

@@ -116,7 +116,7 @@ export async function drainExternalComms(ctx, comms) {
         email: comms.email,
         env: ctx.env,
         runPaths: ctx.runPaths,
-        knownSecretValues: ctx.knownSecretValues,
+        knownSecretValues: ctx.run.secrets.values(),
     });
     ctx.warnings.push(...warnings);
     return path;
@@ -136,7 +136,7 @@ export function receivingSourceOf(residual, env) {
  * when setup fails.
  */
 export async function prepareEmailReceiving(args) {
-    const { source, knownSecretValues } = args;
+    const { source, secrets } = args;
     if (args.dryRun || source.comms?.email?.kind !== "real")
         return { ok: true, receiving: undefined };
     try {
@@ -147,11 +147,7 @@ export async function prepareEmailReceiving(args) {
             env: args.env,
             participants: args.participants,
             runPaths: args.runPaths,
-            registerSecrets: (values) => {
-                for (const value of values)
-                    if (value.length >= 4 && !knownSecretValues.includes(value))
-                        knownSecretValues.push(value);
-            },
+            registerSecrets: (values) => secrets.add(values),
         });
         return { ok: true, receiving };
     }

package/dist/routes/shared-world/handoff.d.ts

@@ -1,9 +1,9 @@
 import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
-import { type ParticipantRunDeps } from "./participant-specs.js";
+import type { DesktopParticipantDeps } from "../computer-use/participant-deps.js";
 import type { ActorRunResult, ExternalCommsWiring } from "./types.js";
 /** What the host and follower participants need besides the handoff. */
 export interface HandoffParticipantDeps {
-    runDeps: ParticipantRunDeps;
+    runDeps: DesktopParticipantDeps;
     publicAppUrl: string;
     inbox: ExternalCommsWiring | undefined;
     now: () => number;

package/dist/routes/shared-world/handoff.js

@@ -14,7 +14,7 @@ import { withInboxMission } from "../computer-use/participant-prompt.js";
 import { runCuaParticipant } from "../computer-use/participant-execution.js";
 import { extractLobbyCode, extractLobbyCodeFromNarration } from "./lobby-code.js";
 import { hostOriginDigest } from "./provenance.js";
-import { makeBlockedFollowerOutcome, withLobbyCodeMission, } from "./participant-specs.js";
+import { makeBlockedFollowerOutcome, withLobbyCodeMission } from "./participant-specs.js";
 // The floor for the host-first handoff barrier deadline (ms). The host must surface a
 // shared-session (/lobby/CODE) URL within the deadline or the run fails closed and no follower
 // opens. The effective deadline scales with the per-participant run budget (execution.timeoutMs): a

package/dist/routes/shared-world/participant-specs.d.ts

@@ -1,7 +1,8 @@
 import type { SharedWorldPlan } from "../../study/plan-types.js";
 import type { Participant, SharedWorldParticipant } from "../../study/plan-participants.js";
 import type { RunBundle } from "../../run/bundle.js";
-import type { CuaParticipantDeps, DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
+import type { DesktopParticipantRun, ParticipantRunOutcome } from "../computer-use/types.js";
+import { type DesktopParticipantDeps } from "../computer-use/participant-deps.js";
 import type { LiveParticipants, PlaneContext } from "./types.js";
 export declare function defaultSessionTimeoutMs(plan: SharedWorldPlan): number;
 /** Resolve an actor's participant URL against the harness-minted getHost base (entry is a
@@ -16,8 +17,6 @@ export declare function withLobbyCodeMission(spec: DesktopParticipantRun, code:
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
  * keep the actual reason rather than turning every upstream failure into a timeout. */
 export declare function makeBlockedFollowerOutcome(spec: DesktopParticipantRun, reason: string, timedOut: boolean): ParticipantRunOutcome;
-/** The computer-use runner deps every participant shares, on either plane. */
-export type ParticipantRunDeps = Omit<CuaParticipantDeps, "signalProvisioned" | "appUrl" | "onObservedUrl">;
 /**
  * A live run publishes an in-progress bundle before its participants start, whether or not an
  * Observer is attached, and the participants' live traces rewrite it as they go, as on the
@@ -30,9 +29,9 @@ export declare function startParticipantFlush(ctx: PlaneContext, live: LiveParti
  * out of every actor sandbox: the subject env names' values, the GitHub token, and clone
  * or local-tree provisioning. The committed subject.envValues still reach it, non-secret by parse.
  * `scrubKnownValues` is the plane's scrub: the external-public plane also scrubs the latched lobby
- * code.
+ * code. A plane calls this once per run, since the deps carry the run's one budget.
  */
-export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): ParticipantRunDeps;
+export declare function participantRunDeps(ctx: PlaneContext, live: LiveParticipants, scrubKnownValues: (text: string) => string): DesktopParticipantDeps;
 /**
  * Each participant's actor spec, with committed personas compiled in so each prompt carries real
  * behavioral directives. Evidence copies of the assignment, instructions and persona are

package/dist/routes/shared-world/participant-specs.js

@@ -7,6 +7,7 @@ import { resolveParticipant } from "../../run/participant.js";
 import { attachObserverRuntimeStreamUrls } from "../../observer/render.js";
 import { composeParticipantInstructions } from "../computer-use/participant-prompt.js";
 import { startLiveTraceFlush } from "../computer-use/live-flush.js";
+import { desktopParticipantDeps, } from "../computer-use/participant-deps.js";
 import { resolveCommittedPersonasForCwd } from "../../study/persona-resolve.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { redactText } from "../../evidence/redaction.js";
@@ -143,26 +144,25 @@ function participantStreams(onStream, live) {
  * out of every actor sandbox: the subject env names' values, the GitHub token, and clone
  * or local-tree provisioning. The committed subject.envValues still reach it, non-secret by parse.
  * `scrubKnownValues` is the plane's scrub: the external-public plane also scrubs the latched lobby
- * code.
+ * code. A plane calls this once per run, since the deps carry the run's one budget.
  */
 export function participantRunDeps(ctx, live, scrubKnownValues) {
-    const { config, env, receiving, runBudget } = ctx;
-    return {
-        onTrace: (participantId, items, usage, metadata) => live.flush?.flush(participantId, items, usage, metadata),
-        residual: ctx.plan.residual,
-        studyId: ctx.plan.studyId,
-        caps: ctx.plan.caps,
+    const { config, plan } = ctx;
+    return desktopParticipantDeps({
+        plan,
+        // A local-agent brain runs each participant on the operator's signed-in agent, as on
+        // computer use.
+        brain: plan.brain,
         subject: {
             kind: "shared-app",
             ...(config.subject.serve?.url === undefined ? {} : { serveUrl: config.subject.serve.url }),
         },
-        env,
+        env: ctx.env,
         openaiApiKey: ctx.openaiApiKey,
         e2bApiKey: ctx.e2bApiKey,
-        requestTimeoutMs: ctx.requestTimeoutMs,
-        sandboxMs: ctx.timeoutMs + SANDBOX_TIMEOUT_BUFFER_MS,
         timeoutMs: ctx.timeoutMs,
-        participantCount: ctx.plan.plane.participants.length,
+        sandboxMs: ctx.timeoutMs + SANDBOX_TIMEOUT_BUFFER_MS,
+        participantCount: plan.plane.participants.length,
         artifactRoot: ctx.runPaths,
         studyCwd: ctx.cwd,
         redactScreenshots: ctx.redactScreenshots,
@@ -172,27 +172,21 @@ export function participantRunDeps(ctx, live, scrubKnownValues) {
             ctx.run.participantStarted();
             return ctx.runSession(options);
         },
-        // A local-agent brain runs each participant on the operator's signed-in agent, as on computer
-        // use.
-        brain: ctx.plan.brain,
-        ...(receiving ? { receiving } : {}),
-        now: ctx.now,
-        // The participant's desktop seams, and the caller's prepareDesktop with the participant as its
-        // target.
-        ...(ctx.deps.desktopModule === undefined ? {} : { desktopModule: ctx.deps.desktopModule }),
-        ...(ctx.deps.detachedTimers === undefined ? {} : { detachedTimers: ctx.deps.detachedTimers }),
-        ...(ctx.input.prepareDesktop === undefined ? {} : { prepareDesktop: ctx.input.prepareDesktop }),
+        liveFlush: () => live.flush?.flush,
         onStream: participantStreams(ctx.input.onStream, live),
-        // A participant visits the shared app and provisions no subject, so it reports no phase of its
-        // own.
+        // A participant visits the shared app and provisions no subject, so it reports no phase of
+        // its own.
         reportSubjectPhase: defaultSubjectPhaseSink,
-        ...(runBudget === undefined ? {} : { runBudget }),
+        seams: ctx.deps,
+        prepareDesktop: ctx.input.prepareDesktop,
+    }, {
+        receiving: ctx.receiving,
         // Concurrent participants are independent evidence: a requested-vs-verified screen
         // mismatch is recorded as separate facts + a warning instead of failing the participant's
         // device claim closed, so one participant's window-manager drift cannot abort the whole
         // live multi-actor world (the single-participant/fan-out routes keep fail-closed).
         screenMismatchPolicy: "record-evidence",
-    };
+    });
 }
 /**
  * Each participant's actor spec, with committed personas compiled in so each prompt carries real

package/dist/routes/shared-world/plan.js

@@ -11,7 +11,7 @@ import { sharedWorldParticipants } from "../../study/plan-participants.js";
 import { PUBLIC_TARGET_OWNER_PATTERN } from "../../study/parse/subject.js";
 import { REPO_SLUG_PATTERN } from "../../study/parse/values.js";
 import { concurrentSharedWorldValidationReason, desktopMediaValidationReason, externalPublicSharedWorldValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, taskProtocolValidationReason, } from "../../study/validation.js";
-import { MODEL_RATES, unpricedCapMessage } from "../../run/pricing.js";
+import { unpricedCapCheck } from "../../study/requirements.js";
 /** The registered descriptor for a planned actor; planSharedWorldStudy checked the registry. */
 export function sharedWorldDescriptorOf(actorType) {
     const descriptor = actorRegistry[actorType];
@@ -60,12 +60,16 @@ export function planSharedWorldStudy(config, input) {
         return refuse(invalid, invalidReason, actor);
     if (config.actor?.maxOutputTokens !== undefined && input.hasRunSession === true)
         return refuse(invalid, "maxOutputTokens cannot be enforced by a custom runSession.", actor);
-    const caps = config.caps;
-    if (!input.dryRun && (caps?.maxUsd !== undefined || caps?.maxTotalUsd !== undefined)) {
-        const model = (config.actor?.model ?? DEFAULT_OPENAI_CU_MODEL).trim().toLowerCase();
-        if (!MODEL_RATES[model])
-            return refuse("HUMANISH_SHARED_WORLD_UNPRICED_CAP", unpricedCapMessage(model), actor);
-    }
+    // A live cap is priced here, at plan time, so its refusal wins over the route's key checks.
+    const unpriced = input.dryRun
+        ? undefined
+        : unpricedCapCheck({
+            caps: config.caps ?? {},
+            model: (config.actor?.model ?? DEFAULT_OPENAI_CU_MODEL).trim().toLowerCase(),
+            code: "HUMANISH_SHARED_WORLD_UNPRICED_CAP",
+        });
+    if (unpriced)
+        return refuse(unpriced.code, unpriced.message, actor);
     const receivingReason = receivingEmailValidationReason(config);
     if (receivingReason)
         return refuse(invalid, receivingReason, actor);

package/dist/routes/shared-world/provisioned.d.ts

@@ -3,8 +3,9 @@ import type { RunSubjectStateStepRecord } from "../../run/bundle.js";
 import type { SharedWorldStateSnapshot } from "../../run/shared-world-evidence.js";
 import type { LocalTreeArchive } from "../../subject/local-tree-archive.js";
 import type { DetachedTimers } from "../../substrates/detached.js";
+import { type SubjectDesktopUsage } from "../../substrates/e2b/subject-sandbox.js";
 import type { StudyDeps } from "../../study/study-deps.js";
-import { type ActorRunResult, type SubjectDesktopUsage, type LiveParticipants, type PlaneContext } from "./types.js";
+import { type ActorRunResult, type LiveParticipants, type PlaneContext } from "./types.js";
 /** What the provisioned plane needs besides the shared plane context. */
 export interface ProvisionedPlaneSetup {
     serve: StudySubjectServe;