humanish 0.111.2 → 0.111.4

package/dist/routes/computer-use/preflight.js

@@ -1,11 +1,7 @@
 import { pricedModel } from "../../study/plan-base.js";
-import { missingKeys, missingSubjectEnv } from "../../study/requirements.js";
-import { detectLocalAgents } from "../../actors/local-agent/cli.js";
-import { localAgentRefusal } from "../../actors/local-agent/readiness.js";
-import { describeMissingKeys } from "../../keys/key-resolution.js";
+import { firstLiveRefusal, keysCheck, localAgentCheck, subjectEnvCheck, unpricedCapCheck, } from "../../study/requirements.js";
 import { catchTokenOf, catchTokenRefusal } from "../../comms/external-evidence.js";
 import { externalCatchHealthy } from "../../comms/sandbox-catch.js";
-import { MODEL_RATES, unpricedCapMessage } from "../../run/pricing.js";
 /** The computer-use code for each local-agent refusal; shared-world keeps the same kinds. */
 const LOCAL_AGENT_REFUSAL_CODES = {
     "agent-missing": "HUMANISH_COMPUTER_USE_AGENT_MISSING",
@@ -21,69 +17,41 @@ const LOCAL_AGENT_REFUSAL_CODES = {
  */
 export async function liveCuaRejection(args) {
     const { caps, brain, env, requirements, externalCommsConfig } = args;
-    // The plan lists OPENAI_API_KEY only for an openai brain (a signed-in local agent or the
-    // caller's provider needs none) and E2B_API_KEY only when this run creates hosted desktops.
-    const localAgent = brain.kind === "local-agent" ? brain.agent : undefined;
-    const missing = missingKeys(requirements, env);
-    if (missing.length > 0) {
-        // The moment someone new actually hits the wall. If a signed-in coding agent is sitting
-        // right there, say so here rather than making them go and find an API key; that detour is
-        // where most people trying humanish stop.
-        const suggestion = missing.includes("OPENAI_API_KEY")
-            ? await (async () => {
-                const ready = (await detectLocalAgents({ env })).filter((agent) => agent.authStatus === "authenticated");
-                return ready.length === 0
-                    ? ""
-                    : ` ${ready.map((agent) => agent.label).join(" and ")} reports authenticated on this machine` +
-                        `. Set actor.type: local-agent to use ${ready.length === 1 ? "it" : "one"} instead of a key.`;
-            })()
-            : "";
-        return {
+    return firstLiveRefusal([
+        // The plan lists OPENAI_API_KEY only for an openai brain (a signed-in local agent or the
+        // caller's provider needs none) and E2B_API_KEY only when this run creates hosted desktops.
+        () => keysCheck({
+            requirements,
+            env,
             code: "HUMANISH_COMPUTER_USE_KEYS_MISSING",
-            message: `Live computer-use studies need ${missing.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missing, env)}${suggestion}`,
-        };
-    }
-    // A caller's createProvider makes the brain `caller`, so only the study's own local agent is checked.
-    if (localAgent) {
-        // Refuse here, before a sandbox exists. "codex is not installed" discovered after the
-        // machine is paid for is the same information delivered at the worst possible moment.
-        const refusal = await localAgentRefusal({ agent: localAgent, env, caps });
-        if (refusal)
-            return { code: LOCAL_AGENT_REFUSAL_CODES[refusal.kind], message: refusal.message };
-    }
-    const unsetSubjectEnv = missingSubjectEnv(requirements, env);
-    if (unsetSubjectEnv.length > 0) {
-        return {
-            code: "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING",
-            message: `subject.env declares ${unsetSubjectEnv.join(", ")} but the environment does not provide ${unsetSubjectEnv.length === 1 ? "it" : "them"} (pass via --dotenv; values are never persisted).`,
-        };
-    }
-    // Fail-closed cap: a maxUsd cap needs a measurable per-turn estimate.
-    // If the operator set caps.maxUsd but src/run/pricing.ts has no rate for the resolved
-    // model, the loop could not enforce the cap, and silently running uncapped would break the
-    // runaway-retry protection. Refuse at preflight (before any sandbox/spend) rather than run
-    // uncapped: an unenforceable cap is more dangerous than none. The operator picks a priced model
-    // or removes the cap; a source checkout can also add a rate to src/run/pricing.ts.
-    if (caps.maxUsd !== undefined || caps.maxTotalUsd !== undefined) {
-        const model = pricedModel(brain);
-        const capModelId = model.trim().toLowerCase();
-        if (!MODEL_RATES[capModelId]) {
-            return {
-                code: "HUMANISH_COMPUTER_USE_UNPRICED_CAP",
-                message: unpricedCapMessage(model),
-            };
-        }
-    }
-    // Adopter-hosted comms catch: fail closed before any sandbox is created, because a comms study
-    // whose catch is unreachable collects nothing while every participant still spends. The probe asserts
-    // humanish's own service marker in /health, so an adopter's proxy answering 200 for everything cannot
-    // pass for a catch.
-    const tokenRefusal = externalCommsConfig === undefined
-        ? undefined
-        : catchTokenRefusal(catchTokenOf(externalCommsConfig, env));
+            need: (names) => `Live computer-use studies need ${names} in the environment (values are never persisted).`,
+            suggestLocalAgent: true,
+        }),
+        // A caller's createProvider makes the brain `caller`, so only the study's own local agent is
+        // checked.
+        () => localAgentCheck({ brain, env, caps, codes: LOCAL_AGENT_REFUSAL_CODES }),
+        () => subjectEnvCheck({ requirements, env, code: "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING" }),
+        () => unpricedCapCheck({
+            caps,
+            model: pricedModel(brain),
+            code: "HUMANISH_COMPUTER_USE_UNPRICED_CAP",
+        }),
+        () => externalCatchCheck(externalCommsConfig, env),
+    ]);
+}
+/**
+ * Adopter-hosted comms catch: refused before any sandbox is created, because a comms study whose
+ * catch is unreachable collects nothing while every participant still spends. The probe asserts
+ * humanish's own service marker in /health, so an adopter's proxy answering 200 for everything
+ * cannot pass for a catch.
+ */
+async function externalCatchCheck(externalCommsConfig, env) {
+    if (externalCommsConfig === undefined)
+        return undefined;
+    const tokenRefusal = catchTokenRefusal(catchTokenOf(externalCommsConfig, env));
     if (tokenRefusal !== undefined)
         return { code: "HUMANISH_COMPUTER_USE_COMMS_TOKEN_INVALID", message: tokenRefusal };
-    if (externalCommsConfig && !(await externalCatchHealthy(externalCommsConfig))) {
+    if (!(await externalCatchHealthy(externalCommsConfig))) {
         return {
             code: "HUMANISH_COMPUTER_USE_COMMS_CATCH_UNREACHABLE",
             message: "The external comms catch or inbox is unreachable or incompatible (GET /health must identify humanish-comms-catch and advertise recipient-inbox-v1). Update humanish on the catch host and restart it with `humanish comms catch` on that host, or drop comms.email to run without the inbox funnel.",

package/dist/routes/computer-use/result.js

@@ -1,8 +1,9 @@
 import { adapterScoreFailureMessage, applyBrowserScorer } from "../../study/adapter-extension.js";
 import { redactText } from "../../evidence/redaction.js";
-import { round6 } from "../../run/pricing.js";
-import { foldScorerFailures, judgeExecution, OUTCOME_POLICIES, participantHarnessFailed, resultOk, } from "../../run/judge.js";
-import { participantFactsOf, participantOutcomeOk, unreleasedSandboxFailures, } from "./participant-facts.js";
+import { foldScorerFailures, judgeExecution, OUTCOME_POLICIES, resultOk, } from "../../run/judge.js";
+import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
+import { participantExecutionFailures, participantOutcomeOk } from "./participant-facts.js";
+import { participantCapWarning } from "./participant-model.js";
 import { summarizeCuaDiagnostics } from "./diagnostics.js";
 import { toParticipantResult } from "./participant-execution.js";
 import { buildCuaRunBundle, judgeComputerUseRun } from "./bundle.js";
@@ -159,56 +160,10 @@ function cuaStudyResult(args) {
         ...(errorResult === undefined ? {} : { error: errorResult }),
     };
 }
-/**
- * The run's execution failures before the Observer renders: each participant whose session failed
- * in the harness, each provider whose cleanup is unconfirmed or that reported a disallowed item
- * after its last request, and each sandbox whose release is unconfirmed. FinishedRun.renderObserver
- * adds an Observer that did not render.
- */
-function computerUseExecutionFailures(outcomes, runId) {
-    return [
-        ...(outcomes ?? [])
-            .filter((outcome) => participantHarnessFailed(participantFactsOf(outcome)))
-            .map((outcome) => ({
-            kind: "harness",
-            message: `${outcome.spec.planned.id}: ${outcome.sessionError ?? outcome.session?.reason ?? "harness error"}`,
-        })),
-        ...(outcomes ?? []).flatMap((outcome) => outcome.providerCleanupError === undefined
-            ? []
-            : [
-                {
-                    kind: "provider-cleanup",
-                    message: `${outcome.spec.planned.id}: ${outcome.providerCleanupError}`,
-                },
-            ]),
-        ...(outcomes ?? []).flatMap((outcome) => outcome.providerPolicyError === undefined
-            ? []
-            : [
-                {
-                    kind: "provider-policy",
-                    message: `${outcome.spec.planned.id}: ${outcome.providerPolicyError}`,
-                },
-            ]),
-        ...unreleasedSandboxFailures(outcomes, runId),
-    ];
-}
-/**
- * caps.maxUsd is enforced inside each participant's loop independently, so an
- * N-participant fan-out can spend up to N × maxUsd before any participant aborts, while the run cost summary reports the larger
- * aggregate. The warning names that ceiling, unless the study declared a shared maxTotalUsd budget.
- */
-function participantCapWarning(caps, participantCount) {
-    const capUsd = caps.maxUsd;
-    if (capUsd === undefined || participantCount <= 1)
-        return undefined;
-    if (caps.maxTotalUsd !== undefined)
-        return undefined;
-    return `caps.maxUsd ($${capUsd}) caps each participant, so ${participantCount} participants may spend up to ${participantCount} × $${capUsd} (about $${round6(capUsd * participantCount)}) before any of them stops. Set caps.maxTotalUsd for one budget across the study.`;
-}
 /** Builds and publishes the final bundle, runs the adapter hooks, renders the Observer and returns the result. */
 export async function finishCuaRun(setup, finish, ran) {
     const { plan, input, cwd, streams, descriptor, run } = setup;
-    const { participantRuns, participantPlan, scrubKnownValues, bundleBase } = setup;
+    const { participantRuns, participantPlan, bundleBase } = setup;
     const { rerunLineage, publicRepo, subjectArgs } = finish;
     const { dryRun } = plan;
     const appUrl = plannedAppUrl(plan.runner.subject);
@@ -252,7 +207,7 @@ export async function finishCuaRun(setup, finish, ran) {
             dryRun,
             participantCount,
         },
-        sanitize: (text) => redactText(scrubKnownValues(text)),
+        sanitize: (text) => redactText(run.secrets.scrub(text)),
         warnings: adapterWarnings,
         ...(input.scorerProvenance === undefined ? {} : { scorerProvenance: input.scorerProvenance }),
     });
@@ -261,13 +216,19 @@ export async function finishCuaRun(setup, finish, ran) {
     if (receiving)
         bundle.commsReceiving = receiving.snapshot();
     const policy = OUTCOME_POLICIES["computer-use"];
-    const execution = judgeExecution(computerUseExecutionFailures(outcomes, runId), policy);
+    // FinishedRun.renderObserver adds an Observer that did not render.
+    const execution = judgeExecution(participantExecutionFailures(outcomes, runId), policy);
     const finished = await run.finish(bundle, {
         ok: resultOk({ judgment, execution, scorerFailures: scorerResult.failures, policy }),
         execution,
         policy,
     });
     const observer = await finished.renderObserver();
+    // A caller's renderer runs with this process's file access, so after one that reports success
+    // the run directory is checked again before the result points anyone at it. A failed render is
+    // already an evidence failure, and its error code stays the run's diagnosis.
+    if (observer.ok)
+        await validatePreparedRunArtifactPaths(finished.paths);
     streams.attachFinal(observer);
     return cuaStudyResult({
         studyId: plan.studyId,

package/dist/routes/computer-use/route.js

@@ -31,7 +31,7 @@ import { finishCuaRun } from "./result.js";
 import { runStudyParticipants } from "./live-phase.js";
 import { admitCuaRun, refuseCuaStudy, startCuaRun } from "./setup.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 /**
  * A refused computer-use study's result, at the refusal's stage: a before-scope refusal has its own
  * envelope and no analysis record; the others come after the cwd checks, and the participant cap after
@@ -40,18 +40,17 @@ import { studyResultIdentity } from "../../run/study-result.js";
 export async function computerUseStudyRefusal(options, refusal) {
     const { config, dryRun } = options;
     if (refusal.stage === "before-scope")
-        return {
-            ...studyResultIdentity("computer-use", config.id),
-            ok: false,
+        return refusedResult("computer-use", {
+            studyId: config.id,
             cwd: path.resolve(options.cwd),
+            error: { code: refusal.code, message: refusal.message },
+        }, {
             actor: config.actor?.type ?? "",
             dryRun,
             runId: options.runId ?? "not-created",
             appUrl: config.subject.appUrl ?? config.subject.serve?.url ?? "",
             lanes: [],
-            warnings: [],
-            error: { code: refusal.code, message: refusal.message },
-        };
+        });
     // The other refusals come after the cwd checks, and the participant cap after the personas are read.
     return completeRefusalAnalysis(await refuseCuaStudy(options, refusal), config, options);
 }

package/dist/routes/computer-use/setup.d.ts

@@ -1,5 +1,6 @@
 import { type RunScope } from "../../run/run.js";
 import type { RefusedStudy } from "../../run/route-shell.js";
+import { RunSecrets } from "../../run/secrets.js";
 import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { StudyCommsEmail, StudyCommsExternal, StudyConfig } from "../../study/types.js";
 import { type RunRerunLineage } from "../../run/bundle.js";
@@ -32,15 +33,11 @@ export interface CuaRunSetup {
     streams: ReturnType<typeof trackRuntimeStreams>;
     participantRuns: DesktopParticipantRun[];
     participantPlan: CuaParticipantPlan;
-    scrubKnownValues: (text: string) => string;
     bundleBase: CuaRunBundleBase;
 }
 /** What only runStudyParticipants reads. */
 export interface CuaParticipantsSetup {
     env: Record<string, string | undefined>;
-    /** The array scrubKnownValues reads at each call. Email receiving appends the values it
-     *  provisions before the participants run. */
-    knownSecretValues: string[];
     deps: Omit<CuaParticipantDeps, "signalProvisioned">;
     /** Filled by runStudyParticipants on a live run; deps.onTrace reads it. */
     liveTrace: {
@@ -116,8 +113,7 @@ export declare function admitCuaRun(plan: ComputerUsePlan, input: ComputerUseRun
         participantCount: number;
         openaiApiKey: string;
         e2bApiKey: string;
-        knownSecretValues: string[];
-        scrubKnownValues: (text: string) => string;
+        secrets: RunSecrets;
         publicRepo: string | undefined;
         localTreeArchive: LocalTreeArchive | undefined;
         localTreeArchiveBuffer: ArrayBuffer | undefined;

package/dist/routes/computer-use/setup.js

@@ -1,19 +1,18 @@
 // The computer-use run's setup: resolve the project and route, plan the participants, make the
 // live checks that need no sandbox, pack a local tree, then start the run and build the
 // participant deps and bundle base that the participants and the finish share.
-import { randomBytes } from "node:crypto";
 import { realpath } from "node:fs/promises";
 import path from "node:path";
 import {} from "../../run/run.js";
 import { externalInboxUrl } from "../../comms/sandbox-catch.js";
-import { redactText, scrubLiterals, toErrorMessage } from "../../evidence/redaction.js";
-import { buildRunSource } from "../../run/bundle.js";
+import { redactText, toErrorMessage } from "../../evidence/redaction.js";
+import { RunSecrets } from "../../run/secrets.js";
+import {} from "../../run/bundle.js";
 import { assertPreparedSelectedOutputDirectory, prepareContainedOutputDirectory, prepareSelectedOutputDirectory, } from "../../run/contained-output.js";
 import {} from "../../subject/local-tree-archive.js";
 import { renderCuaReviewMarkdown } from "./bundle.js";
 import { emitPreflightPlan, compileParticipantPersonas, loadCuaParticipants, sanitizeParticipantRuns, } from "./participant-runs.js";
-import { makeCuaRunBudget } from "./participant-model.js";
-import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
+import { desktopParticipantDeps } from "./participant-deps.js";
 import { liveCuaRejection } from "./preflight.js";
 import { cuaDescriptorOf, declaredAppUrl, plannedAppUrl } from "./plan.js";
 import { trackRuntimeStreams } from "./live-flush.js";
@@ -24,7 +23,7 @@ import { packRunLocalTree } from "./local-tree-pack.js";
 import { projectParticipantSubjects, subjectProvenanceArg } from "./subject-projection.js";
 import { participantSubjectEnv, } from "./types.js";
 import { studyPersonaIds } from "../../study/persona-resolve.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 /** The physical project, bound before any caller hook runs. */
 async function bindProject(cwd) {
     // Capture the physical project before reading or invoking any caller hook. A supported
@@ -43,18 +42,17 @@ export async function refuseCuaStudy(options, refusal) {
     // The committed personas are read before the refusal returns, so a persona-file error wins.
     if (refusal.stage === "after-personas")
         await compileParticipantPersonas(projectRoot, studyPersonaIds(config));
-    return {
-        ...studyResultIdentity("computer-use", config.id),
-        ok: false,
+    return refusedResult("computer-use", {
+        studyId: config.id,
         cwd: projectRoot.physicalPath,
+        error: { code: refusal.code, message: refusal.message },
+    }, {
         actor: refusal.actor ?? config.actor?.type ?? "",
         appUrl: declaredAppUrl(config),
         dryRun,
         runId: options.runId ?? "not-created",
         lanes: [],
-        warnings: [],
-        error: { code: refusal.code, message: refusal.message },
-    };
+    });
 }
 /**
  * Everything before the run starts: the physical project, the route, the participant plan and
@@ -73,17 +71,12 @@ export async function admitCuaRun(plan, input, config) {
     const inProcess = desktop === "in-process";
     const appUrl = plannedAppUrl(subject);
     const subjectEnvNames = [...participantSubjectEnv(subject)];
-    const fail = (code, message, actorLabel) => ({
-        ...studyResultIdentity("computer-use", plan.studyId),
-        ok: false,
-        cwd,
+    const fail = (code, message, actorLabel) => refusedResult("computer-use", { studyId: plan.studyId, cwd, error: { code, message } }, {
         actor: actorLabel ?? plan.actor,
         appUrl,
         dryRun,
         runId: input.runId ?? "not-created",
         lanes: [],
-        warnings: [],
-        error: { code, message },
     });
     const refuse = (...args) => ({
         ok: false,
@@ -131,13 +124,13 @@ export async function admitCuaRun(plan, input, config) {
     const openaiApiKey = env.OPENAI_API_KEY?.trim() ?? "";
     const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     // Literal scrubber for every known provisioned value (no secret "shape" to pattern-match).
-    const knownSecretValues = [
+    // Dry and in-process runs scrub both keys too: a mission or persona can still quote them.
+    const secrets = new RunSecrets([
         openaiApiKey,
         e2bApiKey,
         ...subjectEnvNames.map((name) => env[name] ?? ""),
-    ].filter((value) => value.length >= 4);
-    const scrubKnownValues = scrubLiterals(knownSecretValues);
-    sanitizeParticipantRuns(participantRuns, scrubKnownValues);
+    ]);
+    sanitizeParticipantRuns(participantRuns, secrets.scrub);
     const redactRepoLabel = plan.residual.policies?.redactRepos ?? subjectEnvNames.includes("GITHUB_TOKEN");
     const publicRepo = subject.kind === "clone" ? (redactRepoLabel ? "repo-01" : subject.repo) : undefined;
     // Key-gating is route-aware: the in-process route uses the caller's own model + executor, and
@@ -167,7 +160,7 @@ export async function admitCuaRun(plan, input, config) {
             localTreeArchiveBuffer = packed.buffer;
         }
         catch (error) {
-            return refuse("HUMANISH_COMPUTER_USE_SUBJECT_INVALID", `local-tree packing failed: ${redactText(scrubKnownValues(toErrorMessage(error)))}`, descriptor.id);
+            return refuse("HUMANISH_COMPUTER_USE_SUBJECT_INVALID", `local-tree packing failed: ${redactText(secrets.scrub(toErrorMessage(error)))}`, descriptor.id);
         }
     }
     return {
@@ -192,8 +185,7 @@ export async function admitCuaRun(plan, input, config) {
             participantCount,
             openaiApiKey,
             e2bApiKey,
-            knownSecretValues,
-            scrubKnownValues,
+            secrets,
             publicRepo,
             localTreeArchive,
             localTreeArchiveBuffer,
@@ -202,33 +194,23 @@ export async function admitCuaRun(plan, input, config) {
 }
 /** Starts the run and builds what the participants and the finish read: the deps and the bundle base. */
 export async function startCuaRun(plan, input, admitted, scope) {
-    const { dryRun, cwd, seams, descriptor, participantRuns, participantPlan, publicRepo } = admitted;
+    const { cwd, descriptor, participantRuns, participantPlan, publicRepo } = admitted;
     const { appUrl } = admitted;
     // The run's status record exists from here on, so anything watching the runs directory can
     // tell which study this is and that it is alive. The fail-closed returns below leave it finished
     // with no outcome when the scope closes; a crash leaves it stale, which reads as interrupted.
-    const started = await scope.startRun({
+    const started = await scope.startRun(plan, input, {
         cwd,
-        runId: input.runId,
-        mintRunId: makeCuaRunId,
-        mode: dryRun ? "dry-run" : "live",
-        study: plan.study,
-        warnings: plan.warnings,
+        prefix: "cua",
         renderReview: renderCuaReviewMarkdown,
-        observer: { open: input.open === true, render: seams.renderObserver },
+        secrets: admitted.secrets,
     });
     if (!started.ok)
         return admitted.refuse(started.code, started.message, descriptor.id);
     const { run } = started;
-    const { createdAt, paths: runPaths } = run;
+    const { paths: runPaths, source } = run;
     const redactScreenshots = plan.residual.policies?.redactScreenshots === true;
     await prepareContainedOutputDirectory(runPaths, "screenshots");
-    const source = await buildRunSource({
-        capturedAt: createdAt,
-        cwd,
-        humanishSource: "present",
-        packageName: "humanish",
-    });
     // Live-trace flush seam: runStudyParticipants fills it when a live run has an in-progress bundle
     // to grow; participants call it through deps.onTrace. It exists before deps so deps can reference it as
     // a stable indirection.
@@ -279,12 +261,10 @@ export async function startCuaRun(plan, input, admitted, scope) {
             streams: admitted.streams,
             participantRuns,
             participantPlan,
-            scrubKnownValues: admitted.scrubKnownValues,
             bundleBase,
         },
         participants: {
             env: admitted.env,
-            knownSecretValues: admitted.knownSecretValues,
             deps,
             liveTrace,
             externalComms: externalCommsConfig === undefined || externalCommsEmail === undefined
@@ -300,60 +280,38 @@ export async function startCuaRun(plan, input, admitted, scope) {
         finish: { rerunLineage: admitted.rerunLineage, publicRepo, subjectArgs },
     };
 }
-/** The participant deps every participant reads: the route, keys, timeouts, scrubber, budget and seams. */
+/** The participant deps every participant reads, with computer use's own overrides. */
 function cuaParticipantDeps(plan, input, admitted, run) {
-    const { config, dryRun, seams, streams, env, runSession, participantCount } = admitted;
-    const { localTreeArchiveBuffer } = admitted;
-    const { openaiApiKey, e2bApiKey, scrubKnownValues } = admitted;
-    const { externalCommsConfig, externalCommsEmail } = admitted;
-    const { appUrl } = admitted;
-    const { runPaths, redactScreenshots, liveTrace } = run;
-    const createDesktop = input.localVm?.desktop;
-    const timeoutMs = plan.sessionBudgetMs;
-    const requestTimeoutMs = e2bRequestTimeoutMs(env);
-    return {
-        ...(createDesktop === undefined ? {} : { createDesktop }),
-        onTrace: (participantId, items, usage, metadata) => liveTrace.flush?.(participantId, items, usage, metadata),
-        ...callerDriving(input, config),
-        residual: plan.residual,
-        studyId: plan.studyId,
-        caps: plan.caps,
-        appUrl,
+    const { config, seams, env, externalCommsConfig, externalCommsEmail } = admitted;
+    const deps = desktopParticipantDeps({
+        plan,
         brain: plan.runner.brain,
         subject: plan.runner.subject,
-        ...(localTreeArchiveBuffer === undefined ? {} : { localTreeArchiveBuffer }),
         env,
-        openaiApiKey,
-        e2bApiKey,
-        requestTimeoutMs,
+        openaiApiKey: admitted.openaiApiKey,
+        e2bApiKey: admitted.e2bApiKey,
+        timeoutMs: plan.sessionBudgetMs,
         sandboxMs: plan.sandboxMs,
-        timeoutMs,
-        participantCount,
-        artifactRoot: runPaths,
+        participantCount: admitted.participantCount,
+        artifactRoot: run.runPaths,
         studyCwd: input.cwd,
-        redactScreenshots,
-        scrubKnownValues,
-        runSession,
-        // The study-level ledger exists once per run, shared by every participant. Dry runs never
-        // spend, so they carry none.
-        ...(dryRun || plan.caps.maxTotalUsd === undefined
-            ? {}
-            : { runBudget: makeCuaRunBudget(plan.caps.maxTotalUsd) }),
-        ...(externalCommsConfig === undefined || externalCommsEmail === undefined
-            ? {}
-            : {
-                externalComms: {
-                    email: externalCommsEmail,
-                    inboxUrl: externalInboxUrl(externalCommsConfig),
-                },
-            }),
-        now: seams.now ?? Date.now,
-        ...(seams.desktopModule === undefined ? {} : { desktopModule: seams.desktopModule }),
-        ...(input.prepareDesktop === undefined ? {} : { prepareDesktop: input.prepareDesktop }),
-        ...(seams.detachedTimers === undefined ? {} : { detachedTimers: seams.detachedTimers }),
-        onStream: streams.onStream,
+        redactScreenshots: run.redactScreenshots,
+        scrubKnownValues: admitted.secrets.scrub,
+        runSession: admitted.runSession,
+        liveFlush: () => run.liveTrace.flush,
+        onStream: admitted.streams.onStream,
         reportSubjectPhase: subjectPhaseReporter(input),
-    };
+        seams,
+        prepareDesktop: input.prepareDesktop,
+    }, {
+        createDesktop: input.localVm?.desktop,
+        ...callerDriving(input, config),
+        localTreeArchiveBuffer: admitted.localTreeArchiveBuffer,
+        externalComms: externalCommsConfig === undefined || externalCommsEmail === undefined
+            ? undefined
+            : { email: externalCommsEmail, inboxUrl: externalInboxUrl(externalCommsConfig) },
+    });
+    return { ...deps, appUrl: admitted.appUrl };
 }
 /** The caller's createProvider and inProcess executor, with the run's config bound. */
 function callerDriving(input, config) {
@@ -377,7 +335,3 @@ function subjectPhaseReporter(input) {
         input.emit?.(phaseEvent(event, { kind: "participant", participant }));
     };
 }
-function makeCuaRunId() {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    return `cua-${stamp}-${randomBytes(4).toString("hex")}`;
-}

package/dist/routes/computer-use/single-bundle.js

@@ -3,7 +3,8 @@ import { redactText } from "../../evidence/redaction.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/streams.js";
 import { aggregateTaskFunnels, tallyParticipantOutcomes, withCuaReviewProvenance, } from "../../run/outcomes.js";
-import { describeSubjectState, participantFeedbackCandidates, phaseEventIdSuffix, publicSafeAppUrlLabel, subjectProvenanceMessage, } from "./bundle-parts.js";
+import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel, subjectProvenanceMessage, } from "./bundle-parts.js";
+import { participantFeedbackCandidates } from "./participant-feedback.js";
 import { participantStatus as participantStatusFor } from "../../run/judge.js";
 import { buildRunCostSummary } from "../../run/cost-summary.js";
 import { participantEvent, participantIds, participantRecord, participantStream, } from "../../run/participant-records.js";
@@ -359,13 +360,13 @@ export function buildSingleParticipantBundle(args) {
                 runId: args.run.runId,
                 scenarioId: `cua-${args.studyId}`,
                 adapterId: args.studyId,
-                goal: redactText(args.mission),
                 substrate: runnerSubstrate(args),
                 participants: [
                     {
                         participantId: args.participantId ?? "lane-01",
                         streamId: SINGLE.streamId,
                         personaId: args.persona.id,
+                        goal: redactText(args.mission),
                         ...(args.session === undefined ? {} : { session: args.session }),
                         ...(args.traceArtifactPath === undefined
                             ? {}

package/dist/routes/computer-use/types.d.ts

@@ -26,7 +26,7 @@ import { type RunDesktopGeometry } from "../../run/streams.js";
 import { type PreparedOutputRoot } from "../../run/contained-output.js";
 import type { ComputerUseParticipant, SharedWorldParticipant } from "../../study/plan-participants.js";
 import type { ResolvedParticipant } from "../../run/participant.js";
-import { type StudyResultIdentity } from "../../run/study-result.js";
+import { type StudyResultErrorCode, type StudyResultIdentity } from "../../run/study-result.js";
 export declare const CUA_FANOUT_STRATEGY: "per-lane-worlds";
 export declare const CUA_MAX_CONCURRENCY_ENV = "HUMANISH_CUA_MAX_CONCURRENCY";
 export declare const DEFAULT_APP_URL_SESSION_TIMEOUT_MS: number;
@@ -182,7 +182,7 @@ export interface CuaParticipantSummary {
     concurrency: number;
     waves: number;
 }
-export type CuaActorStudyErrorCode = "HUMANISH_STUDY_ANALYSIS_INVALID" | "HUMANISH_STUDY_TASKS_UNSUPPORTED" | "HUMANISH_STUDY_OPTION_UNSUPPORTED" | "HUMANISH_STUDY_V2_UNSUPPORTED" | "HUMANISH_STUDY_INVALID" | "HUMANISH_COMPUTER_USE_FAILED" | "HUMANISH_COMPUTER_USE_KEYS_MISSING" | "HUMANISH_COMPUTER_USE_AGENT_MISSING" | "HUMANISH_COMPUTER_USE_AGENT_SIGNIN_REQUIRED" | "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING" | "HUMANISH_COMPUTER_USE_ACTOR_UNSUPPORTED" | "HUMANISH_COMPUTER_USE_SUBJECT_INVALID" | "HUMANISH_COMPUTER_USE_SUBJECT_UNSAFE" | "HUMANISH_COMPUTER_USE_EXECUTOR_NO_PROVIDER" | "HUMANISH_COMPUTER_USE_LOCAL_APP_NO_EXECUTOR" | "HUMANISH_COMPUTER_USE_LOCAL_DESKTOP_MISSING" | "HUMANISH_COMPUTER_USE_FANOUT_INVALID" | "HUMANISH_COMPUTER_USE_RERUN_INVALID" | "HUMANISH_COMPUTER_USE_DEVICE_GEOMETRY" | "HUMANISH_RUN_ID_IN_USE" | "HUMANISH_COMPUTER_USE_UNPRICED_CAP" | "HUMANISH_COMPUTER_USE_COMMS_CATCH_UNREACHABLE" | "HUMANISH_COMPUTER_USE_COMMS_TOKEN_INVALID" | "HUMANISH_WATCH_ALLOW_REQUIRES_OAUTH" | "HUMANISH_WATCH_OAUTH_REQUIRES_TUNNEL" | "HUMANISH_WATCH_OPTION_CONFLICT" | "HUMANISH_WATCH_TUNNEL_REQUIRES_EXPOSE" | "HUMANISH_WATCH_EXPOSE_REQUIRES_EDGE_AUTH" | "HUMANISH_WATCH_EXPOSE_REQUIRES_LIVE_FOLLOW" | "HUMANISH_WATCH_SAFE_NOT_APPLICABLE" | "HUMANISH_SERVE_TUNNEL_NOT_FOUND" | "HUMANISH_SERVE_TUNNEL_START_FAILED";
+export type CuaActorStudyErrorCode = StudyResultErrorCode | "HUMANISH_COMPUTER_USE_FAILED" | "HUMANISH_COMPUTER_USE_KEYS_MISSING" | "HUMANISH_COMPUTER_USE_AGENT_MISSING" | "HUMANISH_COMPUTER_USE_AGENT_SIGNIN_REQUIRED" | "HUMANISH_COMPUTER_USE_SUBJECT_ENV_MISSING" | "HUMANISH_COMPUTER_USE_ACTOR_UNSUPPORTED" | "HUMANISH_COMPUTER_USE_SUBJECT_INVALID" | "HUMANISH_COMPUTER_USE_SUBJECT_UNSAFE" | "HUMANISH_COMPUTER_USE_EXECUTOR_NO_PROVIDER" | "HUMANISH_COMPUTER_USE_LOCAL_APP_NO_EXECUTOR" | "HUMANISH_COMPUTER_USE_LOCAL_DESKTOP_MISSING" | "HUMANISH_COMPUTER_USE_FANOUT_INVALID" | "HUMANISH_COMPUTER_USE_RERUN_INVALID" | "HUMANISH_COMPUTER_USE_DEVICE_GEOMETRY" | "HUMANISH_COMPUTER_USE_UNPRICED_CAP" | "HUMANISH_COMPUTER_USE_COMMS_CATCH_UNREACHABLE" | "HUMANISH_COMPUTER_USE_COMMS_TOKEN_INVALID" | "HUMANISH_WATCH_ALLOW_REQUIRES_OAUTH" | "HUMANISH_WATCH_OAUTH_REQUIRES_TUNNEL" | "HUMANISH_WATCH_OPTION_CONFLICT" | "HUMANISH_WATCH_TUNNEL_REQUIRES_EXPOSE" | "HUMANISH_WATCH_EXPOSE_REQUIRES_EDGE_AUTH" | "HUMANISH_WATCH_EXPOSE_REQUIRES_LIVE_FOLLOW" | "HUMANISH_WATCH_SAFE_NOT_APPLICABLE" | "HUMANISH_SERVE_TUNNEL_NOT_FOUND" | "HUMANISH_SERVE_TUNNEL_START_FAILED";
 /** Subject provenance projection: what the actor actually drove. */
 export interface CuaSubjectProjection {
     source: "app-url" | "clone" | "local-tree";

package/dist/routes/preview.js

@@ -1,17 +1,11 @@
 // The preview route: a study whose subject is this repo runs the synthetic dry run. planStudy decides
 // the sim count and refuses what a synthetic run would ignore; runPreviewPlan does the rest.
-import { studyResultIdentity } from "../run/study-result.js";
+import { refusedResult, studyResultIdentity, } from "../run/study-result.js";
 import { runDryRun } from "../run/dry-run.js";
 import path from "node:path";
 /** A refused preview's result. */
 export function previewStudyRefusal(cwd, studyId, refusal) {
-    return {
-        ...studyResultIdentity("preview", studyId),
-        ok: false,
-        cwd: path.resolve(cwd),
-        warnings: [],
-        error: { code: refusal.code, message: refusal.message },
-    };
+    return refusedResult("preview", { studyId, cwd: path.resolve(cwd), error: { code: refusal.code, message: refusal.message } }, {});
 }
 /** runStudyWith's step for a preview plan: it has no local checks and takes no scorer, so it returns its run. */
 export function admitPreviewPlan(plan, input) {

package/dist/routes/scripted/bundle.d.ts

@@ -1,7 +1,7 @@
 import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { ScriptedBrowserSessionResult } from "../../actors/scripted-browser/actor.js";
 import type { BrowserPersonaJourney, BrowserSurface } from "../../actors/scripted-browser/types.js";
-import type { DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
+import type { SubjectDesktopUsage } from "../../substrates/e2b/subject-sandbox.js";
 import { type ReviewSummary, type RunBundle, type RunSubjectProvenance, type BundleRun } from "../../run/bundle.js";
 /** What the scripted study's bundle is built from. */
 interface ScriptedBundleArgs {
@@ -24,11 +24,7 @@ interface ScriptedBundleArgs {
     source: RunBundle["source"];
     subject?: RunSubjectProvenance;
     /** The provisioned clone's desktop; absent when no sandbox was created. */
-    subjectDesktop?: {
-        durationMs: number | undefined;
-        observation: DesktopResourceObservation | undefined;
-        killed: boolean;
-    };
+    subjectDesktop?: SubjectDesktopUsage;
     surfaces: readonly BrowserSurface[];
     /** The run's verdict (judgeScripted). */
     verdict: ReviewSummary["verdict"];