humanish 0.111.2 → 0.111.4

package/dist/routes/scripted/result.d.ts

@@ -6,6 +6,7 @@ import type { RunBundle } from "../../run/bundle.js";
 import type { RunScope } from "../../run/run.js";
 import { type ExecutionFailure } from "../../run/judge.js";
 import type { ScriptedSubject } from "./subject.js";
+import type { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import { type ScriptedBrowserStudyResult } from "./types.js";
 /** What the finish reads from the run. */
 export interface ScriptedFinishInputs {
@@ -44,6 +45,6 @@ export declare function scriptedExecutionFailures(args: {
     sessionError: string | undefined;
     expected: number;
     sessionResults: readonly Pick<ScriptedBrowserSessionResult, "completionReason" | "reason">[];
-    subject: Pick<ScriptedSubject, "sandboxId" | "killed" | "releaseWarning"> | undefined;
+    subject: Pick<E2BSubjectSandbox, "sandboxId" | "killed" | "releaseWarning"> | undefined;
 }): ExecutionFailure[];
 export declare function finishScriptedRun(inputs: ScriptedFinishInputs): Promise<ScriptedBrowserStudyResult>;

package/dist/routes/scripted/result.js

@@ -53,11 +53,11 @@ export async function finishScriptedRun(inputs) {
     const { actor, dryRun } = plan;
     const { runId, paths: runPaths } = run;
     const subjectCommit = scriptedSubject?.commit;
-    const subjectSandboxId = scriptedSubject?.sandboxId;
-    const subjectKilled = scriptedSubject?.killed ?? false;
+    const subjectSandboxId = scriptedSubject?.sandbox.sandboxId;
+    const subjectKilled = scriptedSubject?.sandbox.killed ?? false;
     const hostDigest = scriptedSubject?.hostDigest;
     const stateStepRecords = scriptedSubject?.stateStepRecords ?? [];
-    const subjectDesktop = scriptedSubject?.desktopUsage();
+    const subjectDesktop = scriptedSubject?.sandbox.desktopUsage();
     const screenshotsBySurface = new Map();
     for (const result of sessionResults) {
         screenshotsBySurface.set(result.capture.surface.id, await existingScreenshots(runPaths, result));
@@ -114,7 +114,7 @@ export async function finishScriptedRun(inputs) {
         sessionError,
         expected: surfaces.length,
         sessionResults,
-        subject: scriptedSubject,
+        subject: scriptedSubject?.sandbox,
     }), policy);
     const finished = await run.finish(bundle, {
         ok: resultOk({ judgment, execution, scorerFailures: [], policy }),

package/dist/routes/scripted/route.js

@@ -14,11 +14,9 @@
 // subject, so its build provenance is unpinned and the evidence binds to the scenario digest. A
 // clone run records commit, env names, state provenance and a host digest, never the raw getHost
 // URL or a secret value.
-import { randomBytes } from "node:crypto";
 import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { redactText, toErrorMessage } from "../../evidence/redaction.js";
-import { buildRunSource } from "../../run/bundle.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import {} from "../../run/run.js";
 import { admitRoute, completeRefusalAnalysis } from "../../run/route-shell.js";
@@ -30,7 +28,7 @@ import { prepareScriptedRun } from "./setup.js";
 import { ScriptedSubject } from "./subject.js";
 import { runScriptedSessions, writeSurfaceTraces } from "./surface-sessions.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 /**
  * A refused scripted study's result, at the refusal's stage: a before-scope refusal has its own field
  * order and no analysis record; the others come after the output directory checks.
@@ -39,34 +37,25 @@ export async function scriptedStudyRefusal(options, refusal) {
     const { config, dryRun } = options;
     const cwd = path.resolve(options.cwd);
     const actorType = config.actor?.type ?? "";
+    const error = { code: refusal.code, message: refusal.message };
     if (refusal.beforeScope)
-        return {
-            ...studyResultIdentity("scripted", config.id),
-            ok: false,
-            cwd,
+        return refusedResult("scripted", { studyId: config.id, cwd, error }, {
             actor: actorType,
             dryRun,
             runId: options.runId ?? "not-created",
             appUrl: config.subject.appUrl ?? "",
             sessions: [],
-            warnings: [],
-            error: { code: refusal.code, message: refusal.message },
-        };
+        });
     // The other refusals come after the output directory checks and carry the analysis record.
     const physicalCwd = await realpath(cwd);
     await prepareSelectedOutputDirectory(path.dirname(physicalCwd), physicalCwd);
-    const refused = {
-        ...studyResultIdentity("scripted", config.id),
-        ok: false,
-        cwd,
+    const refused = refusedResult("scripted", { studyId: config.id, cwd, error }, {
         actor: refusal.actor ?? actorType,
         appUrl: refusal.appUrl ?? config.subject.appUrl ?? "",
         dryRun,
         runId: options.runId ?? "not-created",
         sessions: [],
-        warnings: [],
-        error: { code: refusal.code, message: refusal.message },
-    };
+    });
     return completeRefusalAnalysis(refused, config, options);
 }
 /**
@@ -88,30 +77,20 @@ async function runScriptedPlanInScope(plan, input, scope) {
         return prepared.result;
     const { dryRun } = plan;
     const { setup } = prepared;
-    const started = await scope.startRun({
+    const started = await scope.startRun(plan, input, {
         cwd: setup.physicalCwd,
-        runId: input.runId,
-        mintRunId: makeScriptedRunId,
-        mode: dryRun ? "dry-run" : "live",
-        study: plan.study,
-        warnings: plan.warnings,
+        prefix: "scripted",
         // Only a clone subject is served from a sandbox; an app-url run drives a local browser.
         sandboxes: setup.clone ? undefined : "none",
         renderReview: renderScriptedReviewMarkdown,
-        observer: { open: input.open === true, render: setup.deps.renderObserver },
+        secrets: setup.secrets,
     });
     if (!started.ok) {
         return setup.failed(started.code, started.message);
     }
     const { run } = started;
-    const { createdAt, paths: runPaths } = run;
+    const { paths: runPaths, source } = run;
     const artifactRoot = runPaths.physicalRunRoot;
-    const source = await buildRunSource({
-        capturedAt: createdAt,
-        cwd: setup.physicalCwd,
-        humanishSource: "present",
-        packageName: "humanish",
-    });
     const scriptedSubject = setup.clone
         ? new ScriptedSubject({
             plan,
@@ -124,7 +103,7 @@ async function runScriptedPlanInScope(plan, input, scope) {
             timeoutMs: setup.timeoutMs,
             subjectEnvNames: setup.subjectEnvNames,
             hasGithubToken: setup.hasGithubToken,
-            scrubKnownValues: setup.scrubKnownValues,
+            scrubKnownValues: run.secrets.scrub,
             now: setup.deps.now ?? Date.now,
             warnings: setup.warnings,
         })
@@ -142,6 +121,7 @@ async function runScriptedPlanInScope(plan, input, scope) {
                 persona: setup.persona,
                 timeoutMs: setup.timeoutMs,
                 artifactRoot,
+                scrubKnownValues: run.secrets.scrub,
             }, {
                 surfaces: setup.surfaces,
                 deps: setup.deps,
@@ -156,10 +136,10 @@ async function runScriptedPlanInScope(plan, input, scope) {
             }
             // The session itself maps launch failures to harness_error; reaching here means the
             // harness around it failed. Redacted at this boundary before persisting anywhere.
-            sessionError = redactText(setup.scrubKnownValues(toErrorMessage(error)));
+            sessionError = redactText(run.secrets.scrub(toErrorMessage(error)));
         }
         finally {
-            await scriptedSubject?.teardown();
+            await scriptedSubject?.sandbox.release();
         }
         await writeSurfaceTraces(runPaths, sessionResults);
     }
@@ -182,7 +162,3 @@ async function runScriptedPlanInScope(plan, input, scope) {
         scriptedSubject,
     });
 }
-function makeScriptedRunId() {
-    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-    return `scripted-${stamp}-${randomBytes(4).toString("hex")}`;
-}

package/dist/routes/scripted/setup.d.ts

@@ -1,6 +1,7 @@
 import type { ActorPersonaRef } from "../../actors/contract.js";
 import type { BrowserPersonaJourney, ScriptedBrowserEvidenceUrlPolicy } from "../../actors/scripted-browser/types.js";
 import type { ScriptedPlan } from "../../study/plan-types.js";
+import { RunSecrets } from "../../run/secrets.js";
 import { type ScriptedBrowserStudyResult, type ScriptedRunInput } from "./types.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 /** What setup hands the run: the plan's subject and scenario, keys and the browser to launch. */
@@ -20,7 +21,7 @@ export interface ScriptedRunSetup {
     e2bApiKey: string;
     hasGithubToken: boolean;
     redactRepoLabel: boolean;
-    scrubKnownValues: (text: string) => string;
+    secrets: RunSecrets;
     /** The loopback app URL, or the clone's serve URL until its getHost URL replaces it. */
     appUrl: string;
     scenario: {

package/dist/routes/scripted/setup.js

@@ -1,16 +1,17 @@
 // What a scripted run needs before it starts: the checks the plan cannot make (the scenario file,
 // the E2B key and subject env of a live clone, a browser to launch) and the values the run reads
-// (the evidence URL policy, the scrubber for clone values, the persona and the session budget).
+// (the evidence URL policy, the run's known secrets, the persona and the session budget).
 import { realpath } from "node:fs/promises";
-import { missingKeys, missingSubjectEnv } from "../../study/requirements.js";
+import { firstLiveRefusal, keysCheck, subjectEnvCheck } from "../../study/requirements.js";
 import path from "node:path";
 import { resolveBrowserCommand } from "../../actors/scripted-browser/browser-command.js";
-import { describeMissingKeys } from "../../keys/key-resolution.js";
+import { publicSafeToken } from "../../actors/scripted-browser/journey.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
+import { RunSecrets } from "../../run/secrets.js";
 import { evidenceAppUrlOf } from "./plan.js";
 import { resolveScriptedScenario } from "./scenario.js";
 import {} from "./types.js";
-import { studyResultIdentity } from "../../run/study-result.js";
+import { refusedResult } from "../../run/study-result.js";
 // Journey wall-clock budget per surface: 5 minutes. A scripted surface has zero model cost and
 // sandbox-seconds are pennies; a short default only truncated slow-loading subjects.
 const DEFAULT_SESSION_TIMEOUT_MS = 300_000;
@@ -26,32 +27,28 @@ export async function prepareScriptedRun(plan, input) {
     const deps = input.deps ?? {};
     const warnings = [];
     const clone = plan.subject.kind === "clone" ? plan.subject : undefined;
-    const evidenceAppUrl = evidenceAppUrlOf(plan.subject);
-    const failed = (code, message) => ({
-        ...studyResultIdentity("scripted", plan.studyId),
-        ok: false,
-        cwd,
+    const subjectEnvNames = [...(clone?.env ?? [])];
+    const env = input.env ?? process.env;
+    const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
+    const secrets = new RunSecrets([
+        e2bApiKey,
+        ...(clone ? [clone.repo] : []),
+        ...subjectEnvNames.map((name) => env[name] ?? ""),
+    ]);
+    // An app-url run records the URL it was given, in the bundle and every summary.
+    const evidenceAppUrl = secrets.scrub(evidenceAppUrlOf(plan.subject));
+    const failed = (code, message) => refusedResult("scripted", { studyId: plan.studyId, cwd, warnings, error: { code, message } }, {
         actor: plan.actor,
         appUrl: evidenceAppUrl,
         dryRun,
         runId: input.runId ?? "not-created",
         sessions: [],
-        warnings,
-        error: { code, message },
     });
     const urlPolicy = clone
         ? { kind: "provisioned-subject", evidenceOrigin: evidenceAppUrl }
         : { kind: "loopback" };
-    const subjectEnvNames = [...(clone?.env ?? [])];
-    const env = input.env ?? process.env;
-    const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     const hasGithubToken = subjectEnvNames.includes("GITHUB_TOKEN");
     const redactRepoLabel = plan.residual.policies?.redactRepos ?? hasGithubToken;
-    const scrubSourceValues = [
-        ...(clone ? [clone.repo] : []),
-        ...subjectEnvNames.map((name) => env[name] ?? ""),
-    ].filter(Boolean);
-    const scrubKnownValues = (text) => scrubSourceValues.reduce((acc, value) => acc.split(value).join("[redacted]"), text);
     // A clone's URL is replaced by its getHost URL once it is served.
     let appUrl = plan.subject.kind === "clone" ? plan.subject.serve.url : plan.subject.appUrl;
     const scenario = await resolveScriptedScenario(projectRoot, plan.scenarioRef);
@@ -61,22 +58,30 @@ export async function prepareScriptedRun(plan, input) {
             result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", scenario.message),
         };
     }
-    const journey = scenario.journey;
+    // The goal, title and step labels are recorded; a step's path, selector, value and expected text
+    // drive the browser and stay as written.
+    const journey = {
+        ...scenario.journey,
+        scenarioId: idHoldsKnownValue(scenario.journey.scenarioId, secrets)
+            ? "scenario"
+            : scenario.journey.scenarioId,
+        goal: secrets.scrub(scenario.journey.goal),
+        scenarioTitle: secrets.scrub(scenario.journey.scenarioTitle),
+        steps: recordedStepIds(scenario.journey.steps, secrets),
+    };
     // The plan lists E2B_API_KEY and the subject env only for a live clone.
-    const missing = missingKeys(plan.requirements, env);
-    if (missing.length > 0) {
-        return {
-            ok: false,
-            result: failed("HUMANISH_SCRIPTED_KEYS_MISSING", `Live clone scripted-browser studies require ${missing.join(" and ")} (dry-run remains $0 and does not provision a subject). ${describeMissingKeys(missing, env)}`),
-        };
-    }
-    const unsetSubjectEnv = missingSubjectEnv(plan.requirements, env);
-    if (unsetSubjectEnv.length > 0) {
-        return {
-            ok: false,
-            result: failed("HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING", `Subject env values missing for a live clone scripted-browser study: ${unsetSubjectEnv.join(", ")}.`),
-        };
-    }
+    const { requirements } = plan;
+    const refusal = await firstLiveRefusal([
+        () => keysCheck({
+            requirements,
+            env,
+            code: "HUMANISH_SCRIPTED_KEYS_MISSING",
+            need: (names) => `Live clone scripted-browser studies require ${names} (dry-run remains $0 and does not provision a subject).`,
+        }),
+        () => subjectEnvCheck({ requirements, env, code: "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" }),
+    ]);
+    if (refusal)
+        return { ok: false, result: failed(refusal.code, refusal.message) };
     const surfaces = plan.surfaces;
     const timeoutMs = plan.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;
     const persona = {
@@ -114,7 +119,7 @@ export async function prepareScriptedRun(plan, input) {
             e2bApiKey,
             hasGithubToken,
             redactRepoLabel,
-            scrubKnownValues,
+            secrets,
             appUrl,
             scenario,
             journey,
@@ -125,3 +130,34 @@ export async function prepareScriptedRun(plan, input) {
         },
     };
 }
+/**
+ * Whether an id holds a known value as written or as the parser's id token of it, lower-cased with
+ * other characters as `-`, which the scrub would not find.
+ */
+function idHoldsKnownValue(id, secrets) {
+    return (secrets.scrub(id) !== id ||
+        secrets.values().some((value) => {
+            const token = publicSafeToken(value, "");
+            return token.length > 0 && id.includes(token);
+        }));
+}
+/**
+ * The steps with their labels scrubbed and their ids safe to record. A step id names the step's
+ * screenshot file and is recorded beside it, and the parser derives an omitted id from the label,
+ * lower-cased and cut to 80 characters, so the scrub may not find a value in it. A step whose
+ * label or id holds a known value is renamed by its position instead.
+ */
+function recordedStepIds(steps, secrets) {
+    const taken = new Set(steps.map((step) => step.id));
+    return steps.map((step, index) => {
+        const label = secrets.scrub(step.label);
+        if (label === step.label && !idHoldsKnownValue(step.id, secrets))
+            return { ...step, label };
+        const position = `step-${String(index + 1).padStart(2, "0")}`;
+        let id = position;
+        for (let suffix = 2; taken.has(id); suffix += 1)
+            id = `${position}-${suffix}`;
+        taken.add(id);
+        return { ...step, id, label };
+    });
+}

package/dist/routes/scripted/subject.d.ts

@@ -1,7 +1,7 @@
 import type { ScriptedPlan } from "../../study/plan-types.js";
 import { type PreparedRunArtifactPaths } from "../../run/paths.js";
 import type { RunSubjectStateStepRecord } from "../../run/bundle.js";
-import { type DesktopResourceObservation } from "../../substrates/e2b/desktop-resources.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
 type ScriptedCloneSubject = Extract<ScriptedPlan["subject"], {
@@ -22,33 +22,18 @@ export interface ScriptedSubjectInputs {
     hasGithubToken: boolean;
     scrubKnownValues: (text: string) => string;
     now: () => number;
-    /** The run's warnings. Teardown appends to it. */
+    /** The run's warnings. The subject sandbox's release appends to it. */
     warnings: string[];
 }
 /** The subject sandbox and what provisioning it recorded. */
 export declare class ScriptedSubject {
-    sandboxId: string | undefined;
-    killed: boolean;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning: string | undefined;
+    readonly sandbox: E2BSubjectSandbox;
     commit: string | undefined;
     hostDigest: string | undefined;
     readonly stateStepRecords: RunSubjectStateStepRecord[];
     private readonly inputs;
-    private allocation;
-    private createdAtMs;
-    private tornDownAtMs;
-    private resources;
     constructor(inputs: ScriptedSubjectInputs);
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     provision(): Promise<string>;
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    teardown(): Promise<void>;
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage(): {
-        durationMs: number | undefined;
-        observation: DesktopResourceObservation | undefined;
-        killed: boolean;
-    } | undefined;
 }
 export {};

package/dist/routes/scripted/subject.js

@@ -5,11 +5,9 @@ import { commandDigestOf } from "../../subject/state.js";
 import { validatePreparedRunArtifactPaths, } from "../../run/paths.js";
 import { provisionCloneSubject } from "../../subject/clone.js";
 import { loadE2BDesktopModule } from "../../substrates/e2b/sdk.js";
-import { observeDesktopResources, } from "../../substrates/e2b/desktop-resources.js";
-import { acquireE2BDesktopSandbox, readE2BRelease } from "../../substrates/e2b/sandbox.js";
+import { E2BSubjectSandbox } from "../../substrates/e2b/subject-sandbox.js";
 import { e2bShell } from "../../substrates/e2b/shell.js";
-import { e2bRequestTimeoutMs, SANDBOX_TIMEOUT_BUFFER_MS, SUBJECT_PROVISION_BUDGET_MS, } from "../../substrates/e2b/lifetime.js";
-import { DEFAULT_STATE_STEP_TIMEOUT_MS } from "../../subject/state.js";
+import { e2bRequestTimeoutMs } from "../../substrates/e2b/lifetime.js";
 function servePort(serveUrl) {
     const url = new URL(serveUrl);
     if (url.port)
@@ -35,65 +33,44 @@ function hostOriginDigest(url) {
 }
 /** The subject sandbox and what provisioning it recorded. */
 export class ScriptedSubject {
-    sandboxId;
-    killed = false;
-    /** The scrubbed release warning when the subject's release is unconfirmed. */
-    releaseWarning;
+    sandbox;
     commit;
     hostDigest;
     stateStepRecords = [];
     inputs;
-    allocation;
-    createdAtMs;
-    tornDownAtMs;
-    resources;
     constructor(inputs) {
         this.inputs = inputs;
+        this.sandbox = new E2BSubjectSandbox({
+            warnings: inputs.warnings,
+            scrub: inputs.scrubKnownValues,
+            now: inputs.now,
+        });
     }
     /** Acquires, provisions and serves the subject. Returns the tokenless getHost URL to drive. */
     async provision() {
         const { plan, clone, deps, prepareDesktop, env, e2bApiKey, runPaths, timeoutMs } = this.inputs;
-        const { subjectEnvNames, hasGithubToken, scrubKnownValues, now } = this.inputs;
+        const { subjectEnvNames, hasGithubToken, scrubKnownValues } = this.inputs;
         const requestTimeoutMs = e2bRequestTimeoutMs(env);
         const timers = deps.detachedTimers ?? {};
-        const subjectSandboxTimeoutMs = timeoutMs +
-            SUBJECT_PROVISION_BUDGET_MS +
-            (clone.state?.seed ?? []).reduce((sum, step) => sum + (step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS), 0) +
-            SANDBOX_TIMEOUT_BUFFER_MS;
         const subjectModule = await (deps.desktopModule ?? loadE2BDesktopModule)();
         await validatePreparedRunArtifactPaths(runPaths);
-        // The receipt is on disk before any work on the sandbox, so `humanish reclaim` can kill
-        // it by exact id when this process dies mid-run; the finally block below only runs while
-        // the process is alive.
-        const subject = await acquireE2BDesktopSandbox({
+        const subjectDesktop = await this.sandbox.acquire({
             module: subjectModule,
-            options: {
-                apiKey: e2bApiKey,
-                requestTimeoutMs,
-                timeoutMs: subjectSandboxTimeoutMs,
-                metadata: {
-                    mode: "scripted-browser-lab",
-                    tool: "humanish",
-                    labId: plan.studyId,
-                    kind: "subject",
-                    actor: plan.actor,
-                },
-                ...(subjectEnvNames.length > 0
-                    ? {
-                        envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
-                    }
-                    : {}),
-                dpi: 96,
-                lifecycle: { onTimeout: "kill" },
+            apiKey: e2bApiKey,
+            requestTimeoutMs,
+            sessionTimeoutMs: timeoutMs,
+            seed: clone.state?.seed ?? [],
+            metadata: {
+                mode: "scripted-browser-lab",
+                tool: "humanish",
+                labId: plan.studyId,
+                kind: "subject",
+                actor: plan.actor,
             },
+            envs: Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
             template: plan.residual.execution?.desktop?.template,
-            receipt: { root: runPaths, participantId: "subject" },
+            root: runPaths,
         });
-        const subjectDesktop = subject.sandbox;
-        this.allocation = subject.allocation;
-        this.sandboxId = subject.allocation.resourceId;
-        this.createdAtMs = now();
-        this.resources = await observeDesktopResources(subjectDesktop);
         if (prepareDesktop) {
             await prepareDesktop(subjectDesktop, { kind: "subject" });
             await validatePreparedRunArtifactPaths(runPaths);
@@ -125,37 +102,4 @@ export class ScriptedSubject {
         this.hostDigest = hostOriginDigest(hostUrl);
         return hostUrl;
     }
-    /** Releases the subject by exact id, when one was acquired. An unconfirmed release is reported. */
-    async teardown() {
-        const { warnings, scrubKnownValues, now } = this.inputs;
-        if (this.allocation === undefined)
-            return;
-        const released = await this.allocation.close();
-        const reading = readE2BRelease(released, {
-            label: "Subject sandbox",
-            scrub: scrubKnownValues,
-            costSpan: true,
-        });
-        this.killed = reading.released;
-        if (reading.warning)
-            warnings.push(reading.warning);
-        if (!reading.released)
-            this.releaseWarning = reading.warning ?? "Subject sandbox release is unconfirmed.";
-        // Without a kill method, or in E2B debug mode, no kill reached E2B, so there is no teardown
-        // time to record.
-        if (released.status !== "unconfirmed" || released.reason !== "release_unavailable")
-            this.tornDownAtMs = now();
-    }
-    /** The subject desktop's billed span and size, when one was acquired. */
-    desktopUsage() {
-        if (this.sandboxId === undefined)
-            return undefined;
-        return {
-            durationMs: this.createdAtMs === undefined || this.tornDownAtMs === undefined
-                ? undefined
-                : Math.max(0, this.tornDownAtMs - this.createdAtMs),
-            observation: this.resources,
-            killed: this.killed,
-        };
-    }
 }

package/dist/routes/scripted/surface-sessions.d.ts

@@ -3,7 +3,7 @@ import type { ScriptedPlan } from "../../study/plan-types.js";
 import { type PreparedRunArtifactPaths } from "../../run/paths.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 /** One session per surface, in parallel. */
-export declare function runScriptedSessions(session: Required<Pick<ScriptedBrowserSessionOptions, "appUrl" | "evidenceAppUrl" | "urlPolicy" | "journey" | "persona" | "timeoutMs" | "artifactRoot">>, run: {
+export declare function runScriptedSessions(session: Required<Pick<ScriptedBrowserSessionOptions, "appUrl" | "evidenceAppUrl" | "urlPolicy" | "journey" | "persona" | "timeoutMs" | "artifactRoot" | "scrubKnownValues">>, run: {
     surfaces: ScriptedPlan["surfaces"];
     deps: StudyDeps;
     browserCommand: string | undefined;

package/dist/routes/scripted/surface-sessions.js

@@ -7,6 +7,7 @@ import { validateScriptedSessionResult } from "./session-result.js";
 /** One session per surface, in parallel. */
 export function runScriptedSessions(session, run) {
     const { appUrl, evidenceAppUrl, urlPolicy, journey, persona, timeoutMs, artifactRoot } = session;
+    const { scrubKnownValues } = session;
     const { surfaces, deps, browserCommand, runPaths, onSessionStart } = run;
     const runSession = deps.runScriptedSession;
     return Promise.all(surfaces.map((surface) => {
@@ -20,6 +21,7 @@ export function runScriptedSessions(session, run) {
             persona,
             timeoutMs,
             artifactRoot,
+            scrubKnownValues,
             ...(browserCommand === undefined ? {} : { browserCommand }),
             ...(deps.launchBrowser === undefined ? {} : { launchBrowser: deps.launchBrowser }),
             ...(deps.now === undefined ? {} : { now: deps.now }),

package/dist/routes/scripted/types.d.ts

@@ -5,7 +5,7 @@ import type { ObserverResult } from "../../observer/render.js";
 import type { RunSubjectProvenance } from "../../run/bundle.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 import type { RunStudyHomes } from "../../study/run-study-homes.js";
-import { type StudyResultIdentity } from "../../run/study-result.js";
+import { type StudyResultErrorCode, type StudyResultIdentity } from "../../run/study-result.js";
 /** What a scripted run takes besides its plan. The plan carries the config, dry run and study. */
 export interface ScriptedRunInput {
     /** Cancels post-run analysis only. */
@@ -58,7 +58,7 @@ export interface ScriptedBrowserStudyResult extends AutomaticAnalysisResult, Stu
     observer?: ObserverResult;
     warnings: string[];
     error?: {
-        code: "HUMANISH_STUDY_ANALYSIS_INVALID" | "HUMANISH_STUDY_TASKS_UNSUPPORTED" | "HUMANISH_STUDY_OPTION_UNSUPPORTED" | "HUMANISH_STUDY_V2_UNSUPPORTED" | "HUMANISH_STUDY_INVALID" | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE" | "HUMANISH_RUN_ID_IN_USE";
+        code: StudyResultErrorCode | "HUMANISH_SCRIPTED_FAILED" | "HUMANISH_SCRIPTED_ACTOR_UNSUPPORTED" | "HUMANISH_SCRIPTED_SCENARIO_INVALID" | "HUMANISH_SCRIPTED_SUBJECT_UNSAFE" | "HUMANISH_SCRIPTED_BROWSER_MISSING" | "HUMANISH_SCRIPTED_KEYS_MISSING" | "HUMANISH_SCRIPTED_SUBJECT_ENV_MISSING" | "HUMANISH_SCRIPTED_GETHOST_UNAVAILABLE";
         message: string;
     };
 }

package/dist/routes/shared-world/bundle.js

@@ -8,6 +8,7 @@ import { SHARED_WORLD_SCHEMA, concurrencyFacts, sharedWorldParticipantKeys, } fr
 import { commandDigestOf } from "../../subject/state.js";
 import { buildRunCostSummary, desktopSpanToMinutes } from "../../run/cost-summary.js";
 import { participantFactsOf } from "../computer-use/participant-facts.js";
+import { participantFeedbackCandidates } from "../computer-use/participant-feedback.js";
 import { judgeSharedWorld, participantPassed, sharedWorldShortfall, verdictText, } from "../../run/judge.js";
 import { reviewOutcome } from "../../run/display.js";
 import { combineCheckpointDigest } from "./checkpoints.js";
@@ -369,7 +370,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         },
         artifacts: bundleArtifacts(),
         review,
-        feedbackCandidates: [],
+        feedbackCandidates: sharedWorldFeedbackCandidates(args),
         // Custom desktop image provenance (subject + every actor sandbox launched on it); omitted on the default.
         ...(plan.residual.execution?.desktop?.template === undefined
             ? {}
@@ -380,6 +381,40 @@ export function buildConcurrentSharedWorldBundle(args) {
         ...(cost === undefined ? {} : { cost }),
     };
 }
+/**
+ * What the participants reported, built by the same builder as a computer-use fan-out: one
+ * candidate per participant who reported friction or abandoned the goal, named by its participant
+ * id, with that participant's own instructions as `expected`. Dry-run and in-progress bundles
+ * carry none: there is no participant yet to quote. The comms thread belongs to the one shared
+ * app, so each candidate cites it.
+ */
+function sharedWorldFeedbackCandidates(args) {
+    if (args.dryRun || args.inProgress === true)
+        return [];
+    return participantFeedbackCandidates({
+        runId: args.run.runId,
+        scenarioId: `concurrent-shared-world-${args.plan.studyId}`,
+        adapterId: args.plan.studyId,
+        // planSharedWorldStudy refuses any target other than e2b-desktop on both planes.
+        substrate: "e2b-desktop",
+        participants: args.actorSpecs.map((spec, index) => {
+            const outcome = args.actorResults[index]?.outcome;
+            return {
+                participantId: spec.planned.id,
+                streamId: spec.streamId,
+                personaId: spec.persona.id,
+                goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                ...(outcome?.session === undefined
+                    ? {}
+                    : { session: outcome.session, traceArtifactPath: spec.traceArtifactPath }),
+                screenshots: outcome?.screenshots ?? [],
+                ...(args.commsArtifactPath === undefined
+                    ? {}
+                    : { commsArtifactPath: args.commsArtifactPath }),
+            };
+        }),
+    });
+}
 /**
  * Priced like `per-lane-worlds`: each participant's model tokens and desktop, plus the provisioned plane's
  * desktop. Absent when nothing ran, so dry runs and in-progress snapshots stay byte-stable.

package/dist/routes/shared-world/comms.d.ts

@@ -3,6 +3,7 @@ import type { SharedWorldPlan } from "../../study/plan-types.js";
 import type { CommsReceivingRun } from "../../comms/receiving.js";
 import { type DeployedCommsCatch } from "../../comms/sandbox-catch.js";
 import type { StudyCommsEmail, StudyConfig } from "../../study/types.js";
+import type { RunSecrets } from "../../run/secrets.js";
 import type { Shell } from "../../substrates/shell.js";
 import type { ConcurrentSharedWorldPlaneClass, ExternalCommsWiring, PlaneContext } from "./types.js";
 /** The in-sandbox email catch a provisioned plane deploys, when the study declares one. */
@@ -58,7 +59,7 @@ export declare function prepareEmailReceiving(args: {
     env: Record<string, string | undefined>;
     participants: string[];
     runPaths: PlaneContext["runPaths"];
-    knownSecretValues: string[];
+    secrets: RunSecrets;
     dryRun: boolean;
 }): Promise<{
     ok: true;