humanish 0.111.3 → 0.112.0

package/CHANGELOG.md

@@ -8,6 +8,39 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.112.0: Plain finding headlines, design findings, plain captions, DO_NOT_TRACK for terminal participants (2026-10-07)
+
+humanish 0.112.0 writes findings and captions for someone who did not watch the session, and
+terminal participants send `DO_NOT_TRACK=1` by default. Each analysis finding leads with a plain
+headline and an account of what the person tried, what got in their way and how it seemed to feel;
+its title, summary and observations stay underneath as the evidence. Analyses also report design
+findings: problems a product designer would notice in the captures, each with a severity and at
+least one cited capture. `review --json` carries them as `analysis.designFindings`, and the
+analysis prompt is `study-evidence-7`. Participant captions name the person, such as "Lobby host,
+phone", and every route's run summary says how many participants took part and how many reached
+the goal. Terminal participant and product setup commands run with `DO_NOT_TRACK=1`; set
+`execution.terminal.doNotTrack: false` to study a product's telemetry. `humanish runs` and the
+Observer now read a run with no outcome and a running simulation as interrupted, as the TUI,
+`stats` and `verify` already did. The `--env-file` and `cleanup` aliases are removed in the first
+minor release on or after 2026-11-03.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.112.0)
+
+## 0.111.4: Encoded known values scrubbed, scripted traces scrubbed, a live command after a dry run (2026-10-06)
+
+humanish 0.111.4 scrubs a run's known values from more of its evidence and fixes three messages.
+Every route now also finds a known value, such as a provider key or a `subject.env` value, in its
+encoded forms: percent-encoded, JSON-escaped, base64, base64url and hex, and where a terminal color
+code or an output chunk boundary splits it. A scripted run scrubs its known values from the step
+trace in `traces/<surface>.json` and `actor-<surface>.json`, and from the app URL, scenario goal,
+title and step labels it records. Two places keep a known value: a scenario file name, and the
+path of a computer-use `subject.appUrl`. `humanish review` on a dry run names the command that
+starts a live run, so `next` in `review --json` holds a string where it held null. A terminal
+refusal for a missing runtime key no longer reads `runtimeAuth "undefined"`, and a refusal that
+names two signed-in coding agents reads "report".
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.111.4)
+
 ## 0.111.3: Shared-world feedback candidates, scripted E2B key scrubbed, subject sandbox warnings (2026-10-06)
 
 humanish 0.111.3 gives shared-world runs feedback candidates and repairs seven places where one

package/dist/actors/computer-use/openai-conversation.d.ts

@@ -0,0 +1,91 @@
+import type { CuaTurn, CuaTurnRequest } from "./loop.js";
+import type { ReasoningEffort } from "../reasoning-effort.js";
+import type { ActorConversation } from "../contract.js";
+import { type OpenAiReasoningSummary } from "./openai-wire.js";
+/** How a conversation starts. The model settings stay fixed for the whole session. */
+export interface OpenAiConversationSettings {
+    readonly model: string;
+    readonly reasoningEffort: ReasoningEffort;
+    readonly maxOutputTokens?: number;
+    readonly safetyIdentifier?: string;
+    /** The summaries to ask for until the account or model rejects them; undefined asks for none. */
+    readonly reasoningSummary: OpenAiReasoningSummary | undefined;
+    /** Carry the conversation on the client from the first request (explicit_context). */
+    readonly zeroDataRetention: boolean;
+    /** The clock the trace's record reads. */
+    readonly now: () => number;
+}
+/**
+ * One request of the conversation. Its new items are built once, so every attempt at it, and the
+ * reply it accepts, see the same ones.
+ */
+export interface ConversationRequest {
+    /** The body as the conversation stands now, so an attempt after a rejection shows its effect. */
+    body(): Record<string, unknown>;
+    /**
+     * The request was answered: records a participant request with what it carried, moves the
+     * conversation on to the reply and returns the reply's turn.
+     */
+    accept(reply: unknown): CuaTurn;
+}
+/** Which answer told the provider that the organization keeps no server-side conversation. */
+export type ZdrRejection = NonNullable<ActorConversation["rejection"]>;
+export declare class OpenAiConversation {
+    private readonly settings;
+    private lastResponseId;
+    /** computer_call ids the next request owes an output for. */
+    private pendingCallIds;
+    /** Accepted replies so far; the next request is number `replies + 1`. */
+    private replies;
+    /** The whole conversation, which explicit-context requests carry within its token budget. */
+    private readonly carried;
+    private mode;
+    /** Undefined once the account or model rejected reasoning summaries. */
+    private reasoningSummary;
+    private readonly evidence;
+    constructor(settings: OpenAiConversationSettings);
+    /**
+     * The next request, carrying `req`'s screen: the opening request, or the outputs the latest
+     * reply's computer calls are owed. A closing report asks for a strict JSON report and no tools.
+     */
+    request(req: CuaTurnRequest, closing?: boolean): ConversationRequest;
+    /**
+     * The organization rejected server-side state: carry the conversation on the client from the
+     * request being sent, and record which answer made the switch. False when the conversation is
+     * already carried, so the rejection stands.
+     */
+    switchToExplicitContext(rejection: ZdrRejection): boolean;
+    /**
+     * The account or model rejected reasoning summaries: stop asking for the rest of the session,
+     * from the request being sent. False when none are asked for, so the rejection stands.
+     */
+    dropReasoningSummaries(): boolean;
+    /**
+     * Whether the server holds the whole session, so a closing report threaded on it reads every
+     * turn. An explicit-context conversation summarizes its oldest turns past its budget, configured
+     * or switched to at runtime.
+     */
+    get serverHoldsSession(): boolean;
+    /** The trace's account of how the conversation was carried (ActorConversation). */
+    record(): ActorConversation;
+    /**
+     * The items a request adds to the conversation: the opening message with the first screen, or
+     * an output for each pending computer_call with the latest screenshot and any hint.
+     */
+    private newItems;
+    private context;
+    /**
+     * A participant request: the opening request, or a continuation carrying `sent`. A threaded
+     * continuation names the previous response; an explicit-context one carries the conversation
+     * ahead of `sent`.
+     */
+    private turnBody;
+    /** The read-only closing report: no tools, a small output limit, a strict schema. */
+    private closingBody;
+    /**
+     * Move the conversation on to a reply to a request that added `sent`. A participant reply cut
+     * off by the output limit is set aside, so the next request is the same one again
+     * (outputLimitRetry); its actions never run, so no call output is owed for them.
+     */
+    private accept;
+}

package/dist/actors/computer-use/openai-conversation.js

@@ -0,0 +1,209 @@
+import { CarriedConversation, estimateTokens } from "./openai-context.js";
+import { buildCallOutput, buildContinuationRequest, buildInitialRequest, hintItems, openingMessage, parseOpenAiResponse, } from "./openai-wire.js";
+/** The closing report's output limit: its own cap, or the declared limit when that is lower. */
+const CLOSING_OUTPUT_LIMIT = 1024;
+export class OpenAiConversation {
+    settings;
+    lastResponseId;
+    /** computer_call ids the next request owes an output for. */
+    pendingCallIds = [];
+    /** Accepted replies so far; the next request is number `replies + 1`. */
+    replies = 0;
+    /** The whole conversation, which explicit-context requests carry within its token budget. */
+    carried = new CarriedConversation();
+    mode;
+    /** Undefined once the account or model rejected reasoning summaries. */
+    reasoningSummary;
+    evidence;
+    constructor(settings) {
+        this.settings = settings;
+        this.mode = settings.zeroDataRetention ? "explicit_context" : "threaded";
+        this.reasoningSummary = settings.reasoningSummary;
+        this.evidence = new ConversationRecord(settings.zeroDataRetention, settings.now);
+    }
+    /**
+     * The next request, carrying `req`'s screen: the opening request, or the outputs the latest
+     * reply's computer calls are owed. A closing report asks for a strict JSON report and no tools.
+     */
+    request(req, closing = false) {
+        const sent = this.newItems(req);
+        return {
+            body: () => (closing ? this.closingBody(req, sent) : this.turnBody(req, sent)),
+            accept: (reply) => this.accept(reply, closing, sent),
+        };
+    }
+    /**
+     * The organization rejected server-side state: carry the conversation on the client from the
+     * request being sent, and record which answer made the switch. False when the conversation is
+     * already carried, so the rejection stands.
+     */
+    switchToExplicitContext(rejection) {
+        if (this.mode === "explicit_context")
+            return false;
+        this.evidence.switched(rejection);
+        this.mode = "explicit_context";
+        return true;
+    }
+    /**
+     * The account or model rejected reasoning summaries: stop asking for the rest of the session,
+     * from the request being sent. False when none are asked for, so the rejection stands.
+     */
+    dropReasoningSummaries() {
+        if (this.reasoningSummary === undefined)
+            return false;
+        this.reasoningSummary = undefined;
+        return true;
+    }
+    /**
+     * Whether the server holds the whole session, so a closing report threaded on it reads every
+     * turn. An explicit-context conversation summarizes its oldest turns past its budget, configured
+     * or switched to at runtime.
+     */
+    get serverHoldsSession() {
+        return this.mode === "threaded" && this.lastResponseId !== undefined;
+    }
+    /** The trace's account of how the conversation was carried (ActorConversation). */
+    record() {
+        return this.evidence.snapshot(this.mode);
+    }
+    /**
+     * The items a request adds to the conversation: the opening message with the first screen, or
+     * an output for each pending computer_call with the latest screenshot and any hint.
+     */
+    newItems(req) {
+        if (this.replies === 0)
+            return [openingMessage(req.instructions, req.observation.screenshot)];
+        return [
+            ...this.pendingCallIds.map((id) => buildCallOutput(id, req.observation.screenshot, req.acknowledgedSafetyChecks)),
+            ...hintItems(req.contextHint),
+        ];
+    }
+    context(instructions) {
+        const { settings } = this;
+        return {
+            stateless: this.mode === "explicit_context",
+            model: settings.model,
+            instructions,
+            reasoningEffort: settings.reasoningEffort,
+            ...(settings.maxOutputTokens === undefined
+                ? {}
+                : { maxOutputTokens: settings.maxOutputTokens }),
+            ...(this.reasoningSummary === undefined ? {} : { reasoningSummary: this.reasoningSummary }),
+            ...(settings.safetyIdentifier === undefined
+                ? {}
+                : { safetyIdentifier: settings.safetyIdentifier }),
+        };
+    }
+    /**
+     * A participant request: the opening request, or a continuation carrying `sent`. A threaded
+     * continuation names the previous response; an explicit-context one carries the conversation
+     * ahead of `sent`.
+     */
+    turnBody(req, sent) {
+        const ctx = this.context(req.instructions);
+        if (this.replies === 0)
+            return buildInitialRequest(ctx, req.observation.screenshot);
+        return buildContinuationRequest({
+            ctx,
+            previousResponseId: this.lastResponseId,
+            callOutputs: [...sent],
+            ...(this.mode === "explicit_context" ? { explicitContextItems: this.carried.carried() } : {}),
+        });
+    }
+    /** The read-only closing report: no tools, a small output limit, a strict schema. */
+    closingBody(req, sent) {
+        return {
+            ...this.turnBody(req, sent),
+            tool_choice: "none",
+            max_output_tokens: Math.min(this.settings.maxOutputTokens ?? CLOSING_OUTPUT_LIMIT, CLOSING_OUTPUT_LIMIT),
+            text: {
+                format: {
+                    type: "json_schema",
+                    name: "participant_closing_report",
+                    strict: true,
+                    schema: {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["summary", "frictionReports"],
+                        properties: {
+                            summary: { type: "string" },
+                            frictionReports: { type: "array", items: { type: "string" } },
+                        },
+                    },
+                },
+            },
+        };
+    }
+    /**
+     * Move the conversation on to a reply to a request that added `sent`. A participant reply cut
+     * off by the output limit is set aside, so the next request is the same one again
+     * (outputLimitRetry); its actions never run, so no call output is owed for them.
+     */
+    accept(reply, closing, sent) {
+        // Recorded before the reply is accepted: accepting can cut the carried history, and the record
+        // counts what this request carried.
+        if (!closing)
+            this.evidence.requested(this.mode, this.carried, sent);
+        const parsed = parseOpenAiResponse(reply);
+        if (!closing && parsed.turn.interruption === "output_limit")
+            return parsed.turn;
+        if (parsed.turn.responseId !== undefined)
+            this.lastResponseId = parsed.turn.responseId;
+        this.pendingCallIds = parsed.callIds;
+        this.replies += 1;
+        this.carried.accept(this.replies, sent, parsed.outputItems);
+        return parsed.turn;
+    }
+}
+/** The trace's account of how a session carried its conversation (ActorConversation). */
+class ConversationRecord {
+    now;
+    explicitReason;
+    rejection;
+    switchedAt;
+    switchedAtRequest;
+    summarizedTurns = 0;
+    requests = [];
+    constructor(configured, now) {
+        this.now = now;
+        if (configured)
+            this.explicitReason = "configured";
+    }
+    /** The organization rejected server-side state, so the request being sent is explicit_context. */
+    switched(rejection) {
+        this.explicitReason = "zdr_rejection";
+        this.rejection = rejection;
+        this.switchedAt = new Date(this.now()).toISOString();
+        // Counted like requests[], which includes replies set aside at their output limit.
+        this.switchedAtRequest = this.requests.length + 1;
+    }
+    /** A participant request went out with `sent` after `conversation`. */
+    requested(mode, conversation, sent) {
+        if (mode !== "explicit_context") {
+            this.requests.push({ mode: "threaded" });
+            return;
+        }
+        const carried = conversation.size();
+        // Only summaries a request carried count; the conversation also trims after the last reply.
+        this.summarizedTurns = carried.notedTurns;
+        this.requests.push({
+            mode: "explicit_context",
+            carriedExchanges: carried.exchanges,
+            carriedScreenshots: carried.screenshots,
+            estimatedInputTokens: carried.estimatedTokens + estimateTokens(sent),
+        });
+    }
+    snapshot(mode) {
+        return {
+            mode,
+            ...(this.explicitReason === undefined ? {} : { explicitReason: this.explicitReason }),
+            ...(this.rejection === undefined ? {} : { rejection: this.rejection }),
+            ...(this.switchedAt === undefined ? {} : { switchedAt: this.switchedAt }),
+            ...(this.switchedAtRequest === undefined
+                ? {}
+                : { switchedAtRequest: this.switchedAtRequest }),
+            summarizedTurns: this.summarizedTurns,
+            requests: this.requests.map((request) => ({ ...request })),
+        };
+    }
+}

package/dist/actors/computer-use/openai-provider.js

@@ -1,16 +1,16 @@
 import { validClosingReport } from "./loop.js";
 import { ComputerUseAdmissionLimitError, isComputerUseAdmissionLimitError, } from "./admission-limit.js";
 import { ComputerUsePromptRefusedError } from "./provider-error.js";
-import { CarriedConversation } from "./openai-context.js";
-import { acceptReply, ConversationRecord, debriefRequestBody, turnInputItems, turnRequestBody, } from "./openai-requests.js";
-import { asRecord, optionalString, parseOpenAiResponse, } from "./openai-wire.js";
+import { OpenAiConversation, } from "./openai-conversation.js";
+import { asRecord, optionalString } from "./openai-wire.js";
 import { redactText } from "../../evidence/redaction.js";
 import { isMaxOutputTokens } from "../output-token-limit.js";
 import { prepareContainedOutputFile, prepareSelectedOutputDirectory, writeContainedOutputFile, } from "../../run/contained-output.js";
 import { OPENAI_RESPONSES_URL } from "../openai-endpoint.js";
 // A public-safe re-derivation of the OpenAI Responses API computer-use provider,
 // behind the CuaProvider port from src/actors/computer-use/loop.ts. The pure wire mapping
-// (openAiActionToCua, parseOpenAiResponse and the request builders) is in openai-wire.ts.
+// (openAiActionToCua, parseOpenAiResponse and the request builders) is in openai-wire.ts, and
+// what each request carries, with the trace's record of it, is in openai-conversation.ts.
 // This module is the live shim: createOpenAiResponsesProvider does a raw POST to the
 // Responses endpoint (no SDK dependency) through an injectable FetchLike seam, so the retry,
 // ZDR fallback, and state threading are testable with a fake.
@@ -412,24 +412,17 @@ export function createOpenAiResponsesProvider(options) {
     // An unset or empty capture variable leaves capture off.
     const capture = createWireCapture(optionalString((options.env ?? process.env)[WIRE_CAPTURE_ENV]?.trim()));
     let interactionUsageIncomplete = false;
-    const settings = {
+    const conversation = new OpenAiConversation({
         model,
         reasoningEffort,
         ...(maxOutputTokens === undefined ? {} : { maxOutputTokens }),
         ...(options.safetyIdentifier === undefined
             ? {}
             : { safetyIdentifier: options.safetyIdentifier }),
-    };
-    const state = {
-        lastResponseId: undefined,
-        pendingCallIds: [],
-        replies: 0,
-        conversation: new CarriedConversation(),
-        mode: options.zeroDataRetention ? "explicit_context" : "previous_response_id",
-        // Latches to undefined (stop asking) for the rest of the session when the
-        // account/model rejects the summary request; see OpenAiResponsesProviderOptions.
         reasoningSummary: options.reasoningSummary === "off" ? undefined : (options.reasoningSummary ?? "auto"),
-    };
+        zeroDataRetention: options.zeroDataRetention === true,
+        now: options.now ?? Date.now,
+    });
     const transport = {
         endpoint: options.endpoint ?? OPENAI_RESPONSES_URL,
         apiKey: options.apiKey,
@@ -441,25 +434,21 @@ export function createOpenAiResponsesProvider(options) {
         },
     };
     const post = (body, signal, retries = maxRetries, interaction = true, spend) => postResponse(transport, body, signal, retries, interaction, spend);
-    const record = new ConversationRecord(options.zeroDataRetention === true, options.now ?? Date.now);
     // POST with the recoverable-policy latches: a ZDR rejection switches to explicit-context mode; a
     // reasoning-summary rejection latches summaries off. Each latch can flip only once, so the loop
     // is bounded; anything else rethrows. The body is rebuilt per attempt so a flipped latch shows.
-    const postTurn = async (req, sent, signal, spend) => {
+    const postTurn = async (request, signal, spend) => {
         if (options.singleDispatch === true)
-            return post(turnRequestBody(settings, state, req, sent), signal, 0);
+            return post(request.body(), signal, 0);
         for (;;) {
             try {
-                return await post(turnRequestBody(settings, state, req, sent), signal, maxRetries, true, spend);
+                return await post(request.body(), signal, maxRetries, true, spend);
             }
             catch (error) {
-                if (error instanceof SummaryRejectionError && state.reasoningSummary !== undefined) {
-                    state.reasoningSummary = undefined;
+                if (error instanceof SummaryRejectionError && conversation.dropReasoningSummaries()) {
                     continue;
                 }
-                if (error instanceof ZdrError && state.mode !== "explicit_context") {
-                    record.switched(error.rejection);
-                    state.mode = "explicit_context";
+                if (error instanceof ZdrError && conversation.switchToExplicitContext(error.rejection)) {
                     continue;
                 }
                 throw error;
@@ -468,29 +457,26 @@ export function createOpenAiResponsesProvider(options) {
     };
     const requestTurn = async (req, signal, closing = false, spend) => {
         await capture.prepareNext();
-        const sent = turnInputItems(state, req);
+        const request = conversation.request(req, closing);
         // A closing report makes exactly one request: no HTTP or policy-latch retries.
         const raw = closing
-            ? await post(debriefRequestBody(settings, state, req, sent), signal, 0, false)
-            : await postTurn(req, sent, signal, spend);
-        if (!closing)
-            record.requested(state, sent);
-        const parsed = parseOpenAiResponse(raw);
-        acceptReply(state, parsed, closing, sent);
+            ? await post(request.body(), signal, 0, false)
+            : await postTurn(request, signal, spend);
+        const turn = request.accept(raw);
         if (closing) {
             // Refusals, incomplete output, malformed JSON, and invalid shapes remain no-report results.
             // Never promote raw JSON or a fallback paragraph into a structured finding.
             try {
-                const report = JSON.parse(parsed.turn.message ?? "");
+                const report = JSON.parse(turn.message ?? "");
                 if (asRecord(raw).status === "completed" && validClosingReport(report)) {
-                    return { ...parsed.turn, closingReport: report };
+                    return { ...turn, closingReport: report };
                 }
             }
             catch {
                 /* A failed optional closing account keeps its usage and no report. */
             }
         }
-        return parsed.turn;
+        return turn;
     };
     return {
         id: "openai-responses-cu",
@@ -512,15 +498,13 @@ export function createOpenAiResponsesProvider(options) {
         },
         nextTurn: (req, signal, spend) => requestTurn(req, signal, false, spend),
         get conversation() {
-            return record.snapshot(state);
+            return conversation.record();
         },
-        // An explicit-context conversation summarizes its oldest turns past its budget, so it may not
-        // hold the whole session a retrospective report needs. This getter follows both configured
-        // ZDR and a runtime policy latch.
+        // A retrospective report reads the session the server holds; see serverHoldsSession.
         get debrief() {
-            return state.mode === "explicit_context" || state.lastResponseId === undefined
-                ? undefined
-                : (req, signal) => requestTurn(req, signal, true);
+            return conversation.serverHoldsSession
+                ? (req, signal) => requestTurn(req, signal, true)
+                : undefined;
         },
     };
 }

package/dist/actors/contract.d.ts

@@ -191,6 +191,8 @@ export interface ParticipantClosingReport {
 export interface ActorRuntimeProvenance {
     schema: "humanish.actor-runtime.v1";
     package: string;
+    /** Terminal command telemetry opt-out; absent in older bundles. */
+    doNotTrack?: boolean;
     requestedVersion: string;
     observedVersion?: string;
     versionStatus: "unobserved" | "verified" | "failed";

package/dist/actors/scripted-browser/actor.d.ts

@@ -24,6 +24,11 @@ export interface ScriptedBrowserSessionOptions {
     /** DI seam; production default is launchPlaywrightChromium. */
     launchBrowser?: (args: ScriptedBrowserLaunchArgs) => Promise<ScriptedBrowserLike>;
     now?: () => number;
+    /**
+     * The run's scrub of its known secret values. Each URL and text the session records passes
+     * through it before the trace is written or the capture returned.
+     */
+    scrubKnownValues?: (text: string) => string;
 }
 export interface ScriptedBrowserSessionResult extends ActorSessionResult {
     /** Native evidence incl. tracePath (humanish.browser-persona-trace.v1, written to disk). */

package/dist/actors/scripted-browser/actor.js

@@ -21,7 +21,7 @@ import { CHROMIUM_EVIDENCE_HYGIENE_FLAGS } from "../../evidence/browser-hygiene.
 import { redactText } from "../../evidence/redaction.js";
 import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputDirectory, prepareContainedOutputFile, prepareSelectedOutputDirectory, writeContainedOutputFile, } from "../../run/contained-output.js";
 import { ACTOR_TRACE_SCHEMA, SCRIPTED_BROWSER_CAPABILITIES, } from "../contract.js";
-import { buildBlockedBrowserPersonaSteps, buildBrowserTrace, captureBlockedStepScreenshot, compactBrowserError, executeBrowserPersonaStep, probeAppUrl, sanitizeBrowserEvidenceUrl, screenshotPathForBrowserStep, surfaceScreenshotPath, tracePathForBrowserSurface, } from "./steps.js";
+import { buildBlockedBrowserPersonaSteps, buildBrowserTrace, captureBlockedStepScreenshot, compactBrowserError, executeBrowserPersonaStep, probeAppUrl, sanitizeBrowserEvidenceUrl, screenshotPathForBrowserStep, scrubRecordedStep, surfaceScreenshotPath, tracePathForBrowserSurface, } from "./steps.js";
 import { LOOPBACK_EVIDENCE_URL_POLICY, } from "./types.js";
 import { chromeLaunchEnv, chromeLaunchError } from "./launch-env.js";
 /** Production default: lazy playwright-core import + chromium.launch, exactly as the driver
@@ -93,8 +93,10 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
     const browserCommand = options.browserCommand ?? (options.launchBrowser ? "injected-browser" : "");
     const evidenceAppUrl = options.evidenceAppUrl ?? options.appUrl;
     const urlPolicy = options.urlPolicy ?? LOOPBACK_EVIDENCE_URL_POLICY;
+    const scrub = options.scrubKnownValues ?? ((text) => text);
     const finish = async (args) => {
         const completedAtMs = now();
+        const reason = scrub(args.reason);
         const trace = await projectScriptedActorTrace({
             artifactRoot: preparedArtifactRoot,
             capture: args.capture,
@@ -104,14 +106,14 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
             executedSteps: args.executedSteps,
             journey: options.journey,
             persona: options.persona,
-            reason: args.reason,
+            reason,
             startedAt,
             status: args.status,
         });
         return {
             status: args.status,
             completionReason: args.completionReason,
-            reason: args.reason,
+            reason,
             capture: args.capture,
             trace,
         };
@@ -130,6 +132,7 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
             evidenceAppUrl,
             journey: options.journey,
             reason,
+            scrub,
             surface: options.surface,
             urlPolicy,
         });
@@ -155,6 +158,7 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
         browserCommand,
         evidenceAppUrl,
         journey: options.journey,
+        scrub,
         surface: options.surface,
         timeoutMs: options.timeoutMs,
         urlPolicy,
@@ -258,17 +262,18 @@ async function runScriptedJourney(args) {
     finally {
         await args.browser.close().catch(() => undefined);
     }
+    const recordedSteps = steps.map((step) => scrubRecordedStep(step, args.scrub));
     const completedAt = new Date().toISOString();
     const durationMs = Date.now() - started;
     const ok = !timedOut &&
         httpProbe.ok &&
-        steps.length === args.journey.steps.length &&
-        steps.every((step) => step.status === "passed");
-    const reason = ok
-        ? `${args.surface.label} completed ${steps.length}/${steps.length} scripted browser steps from ${args.evidenceAppUrl}${httpProbe.status === undefined ? "" : ` with HTTP ${httpProbe.status}`}.`
-        : `${args.surface.label} scripted browser journey blocked: ${steps.find((step) => step.status !== "passed")?.reason ?? httpProbe.reason}`;
-    const scriptedScreenshotPath = surfaceScreenshotPath(steps);
-    await writeContainedOutputFile(args.artifactRoot, tracePath, `${JSON.stringify(buildBrowserTrace({
+        recordedSteps.length === args.journey.steps.length &&
+        recordedSteps.every((step) => step.status === "passed");
+    const reason = args.scrub(ok
+        ? `${args.surface.label} completed ${recordedSteps.length}/${recordedSteps.length} scripted browser steps from ${args.evidenceAppUrl}${httpProbe.status === undefined ? "" : ` with HTTP ${httpProbe.status}`}.`
+        : `${args.surface.label} scripted browser journey blocked: ${recordedSteps.find((step) => step.status !== "passed")?.reason ?? httpProbe.reason}`);
+    const scriptedScreenshotPath = surfaceScreenshotPath(recordedSteps);
+    await writeBrowserTrace(args.artifactRoot, tracePath, {
         appUrl: args.evidenceAppUrl,
         browserCommand: path.basename(args.browserCommand || "injected-browser"),
         browserJourney: args.journey,
@@ -278,9 +283,9 @@ async function runScriptedJourney(args) {
         ok,
         reason,
         ...(scriptedScreenshotPath === undefined ? {} : { screenshotPath: scriptedScreenshotPath }),
-        steps,
+        steps: recordedSteps,
         surface: args.surface,
-    }), null, 2)}\n`, "utf8");
+    }, args.scrub);
     return {
         capture: {
             capturedAt: completedAt,
@@ -289,7 +294,7 @@ async function runScriptedJourney(args) {
             ok,
             reason,
             ...(scriptedScreenshotPath === undefined ? {} : { screenshotPath: scriptedScreenshotPath }),
-            steps,
+            steps: recordedSteps,
             surface: args.surface,
             tracePath,
         },
@@ -327,40 +332,56 @@ async function withJourneyDeadline(promise, deadline, timeoutMs) {
 async function persistScriptedFailureCapture(args) {
     const capturedAt = new Date().toISOString();
     const tracePath = tracePathForBrowserSurface(args.surface);
+    const reason = args.scrub(args.reason);
     const blockedSteps = buildBlockedBrowserPersonaSteps({
         browserJourney: args.journey,
         currentUrl: args.appUrl,
-        reason: args.reason,
+        reason,
         surface: args.surface,
         timestamp: capturedAt,
         urlPolicy: args.urlPolicy,
-    });
+    }).map((step) => scrubRecordedStep(step, args.scrub));
     // Pre-actuation failure: no screenshots were written, so the surface omits the
     // screenshot reference and the failure itself stands as the evidence.
     const screenshotPath = surfaceScreenshotPath(blockedSteps);
-    await writeContainedOutputFile(args.artifactRoot, tracePath, `${JSON.stringify(buildBrowserTrace({
+    await writeBrowserTrace(args.artifactRoot, tracePath, {
         appUrl: args.evidenceAppUrl,
         browserCommand: path.basename(args.browserCommand || "injected-browser"),
         browserJourney: args.journey,
         capturedAt,
         durationMs: 0,
         ok: false,
-        reason: args.reason,
+        reason,
         ...(screenshotPath === undefined ? {} : { screenshotPath }),
         steps: blockedSteps,
         surface: args.surface,
-    }), null, 2)}\n`, "utf8");
+    }, args.scrub);
     return {
         capturedAt,
         durationMs: 0,
         ok: false,
-        reason: args.reason,
+        reason,
         ...(screenshotPath === undefined ? {} : { screenshotPath }),
         steps: blockedSteps,
         surface: args.surface,
         tracePath,
     };
 }
+/**
+ * Writes one surface's native trace. Its steps and reason arrive scrubbed; the app URL and the
+ * scenario title pass through the same scrub here.
+ */
+async function writeBrowserTrace(artifactRoot, tracePath, trace, scrub) {
+    const recorded = buildBrowserTrace({
+        ...trace,
+        appUrl: scrub(trace.appUrl),
+        browserJourney: {
+            ...trace.browserJourney,
+            scenarioTitle: scrub(trace.browserJourney.scenarioTitle),
+        },
+    });
+    await writeContainedOutputFile(artifactRoot, tracePath, `${JSON.stringify(recorded, null, 2)}\n`, "utf8");
+}
 /** Project one surface capture into humanish.actor-trace.v1. screenshotRefs are attached only
  *  for frames that actually exist on disk (so counts match disk; blocked-not-executed steps name a
  *  path that was never written). */