humanish 0.111.3 → 0.112.0

package/dist/run/secrets.js

@@ -1,33 +1,158 @@
 // The literal values one run scrubs from what it writes: the provider keys and subject env values
 // its route reads, and the values the run provisions while it runs, such as the addresses email
 // receiving registers. These have no secret shape for pattern redaction to find, so each is
-// replaced as written; redactText runs after the scrub and finds secrets by shape.
+// replaced as written and in the encoded forms a URL, a JSON body or a log line gives it;
+// redactText runs after the scrub and finds secrets by shape.
 import { scrubLiterals } from "../evidence/redaction.js";
+import { encodedForms } from "../evidence/secret-scrub.js";
 export class RunSecrets {
     // Private fields stay out of JSON.stringify and object spread, so a Run that reaches a writer
     // whole cannot carry the values with it.
-    #held;
+    #held = [];
+    /** Every held value as written and encoded, longest first. */
+    #forms = [];
     #minLength;
     /**
-     * Replaces every held value with the marker. It reads the values on each call, so a value added
-     * after the scrub was handed to a participant or a subject is scrubbed from then on.
+     * Replaces every held value with the marker, as written, in each encoded form, and where a URL
+     * carries it partly percent-encoded or a terminal escape sequence splits it. It reads the values
+     * on each call, so a value added after the scrub was handed to a participant or a subject is
+     * scrubbed from then on.
      */
     scrub;
     /** `seed` keeps its order; values shorter than the floor are dropped. */
     constructor(seed, options = {}) {
         // An empty value would match between every character.
         this.#minLength = Math.max(1, options.minLength ?? 4);
-        this.#held = seed.filter((value) => value.length >= this.#minLength);
-        this.scrub = scrubLiterals(this.#held, options.marker);
+        this.add(seed);
+        const marker = options.marker ?? "[REDACTED_SECRET]";
+        // Longest first, so a form that holds a shorter one, such as a JSON-escaped value ending in a
+        // backslash, is replaced whole and leaves no stray escape behind.
+        const literal = scrubLiterals(this.#forms, marker);
+        this.scrub = (text) => {
+            const scrubbed = literal(text);
+            return replaceSpans(scrubbed, viewSpans(scrubbed, this.#forms), marker);
+        };
     }
     /** Holds each value the run learns while it runs, unless it is under the floor or already held. */
     add(values) {
-        for (const value of values)
-            if (value.length >= this.#minLength && !this.#held.includes(value))
-                this.#held.push(value);
+        for (const value of values) {
+            if (value.length < this.#minLength || this.#held.includes(value))
+                continue;
+            this.#held.push(value);
+            for (const form of encodedForms(value))
+                if (!this.#forms.includes(form))
+                    this.#forms.push(form);
+        }
+        this.#forms.sort((left, right) => right.length - left.length);
     }
     /** The held values, seed first, in one array that later `add` calls extend. */
     values() {
         return this.#held;
     }
+    /**
+     * Every held value as written and in each encoded form, longest first, in one array that later
+     * `add` calls extend. The terminal recorder sizes the output it keeps past its cap from these.
+     */
+    forms() {
+        return this.#forms;
+    }
+    /**
+     * Where `text` holds a held value: each encoded form as written, and each form in the text's
+     * view without terminal escape sequences and with percent escapes decoded. Sorted, with
+     * overlapping spans merged. A scrub that replaces across chunk boundaries reads these.
+     */
+    spans(text) {
+        const found = viewSpans(text, this.#forms);
+        for (const form of this.#forms)
+            for (let at = text.indexOf(form); at !== -1; at = text.indexOf(form, at + form.length))
+                found.push([at, at + form.length]);
+        return mergeSpans(found);
+    }
+}
+// What a terminal draws with (operating-system commands, control sequences and two-byte escapes,
+// as written or JSON-escaped, as a JSON event carries a command's colored output) and what a URL
+// encodes with (runs of percent escapes). The view a value is looked for in drops the first and
+// decodes the second.
+const VIEW_SEQUENCE = new RegExp([
+    "\\x1b\\][^\\x07]*(?:\\x07|\\x1b\\\\)",
+    "\\x1b\\[[0-?]*[ -/]*[@-~]",
+    "\\x1b[78=>]",
+    "\\\\u001b\\][^\\\\]*(?:\\\\u0007|\\\\u001b\\\\\\\\)",
+    "\\\\u001b\\[[0-?]*[ -/]*[@-~]",
+    "(?:%[0-9A-Fa-f]{2})+",
+].join("|"), "g");
+/**
+ * Where a value is found in the text's view. A browser encodes a space or a quote in a URL path
+ * and leaves a `/` or a `:` as written, so a value with both matches no single encoded form, and a
+ * color code inside a value splits it. Each found value maps back to the span of `text` it came
+ * from, so the text keeps every other character as written.
+ */
+function viewSpans(text, values) {
+    if (!text.includes("%") && !text.includes("\x1b") && !text.includes("\\u001b"))
+        return [];
+    // The view, and for each of its characters the span of `text` it came from. A character decoded
+    // from an escape run maps to the whole run.
+    let view = "";
+    const starts = [];
+    const ends = [];
+    const copy = (from, to) => {
+        for (let at = from; at < to; at += 1) {
+            starts.push(at);
+            ends.push(at + 1);
+        }
+        view += text.slice(from, to);
+    };
+    let cursor = 0;
+    let changed = false;
+    for (const sequence of text.matchAll(VIEW_SEQUENCE)) {
+        let plain = "";
+        if (sequence[0].startsWith("%")) {
+            try {
+                plain = decodeURIComponent(sequence[0]);
+            }
+            catch {
+                // Not UTF-8: the run stays as written and is copied with the text after it.
+                continue;
+            }
+        }
+        copy(cursor, sequence.index);
+        cursor = sequence.index + sequence[0].length;
+        for (let unit = 0; unit < plain.length; unit += 1) {
+            starts.push(sequence.index);
+            ends.push(cursor);
+        }
+        view += plain;
+        changed = true;
+    }
+    if (!changed)
+        return [];
+    copy(cursor, text.length);
+    const spans = [];
+    for (const value of values)
+        for (let at = view.indexOf(value); at !== -1; at = view.indexOf(value, at + value.length))
+            spans.push([starts[at] ?? 0, ends[at + value.length - 1] ?? text.length]);
+    return spans;
+}
+/** Sorted, with overlapping spans merged; spans that only touch stay apart. */
+function mergeSpans(spans) {
+    const merged = [];
+    for (const [from, to] of [...spans].sort((left, right) => left[0] - right[0])) {
+        const last = merged.at(-1);
+        if (last !== undefined && from < last[1])
+            last[1] = Math.max(last[1], to);
+        else
+            merged.push([from, to]);
+    }
+    return merged;
+}
+function replaceSpans(text, spans, marker) {
+    if (spans.length === 0)
+        return text;
+    let replaced = "";
+    let written = 0;
+    for (const [from, to] of mergeSpans(spans)) {
+        replaced += `${text.slice(written, from)}${marker}`;
+        written = to;
+    }
+    return `${replaced}${text.slice(written)}`;
 }

package/dist/run/stats.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import { runDisplay, runDisplayLabel } from "./display.js";
 import { readRunIndex } from "./run-index.js";
 import { addCostTotals, emptyCostTotals, readCostTotals, } from "./costs.js";
+import { runEstimateUsd } from "./run-cost.js";
 import { round6 } from "./pricing.js";
 import { plural } from "./text.js";
 const STATS_SCHEMA = "humanish.stats.v2";
@@ -27,17 +28,6 @@ function addParticipants(into, entry) {
     into.reachedGoal += entry.participants.reachedGoal;
     into.reportedFriction += entry.participants.reportedFriction ?? 0;
 }
-/**
- * A run's participant and desktop estimate: its recorded figure, or $0 for a dry run that records
- * none, since a dry run makes no model request and creates no desktop. Undefined when the cost is
- * unknown, including a dry run that records an unknown (null) figure.
- */
-function runEstimateUsd(entry) {
-    const usd = entry.estimatedCostUsd;
-    if (typeof usd === "number" && Number.isFinite(usd) && usd >= 0)
-        return usd;
-    return usd === undefined && entry.mode === "dry-run" ? 0 : undefined;
-}
 function entryTime(entry) {
     return entry.startedAt ?? entry.completedAt ?? entry.updatedAt;
 }
@@ -175,7 +165,7 @@ export async function computeStats(cwdInput, options = {}) {
             totals.dryRun += 1;
         if (entry.liveness === "running")
             totals.running += 1;
-        const runUsd = runEstimateUsd(entry);
+        const runUsd = runEstimateUsd(entry) ?? undefined;
         if (runUsd === undefined)
             totals.unpricedRuns += 1;
         else

package/dist/run/transient-comms-secrets.d.ts

@@ -4,7 +4,12 @@ export declare function registerTransientCommsSecrets(values: string[]): void;
 /** Literal, longest-first replacement in one pass; replacement text is never matched recursively. */
 export declare function scrubTransientCommsText(text: string): string;
 /**
- * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
- * base64-encoded and returns decoded text. Outside a scope it changes nothing.
+ * A scrub for text a model writes: each scope value as written and in its encoded forms
+ * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
+ * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
+ * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
+ * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
+ * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
+ * changes nothing.
  */
-export declare function transientCommsEncodedScrub(): (text: string) => string;
+export declare function transientCommsKnownValueScrub(): (text: string) => string;

package/dist/run/transient-comms-secrets.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { decodeEscapes } from "../evidence/encoded-text.js";
 import { scrubSecretValues } from "../evidence/secret-scrub.js";
 import { escapeRegExp } from "./text.js";
 const scopes = new AsyncLocalStorage();
@@ -75,10 +76,29 @@ export function scrubTransientCommsText(text) {
  * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
  * base64-encoded and returns decoded text. Outside a scope it changes nothing.
  */
-export function transientCommsEncodedScrub() {
+function transientCommsEncodedScrub() {
     const scope = scopes.getStore();
     if (!scope)
         return (text) => text;
     usable(scope);
     return scrubSecretValues([...scope.values]);
 }
+const REDACTED = "[REDACTED_SECRET]";
+const markers = (text) => text.split(REDACTED).length - 1;
+/**
+ * A scrub for text a model writes: each scope value as written and in its encoded forms
+ * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
+ * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
+ * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
+ * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
+ * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
+ * changes nothing.
+ */
+export function transientCommsKnownValueScrub() {
+    const encoded = transientCommsEncodedScrub();
+    return (text) => {
+        const literal = scrubTransientCommsText(text);
+        const found = encoded(literal);
+        return scrubTransientCommsText(markers(found) > markers(decodeEscapes(literal)) ? found : literal);
+    };
+}

package/dist/study/keys.d.ts

@@ -168,6 +168,7 @@ export declare const EXECUTION: {
     terminal: {
         stdin: true;
         transport: true;
+        doNotTrack: true;
     };
     desktop: {
         template: true;

package/dist/study/keys.js

@@ -108,7 +108,7 @@ export const EXECUTION = {
     timeoutMs: true,
     completionTimeoutMs: true,
     egressAllow: true,
-    terminal: { stdin: true, transport: true },
+    terminal: { stdin: true, transport: true, doNotTrack: true },
     desktop: {
         template: true,
         browser: true,

package/dist/study/parse/execution.js

@@ -75,9 +75,15 @@ function parseTerminal(raw) {
         return { ok: true, value: undefined };
     }
     if (!isRecord(raw)) {
-        return invalid("`execution.terminal` must be an object ({ transport?, stdin? }).");
+        return invalid("`execution.terminal` must be an object ({ transport?, stdin?, doNotTrack? }).");
     }
     const terminal = {};
+    if (raw.doNotTrack !== undefined) {
+        if (typeof raw.doNotTrack !== "boolean") {
+            return invalid("`execution.terminal.doNotTrack` must be true or false (unquoted).");
+        }
+        terminal.doNotTrack = raw.doNotTrack;
+    }
     if (raw.transport !== undefined) {
         const transport = str(raw.transport);
         if (transport !== "exec-stream") {

package/dist/study/plan-types.d.ts

@@ -217,6 +217,7 @@ export type TerminalPlan = PlanBase & {
     readonly personaId?: string;
     readonly mission?: string;
     readonly runtime: {
+        readonly doNotTrack: boolean;
         readonly version?: string;
         /** Passed to Codex as `--model` on every run, so the bundle can name and price it. */
         readonly model: string;

package/dist/study/requirements.js

@@ -100,7 +100,8 @@ async function signedInAgentSuggestion(env) {
     if (ready.length === 0)
         return "";
     const labels = ready.map((agent) => agent.label).join(" and ");
-    return ` ${labels} reports authenticated on this machine. Set actor.type: local-agent to use ${ready.length === 1 ? "it" : "one"} instead of a key.`;
+    const one = ready.length === 1;
+    return ` ${labels} ${one ? "reports" : "report"} authenticated on this machine. Set actor.type: local-agent to use ${one ? "it" : "one"} instead of a key.`;
 }
 /**
  * Refuses a local-agent brain whose CLI is missing, signed out, too old, or cannot honor the

package/dist/study/types.d.ts

@@ -401,6 +401,8 @@ export interface StudyExecutionTerminal {
     transport?: StudyTerminalTransport;
     /** Operator stdin posture. Default "disabled". */
     stdin?: StudyTerminalStdin;
+    /** Send DO_NOT_TRACK=1 to participant commands by default; false leaves it unset. */
+    doNotTrack?: boolean;
 }
 /**
  * The terminal agent's runtime-auth channel. "openai-egress" (the default) keeps the raw runtime
@@ -511,7 +513,8 @@ export interface StudyExecution {
     };
     /**
      * `terminal-product` route: outbound routing allowlist passed to E2B with a deny-all fallback.
-     * Every other route leaves egress open and ignores it with a warning; 0.112.0 refuses it there.
+     * Every other route leaves egress open and ignores it with a warning;
+     * the first minor release on or after 2026-11-04 refuses it there.
      * Domain filtering is a routing control, not strict destination isolation on shared hosting.
      * It does not constrain spending through an allowed runtime provider, including when
      * openai-egress keeps the raw runtime key outside the sandbox.

package/dist/study/warnings.d.ts

@@ -14,7 +14,8 @@ export declare function inertFieldPaths(config: StudyConfig): string[];
  * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
  * study author would trust a list that blocks nothing. `humanish study check` and every run print
  * it, and the run records it in its bundle.
- * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ * Removed in the first minor release on or after 2026-11-04: deprecated on 2026-10-05. That release refuses the field off the terminal
+ * route.
  */
 export declare function egressAllowIgnoredWarning(config: StudyConfig): string | undefined;
 export declare function forwardDeclaredWarnings(config: StudyConfig): string[];

package/dist/study/warnings.js

@@ -270,12 +270,13 @@ export function inertFieldPaths(config) {
  * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
  * study author would trust a list that blocks nothing. `humanish study check` and every run print
  * it, and the run records it in its bundle.
- * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ * Removed in the first minor release on or after 2026-11-04: deprecated on 2026-10-05. That release refuses the field off the terminal
+ * route.
  */
 export function egressAllowIgnoredWarning(config) {
     if (config.execution?.egressAllow === undefined || config.route === "terminal")
         return undefined;
-    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: humanish 0.112.0 refuses it on every route except terminal.`;
+    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: the first minor release on or after 2026-11-04 refuses it on every route except terminal.`;
 }
 // Report fields that are present but not yet consumed by the engine, so a user never trusts a
 // setting that silently does nothing.