humanish 0.111.3 → 0.112.0

package/dist/routes/scripted/bundle.js

@@ -1,13 +1,13 @@
 // Assemble the scripted-browser study's run bundle from its sessions, and the review summary and
 // markdown that ship with it.
-import { verdictText } from "../../run/judge.js";
-import { reviewOutcome } from "../../run/display.js";
+import { renderReviewMarkdown } from "../../run/review-markdown.js";
 import { redactText } from "../../evidence/redaction.js";
 import { buildRunCostSummary, desktopSpanToMinutes, spendFreeCostSummary, } from "../../run/cost-summary.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/streams.js";
 import { participantEvent, recordIdOf } from "../../run/participant-records.js";
 import { scriptedSurfaceIds, scriptedSurfaceRecords } from "./surface-records.js";
+import { gapsListClause } from "../../run/outcomes.js";
 import { plural } from "../../run/text.js";
 /**
  * Project the scripted run into a humanish.run-bundle.v1 (no schema change: a new
@@ -146,7 +146,7 @@ function buildScriptedReview(args) {
         return {
             schema: REVIEW_SCHEMA,
             verdict: args.verdict,
-            summary: `The scripted run failed before a terminal session verdict: ${args.sessionError}`,
+            summary: `The run failed before the script finished: ${args.sessionError}`,
             gaps: [],
         };
     }
@@ -154,41 +154,31 @@ function buildScriptedReview(args) {
         return {
             schema: REVIEW_SCHEMA,
             verdict: args.verdict,
-            summary: `Dry run of scenario ${args.journey.scenarioId} (${args.scenarioSource}, ${args.journey.steps.length} steps) against ${args.appUrl}: composition and scenario checked at $0; no browser ran.`,
+            summary: `Dry run: scenario ${args.journey.scenarioId} (${args.scenarioSource}, ${args.journey.steps.length} steps) would replay against ${args.appUrl} on ${plural(args.surfaces.length, "browser surface")}. No browser ran and $0 was spent.`,
             gaps: ["Live scripted session not yet run (dry run only)."],
         };
     }
     const passed = args.sessionResults.filter((result) => result.status === "passed").length;
+    const ran = args.sessionResults.length;
     return {
         schema: REVIEW_SCHEMA,
         verdict: args.verdict,
-        summary: `Scripted-browser actor replayed ${args.journey.scenarioId} on ${args.sessionResults.length} surface${args.sessionResults.length === 1 ? "" : "s"} against ${args.appUrl}: ${passed}/${args.sessionResults.length} satisfied the scenario predicate.`,
+        summary: `Scenario ${args.journey.scenarioId} ran on ${plural(ran, "browser surface")} against ${args.appUrl}: ${passed}/${ran} passed it${gapsListClause(ran - passed, ran)}.`,
         gaps: args.sessionResults
             .filter((result) => result.status !== "passed")
             .map((result) => `${result.capture.surface.id}: ${result.reason}`),
     };
 }
-export function renderScriptedReviewMarkdown(bundle) {
+export function renderScriptedReviewMarkdown(bundle, status) {
     const subject = bundle.events.find((event) => event.type === "scripted-lab.subject.declared");
     const spend = bundle.events.find((event) => event.type === "scripted-lab.spend");
     const traces = bundle.streams
         .map((stream) => ({ stream, trace: stream.actor }))
         .filter((entry) => entry.trace !== undefined);
-    return [
-        `# ${bundle.scenario.title}`,
-        "",
-        `- run: ${bundle.runId}`,
-        `- mode: ${bundle.mode}`,
-        `- verdict: ${verdictText(bundle.review.verdict, bundle.mode)}`,
-        `- outcome: ${reviewOutcome(bundle)}`,
-        `- summary: ${bundle.review.summary}`,
+    return renderReviewMarkdown(bundle, [
         `- scenario: ${bundle.scenario.id} @ ${bundle.scenario.sourceDigest} (${bundle.scenario.source})`,
         ...(subject ? [`- subject: ${subject.message}`] : []),
         ...(spend ? [`- spend: ${spend.message}`] : []),
         ...traces.map(({ stream, trace }) => `- ${recordIdOf(stream)}: ${trace.provider} (${trace.lane}/${trace.protocol}) ${trace.status} (${trace.completionReason}); ${plural(trace.counts.actions ?? 0, "step action")}, ${plural(trace.counts.screenshots ?? 0, "raw screenshot")}`),
-        ...(bundle.review.gaps.length > 0
-            ? ["", "## Gaps", ...bundle.review.gaps.map((gap) => `- ${gap}`)]
-            : []),
-        "",
-    ].join("\n");
+    ], { status });
 }

package/dist/routes/scripted/route.js

@@ -121,6 +121,7 @@ async function runScriptedPlanInScope(plan, input, scope) {
                 persona: setup.persona,
                 timeoutMs: setup.timeoutMs,
                 artifactRoot,
+                scrubKnownValues: run.secrets.scrub,
             }, {
                 surfaces: setup.surfaces,
                 deps: setup.deps,

package/dist/routes/scripted/setup.js

@@ -5,6 +5,7 @@ import { realpath } from "node:fs/promises";
 import { firstLiveRefusal, keysCheck, subjectEnvCheck } from "../../study/requirements.js";
 import path from "node:path";
 import { resolveBrowserCommand } from "../../actors/scripted-browser/browser-command.js";
+import { publicSafeToken } from "../../actors/scripted-browser/journey.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import { RunSecrets } from "../../run/secrets.js";
 import { evidenceAppUrlOf } from "./plan.js";
@@ -26,7 +27,16 @@ export async function prepareScriptedRun(plan, input) {
     const deps = input.deps ?? {};
     const warnings = [];
     const clone = plan.subject.kind === "clone" ? plan.subject : undefined;
-    const evidenceAppUrl = evidenceAppUrlOf(plan.subject);
+    const subjectEnvNames = [...(clone?.env ?? [])];
+    const env = input.env ?? process.env;
+    const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
+    const secrets = new RunSecrets([
+        e2bApiKey,
+        ...(clone ? [clone.repo] : []),
+        ...subjectEnvNames.map((name) => env[name] ?? ""),
+    ]);
+    // An app-url run records the URL it was given, in the bundle and every summary.
+    const evidenceAppUrl = secrets.scrub(evidenceAppUrlOf(plan.subject));
     const failed = (code, message) => refusedResult("scripted", { studyId: plan.studyId, cwd, warnings, error: { code, message } }, {
         actor: plan.actor,
         appUrl: evidenceAppUrl,
@@ -37,16 +47,8 @@ export async function prepareScriptedRun(plan, input) {
     const urlPolicy = clone
         ? { kind: "provisioned-subject", evidenceOrigin: evidenceAppUrl }
         : { kind: "loopback" };
-    const subjectEnvNames = [...(clone?.env ?? [])];
-    const env = input.env ?? process.env;
-    const e2bApiKey = env.E2B_API_KEY?.trim() ?? "";
     const hasGithubToken = subjectEnvNames.includes("GITHUB_TOKEN");
     const redactRepoLabel = plan.residual.policies?.redactRepos ?? hasGithubToken;
-    const secrets = new RunSecrets([
-        e2bApiKey,
-        ...(clone ? [clone.repo] : []),
-        ...subjectEnvNames.map((name) => env[name] ?? ""),
-    ]);
     // A clone's URL is replaced by its getHost URL once it is served.
     let appUrl = plan.subject.kind === "clone" ? plan.subject.serve.url : plan.subject.appUrl;
     const scenario = await resolveScriptedScenario(projectRoot, plan.scenarioRef);
@@ -56,7 +58,17 @@ export async function prepareScriptedRun(plan, input) {
             result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", scenario.message),
         };
     }
-    const journey = scenario.journey;
+    // The goal, title and step labels are recorded; a step's path, selector, value and expected text
+    // drive the browser and stay as written.
+    const journey = {
+        ...scenario.journey,
+        scenarioId: idHoldsKnownValue(scenario.journey.scenarioId, secrets)
+            ? "scenario"
+            : scenario.journey.scenarioId,
+        goal: secrets.scrub(scenario.journey.goal),
+        scenarioTitle: secrets.scrub(scenario.journey.scenarioTitle),
+        steps: recordedStepIds(scenario.journey.steps, secrets),
+    };
     // The plan lists E2B_API_KEY and the subject env only for a live clone.
     const { requirements } = plan;
     const refusal = await firstLiveRefusal([
@@ -118,3 +130,34 @@ export async function prepareScriptedRun(plan, input) {
         },
     };
 }
+/**
+ * Whether an id holds a known value as written or as the parser's id token of it, lower-cased with
+ * other characters as `-`, which the scrub would not find.
+ */
+function idHoldsKnownValue(id, secrets) {
+    return (secrets.scrub(id) !== id ||
+        secrets.values().some((value) => {
+            const token = publicSafeToken(value, "");
+            return token.length > 0 && id.includes(token);
+        }));
+}
+/**
+ * The steps with their labels scrubbed and their ids safe to record. A step id names the step's
+ * screenshot file and is recorded beside it, and the parser derives an omitted id from the label,
+ * lower-cased and cut to 80 characters, so the scrub may not find a value in it. A step whose
+ * label or id holds a known value is renamed by its position instead.
+ */
+function recordedStepIds(steps, secrets) {
+    const taken = new Set(steps.map((step) => step.id));
+    return steps.map((step, index) => {
+        const label = secrets.scrub(step.label);
+        if (label === step.label && !idHoldsKnownValue(step.id, secrets))
+            return { ...step, label };
+        const position = `step-${String(index + 1).padStart(2, "0")}`;
+        let id = position;
+        for (let suffix = 2; taken.has(id); suffix += 1)
+            id = `${position}-${suffix}`;
+        taken.add(id);
+        return { ...step, id, label };
+    });
+}

package/dist/routes/scripted/surface-records.d.ts

@@ -6,7 +6,6 @@ import { type ParticipantIds } from "../../run/participant-records.js";
 import type { RunStream } from "../../run/streams.js";
 /** What each surface's records read from the bundle arguments. */
 export interface ScriptedSurfaceContext {
-    actorId: string;
     appUrl: string;
     createdAt: string;
     journey: BrowserPersonaJourney;

package/dist/routes/scripted/surface-records.js

@@ -1,5 +1,7 @@
-// One scripted-browser surface's simulation and stream in the run bundle.
+import { judgeParticipantRecords } from "../../run/judge.js";
 import { participantIdsOf, participantRecord, participantStream, } from "../../run/participant-records.js";
+import { participantCaption } from "../../run/participant-caption.js";
+import { sessionEndingInWords } from "../../run/outcomes.js";
 /** A surface's saved ids: `scripted-<surface>` and its `-stream`. */
 export function scriptedSurfaceIds(surfaceId) {
     return participantIdsOf(`scripted-${surfaceId}`, `scripted-${surfaceId}-stream`);
@@ -11,14 +13,23 @@ export function scriptedSurfaceIds(surfaceId) {
 export function scriptedSurfaceRecords(context, surface, index, result, screenshots) {
     const ids = scriptedSurfaceIds(surface.id);
     const lastScreenshot = screenshots.at(-1);
-    const status = result
-        ? result.status
-        : context.sessionError !== undefined
-            ? "failed"
-            : "contract_proof_only";
-    const reason = result?.reason ??
-        context.sessionError ??
-        "Dry run: the scenario was pinned without launching a browser or touching the subject app.";
+    const { status, reason } = judgeParticipantRecords([
+        {
+            ...(result === undefined
+                ? {}
+                : {
+                    status: result.status,
+                    completionReason: result.completionReason,
+                    reason: result.reason,
+                }),
+            ...(context.sessionError === undefined ? {} : { sessionError: context.sessionError }),
+            skipped: false,
+            noEngagement: false,
+            selfReportedBlocker: false,
+        },
+    ], {
+        contractReason: "Dry run: the scenario was pinned without launching a browser or touching the subject app.",
+    }).participants[0];
     const simulation = participantRecord(ids, index + 1, {
         personaId: context.persona.id,
         scenarioId: context.journey.scenarioId,
@@ -28,16 +39,19 @@ export function scriptedSurfaceRecords(context, surface, index, result, screensh
         progress: 100,
         currentStep: reason,
         summary: result
-            ? `Scripted-browser actor (${context.actorId}) replayed ${context.journey.scenarioId} on the ${surface.id} surface; ${result.completionReason}.`
+            ? `Scenario ${context.journey.scenarioId} ran in the ${surface.id} browser and ${sessionEndingInWords(result.trace)}.`
             : context.sessionError !== undefined
-                ? `The scripted run failed before a terminal session verdict: ${context.sessionError}`
-                : `Scripted-browser actor (${context.actorId}) against ${context.appUrl}; no session ran.`,
+                ? `The run failed before the script finished: ${context.sessionError}`
+                : `Scenario ${context.journey.scenarioId} would replay in the ${surface.id} browser against ${context.appUrl}; no browser ran.`,
         startedAt: context.createdAt,
         updatedAt: result?.capture.capturedAt ?? context.createdAt,
     });
     const stream = participantStream(ids, {
         kind: "browser",
-        label: `${surface.label} · ${context.studyId}`,
+        label: participantCaption({
+            personaId: context.persona.id,
+            device: { name: surface.id, preset: { isMobile: surface.viewport.isMobile } },
+        }),
         status,
         transport: "snapshot",
         updatedAt: result?.capture.capturedAt ?? context.createdAt,

package/dist/routes/scripted/surface-sessions.d.ts

@@ -3,7 +3,7 @@ import type { ScriptedPlan } from "../../study/plan-types.js";
 import { type PreparedRunArtifactPaths } from "../../run/paths.js";
 import type { StudyDeps } from "../../study/study-deps.js";
 /** One session per surface, in parallel. */
-export declare function runScriptedSessions(session: Required<Pick<ScriptedBrowserSessionOptions, "appUrl" | "evidenceAppUrl" | "urlPolicy" | "journey" | "persona" | "timeoutMs" | "artifactRoot">>, run: {
+export declare function runScriptedSessions(session: Required<Pick<ScriptedBrowserSessionOptions, "appUrl" | "evidenceAppUrl" | "urlPolicy" | "journey" | "persona" | "timeoutMs" | "artifactRoot" | "scrubKnownValues">>, run: {
     surfaces: ScriptedPlan["surfaces"];
     deps: StudyDeps;
     browserCommand: string | undefined;

package/dist/routes/scripted/surface-sessions.js

@@ -7,6 +7,7 @@ import { validateScriptedSessionResult } from "./session-result.js";
 /** One session per surface, in parallel. */
 export function runScriptedSessions(session, run) {
     const { appUrl, evidenceAppUrl, urlPolicy, journey, persona, timeoutMs, artifactRoot } = session;
+    const { scrubKnownValues } = session;
     const { surfaces, deps, browserCommand, runPaths, onSessionStart } = run;
     const runSession = deps.runScriptedSession;
     return Promise.all(surfaces.map((surface) => {
@@ -20,6 +21,7 @@ export function runScriptedSessions(session, run) {
             persona,
             timeoutMs,
             artifactRoot,
+            scrubKnownValues,
             ...(browserCommand === undefined ? {} : { browserCommand }),
             ...(deps.launchBrowser === undefined ? {} : { launchBrowser: deps.launchBrowser }),
             ...(deps.now === undefined ? {} : { now: deps.now }),

package/dist/routes/shared-world/bundle-records.d.ts

@@ -1,14 +1,14 @@
 import type { RunEvent, RunSimulation } from "../../run/bundle.js";
+import type { judgeParticipantRecords } from "../../run/judge.js";
 import type { RunStream } from "../../run/streams.js";
 import type { DesktopParticipantRun } from "../computer-use/types.js";
 import type { ConcurrentBundleArgs } from "./types.js";
 /** What every participant's records share. */
 export interface SharedWorldRecordContext {
     args: ConcurrentBundleArgs;
+    participants: ReturnType<typeof judgeParticipantRecords>["participants"];
     external: boolean;
     inProgress: boolean;
-    /** The public-safe plane label: never the raw getHost URL or public origin. */
-    appUrl: string;
     /** Numbers events in the order they are pushed. */
     nextEventId: (suffix: string) => string;
 }

package/dist/routes/shared-world/bundle-records.js

@@ -3,14 +3,13 @@
 // running).
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { participantEvent, participantRecord, participantStream, } from "../../run/participant-records.js";
-import { judgedStatus } from "../../run/judge.js";
 import { declaredScreenForRender } from "../../substrates/e2b/desktop-geometry.js";
-import { participantFactsOf } from "../computer-use/participant-facts.js";
 import { publicSafeRouteLabel } from "./provenance.js";
-import { participantTaxonomyLabel } from "./participant-specs.js";
+import { participantCaption } from "../../run/participant-caption.js";
+import { sessionEndingInWords } from "../../run/outcomes.js";
 function participantView(ctx, spec, index) {
-    const { args, external, inProgress } = ctx;
-    const taxonomy = participantTaxonomyLabel(spec.planned.labels);
+    const { args, external } = ctx;
+    const name = participantCaption({ id: spec.planned.id, personaId: spec.persona.id });
     const result = args.actorResults[index];
     const outcome = result?.outcome;
     const session = outcome?.session;
@@ -21,18 +20,8 @@ function participantView(ctx, spec, index) {
     const route = external
         ? "[external-public-plane]"
         : publicSafeRouteLabel(args.plan.plane.participants[index]?.entry);
-    const status = session
-        ? session.status
-        : outcome?.sessionError !== undefined
-            ? "failed"
-            : inProgress
-                ? "running"
-                : "contract_proof_only";
-    const reason = session?.reason ??
-        outcome?.sessionError ??
-        (inProgress
-            ? "Actor desktop is running; the attached Observer hydrates the runtime stream URL without persisting it."
-            : "Dry run: the evidence shape was written without launching a desktop or spending provider tokens.");
+    const judgment = ctx.participants[index];
+    const { status, reason } = judgment;
     const traceScreenshotMode = session?.trace.redaction.screenshots;
     // Include `declared` on the no-outcome fallback too (dry-run, skipped participant): otherwise an
     // absent `declared` means either "the preset rendered faithfully" or "there was no live
@@ -53,7 +42,8 @@ function participantView(ctx, spec, index) {
             ? "blurred"
             : "raw";
     return {
-        taxonomy,
+        name,
+        judgment,
         outcome,
         session,
         screenshots,
@@ -67,7 +57,7 @@ function participantView(ctx, spec, index) {
 }
 function sharedWorldSimulation(ctx, spec, index, view) {
     const { args, inProgress } = ctx;
-    const { taxonomy, outcome, session } = view;
+    const { name, outcome, session } = view;
     return participantRecord(spec, index + 1, {
         personaId: spec.persona.id,
         scenarioId: `concurrent-shared-world-${args.plan.studyId}`,
@@ -77,27 +67,30 @@ function sharedWorldSimulation(ctx, spec, index, view) {
         progress: inProgress ? 35 : 100,
         currentStep: view.reason,
         summary: session
-            ? `Persona ${spec.planned.id}${taxonomy} (${spec.persona.id}): drove the shared plane concurrently; ${session.completionReason}.`
+            ? `${name} used the shared app and ${sessionEndingInWords(session.trace)}.`
             : outcome?.sessionError !== undefined
-                ? `Persona ${spec.planned.id}${taxonomy} failed before a terminal session verdict: ${outcome.sessionError}`
+                ? `${name} did not finish a session: ${outcome.sessionError}`
                 : inProgress
-                    ? `Persona ${spec.planned.id}${taxonomy} (${spec.persona.id}) is running against the shared plane.`
-                    : `Persona ${spec.planned.id}${taxonomy} (${spec.persona.id}) for ${args.descriptor.id} against the shared plane at ${ctx.appUrl}; no session ran.`,
+                    ? `${name} is using the shared app.`
+                    : `${name} would use the shared app; no session ran.`,
         startedAt: args.run.createdAt,
         updatedAt: args.run.createdAt,
     });
 }
 function sharedWorldStream(ctx, spec, index, view) {
     const { args } = ctx;
-    const { taxonomy, session, screenshots, lastScreenshot, desktopGeometry, screenshotMode } = view;
-    // The judge's status for the participant, so the Observer shows it the way the verdict judged it.
-    const judged = view.outcome === undefined ? undefined : judgedStatus(participantFactsOf(view.outcome));
+    const { name, session, screenshots, lastScreenshot, desktopGeometry, screenshotMode } = view;
+    const judged = view.judgment.judgedStatus;
     return participantStream(spec, {
         ...(spec.evidenceAssignment === undefined
             ? {}
             : { assignment: participantAssignment(spec.evidenceAssignment) }),
         kind: "browser",
-        label: `Concurrent persona ${spec.planned.id}${taxonomy} · ${args.plan.studyId}`,
+        label: participantCaption({
+            id: spec.planned.id,
+            personaId: spec.persona.id,
+            device: spec.planned.device,
+        }),
         status: view.status,
         ...(judged === undefined ? {} : { judgedStatus: judged }),
         transport: "snapshot",
@@ -122,7 +115,7 @@ function sharedWorldStream(ctx, spec, index, view) {
         desktopGeometry,
         ui: {
             route: view.route,
-            intent: `Watch persona ${spec.planned.id}${taxonomy} (${spec.persona.id}) use the shared app at the same time as the other personas.`,
+            intent: `Watch ${name} use the shared app at the same time as the others.`,
             state: view.reason,
             ...(session ? { actorStatus: session.status } : {}),
             ...(lastScreenshot ? { screenshotUrl: lastScreenshot } : {}),

package/dist/routes/shared-world/bundle.d.ts

@@ -17,4 +17,4 @@ export declare function judgeSharedWorldRun(args: Omit<ConcurrentBundleArgs, "ju
 export declare function actorRunPassed(result: ActorRunResult | undefined): boolean;
 /** Project the concurrent run into a humanish.run-bundle.v1 with the concurrent shared-world block. */
 export declare function buildConcurrentSharedWorldBundle(args: ConcurrentBundleArgs): RunBundle;
-export declare function renderConcurrentReviewMarkdown(bundle: RunBundle): string;
+export declare function renderConcurrentReviewMarkdown(bundle: RunBundle, status?: unknown): string;