humanish 0.111.4 → 0.112.0

package/dist/run/transient-comms-secrets.d.ts

@@ -4,7 +4,12 @@ export declare function registerTransientCommsSecrets(values: string[]): void;
 /** Literal, longest-first replacement in one pass; replacement text is never matched recursively. */
 export declare function scrubTransientCommsText(text: string): string;
 /**
- * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
- * base64-encoded and returns decoded text. Outside a scope it changes nothing.
+ * A scrub for text a model writes: each scope value as written and in its encoded forms
+ * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
+ * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
+ * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
+ * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
+ * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
+ * changes nothing.
  */
-export declare function transientCommsEncodedScrub(): (text: string) => string;
+export declare function transientCommsKnownValueScrub(): (text: string) => string;

package/dist/run/transient-comms-secrets.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { decodeEscapes } from "../evidence/encoded-text.js";
 import { scrubSecretValues } from "../evidence/secret-scrub.js";
 import { escapeRegExp } from "./text.js";
 const scopes = new AsyncLocalStorage();
@@ -75,10 +76,29 @@ export function scrubTransientCommsText(text) {
  * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
  * base64-encoded and returns decoded text. Outside a scope it changes nothing.
  */
-export function transientCommsEncodedScrub() {
+function transientCommsEncodedScrub() {
     const scope = scopes.getStore();
     if (!scope)
         return (text) => text;
     usable(scope);
     return scrubSecretValues([...scope.values]);
 }
+const REDACTED = "[REDACTED_SECRET]";
+const markers = (text) => text.split(REDACTED).length - 1;
+/**
+ * A scrub for text a model writes: each scope value as written and in its encoded forms
+ * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
+ * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
+ * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
+ * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
+ * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
+ * changes nothing.
+ */
+export function transientCommsKnownValueScrub() {
+    const encoded = transientCommsEncodedScrub();
+    return (text) => {
+        const literal = scrubTransientCommsText(text);
+        const found = encoded(literal);
+        return scrubTransientCommsText(markers(found) > markers(decodeEscapes(literal)) ? found : literal);
+    };
+}

package/dist/study/keys.d.ts

@@ -168,6 +168,7 @@ export declare const EXECUTION: {
     terminal: {
         stdin: true;
         transport: true;
+        doNotTrack: true;
     };
     desktop: {
         template: true;

package/dist/study/keys.js

@@ -108,7 +108,7 @@ export const EXECUTION = {
     timeoutMs: true,
     completionTimeoutMs: true,
     egressAllow: true,
-    terminal: { stdin: true, transport: true },
+    terminal: { stdin: true, transport: true, doNotTrack: true },
     desktop: {
         template: true,
         browser: true,

package/dist/study/parse/execution.js

@@ -75,9 +75,15 @@ function parseTerminal(raw) {
         return { ok: true, value: undefined };
     }
     if (!isRecord(raw)) {
-        return invalid("`execution.terminal` must be an object ({ transport?, stdin? }).");
+        return invalid("`execution.terminal` must be an object ({ transport?, stdin?, doNotTrack? }).");
     }
     const terminal = {};
+    if (raw.doNotTrack !== undefined) {
+        if (typeof raw.doNotTrack !== "boolean") {
+            return invalid("`execution.terminal.doNotTrack` must be true or false (unquoted).");
+        }
+        terminal.doNotTrack = raw.doNotTrack;
+    }
     if (raw.transport !== undefined) {
         const transport = str(raw.transport);
         if (transport !== "exec-stream") {

package/dist/study/plan-types.d.ts

@@ -217,6 +217,7 @@ export type TerminalPlan = PlanBase & {
     readonly personaId?: string;
     readonly mission?: string;
     readonly runtime: {
+        readonly doNotTrack: boolean;
         readonly version?: string;
         /** Passed to Codex as `--model` on every run, so the bundle can name and price it. */
         readonly model: string;

package/dist/study/types.d.ts

@@ -401,6 +401,8 @@ export interface StudyExecutionTerminal {
     transport?: StudyTerminalTransport;
     /** Operator stdin posture. Default "disabled". */
     stdin?: StudyTerminalStdin;
+    /** Send DO_NOT_TRACK=1 to participant commands by default; false leaves it unset. */
+    doNotTrack?: boolean;
 }
 /**
  * The terminal agent's runtime-auth channel. "openai-egress" (the default) keeps the raw runtime
@@ -511,7 +513,8 @@ export interface StudyExecution {
     };
     /**
      * `terminal-product` route: outbound routing allowlist passed to E2B with a deny-all fallback.
-     * Every other route leaves egress open and ignores it with a warning; 0.112.0 refuses it there.
+     * Every other route leaves egress open and ignores it with a warning;
+     * the first minor release on or after 2026-11-04 refuses it there.
      * Domain filtering is a routing control, not strict destination isolation on shared hosting.
      * It does not constrain spending through an allowed runtime provider, including when
      * openai-egress keeps the raw runtime key outside the sandbox.

package/dist/study/warnings.d.ts

@@ -14,7 +14,8 @@ export declare function inertFieldPaths(config: StudyConfig): string[];
  * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
  * study author would trust a list that blocks nothing. `humanish study check` and every run print
  * it, and the run records it in its bundle.
- * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ * Removed in the first minor release on or after 2026-11-04: deprecated on 2026-10-05. That release refuses the field off the terminal
+ * route.
  */
 export declare function egressAllowIgnoredWarning(config: StudyConfig): string | undefined;
 export declare function forwardDeclaredWarnings(config: StudyConfig): string[];

package/dist/study/warnings.js

@@ -270,12 +270,13 @@ export function inertFieldPaths(config) {
  * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
  * study author would trust a list that blocks nothing. `humanish study check` and every run print
  * it, and the run records it in its bundle.
- * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ * Removed in the first minor release on or after 2026-11-04: deprecated on 2026-10-05. That release refuses the field off the terminal
+ * route.
  */
 export function egressAllowIgnoredWarning(config) {
     if (config.execution?.egressAllow === undefined || config.route === "terminal")
         return undefined;
-    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: humanish 0.112.0 refuses it on every route except terminal.`;
+    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: the first minor release on or after 2026-11-04 refuses it on every route except terminal.`;
 }
 // Report fields that are present but not yet consumed by the engine, so a user never trusts a
 // setting that silently does nothing.