humanish 0.114.0 → 0.116.0

package/CHANGELOG.md

@@ -8,6 +8,47 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.116.0: Hosted keyboard input, E2B sandbox ceiling, bounded run reads, run header, TUI live starts (2026-10-09)
+
+humanish 0.116.0 delivers a hosted participant's arrow keys and punctuation, lets the operator
+raise the E2B sandbox lifetime, and reads run files within size limits. On hosted E2B desktops,
+`ARROWDOWN`, Page Up, Page Down, `?`, `/` and other names missing from `@e2b/desktop`'s key table
+reached xdotool unchanged, which ignored them while the run recorded the keypress as completed;
+both desktops now translate key names through one table and refuse a name outside it.
+`HUMANISH_E2B_MAX_SANDBOX_MINUTES` sets the longest sandbox lifetime the planners allow, 60 minutes
+when unset and up to 1440 on E2B's Pro plan. A refusal names the value that admits the study, and
+`humanish doctor` shows the ceiling. A route's sandbox kill, and the kills, checks and listings of
+`humanish reclaim`, carry the run's E2B key. `verify` reads at most 32 MiB of a run file and lists
+a larger file, or a run past 10,000 entries, as unscanned, and every contained read tells a missing
+file from one it refused. A run whose analysis did not complete reads `live run finished; the
+analysis did not complete`, a run refused before it was created prints no `analysis:` line, and a
+`desktop-cli` run names its product on the `subject:` line and in run.json. In `humanish tui`, the
+cursor follows the selected row through a refresh, a live start of a `mode: dry-run` file says
+`needs mode: live`, Run again on a live run asks for a second Enter, the confirm prompt restates
+the study's cost, and `c` lists every provider key. `NO_UPDATE_NOTIFIER` turns the update check
+off.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.116.0)
+
+## 0.115.0: Closing report limits, admitted analysis cost, concurrent reviewer notes, known-value scrub (2026-10-08)
+
+humanish 0.115.0 asks the OpenAI computer-use participant for its closing report and impressions
+within the limits its reply is checked against, keeps every reviewer note added at the same time,
+and finds more encoded forms of a registered secret. The participant's request schema now carries
+the limits the parser already enforced: a summary of up to 4,000 characters, up to 8 friction
+reports of up to 2,000 characters and up to 6 impressions of up to 500 characters, so a longer
+reply is no longer requested and then dropped. `analyze --json` adds `admission.admittedCostUsd`,
+the smallest `--max-cost` that admits the analysis, and `humanish analyze` names its refusal
+command as `npx humanish analyze` where humanish is a dev dependency. A reviewer note is created
+under its own name, so notes added together from the Observer and `humanish notes --add` are all
+kept. `export --local-only` keeps a `blocked` run `blocked` when its analysis fails the export's
+own check. The known-value scrub exempts only the markers humanish writes, reads text in the same
+five ways as `verify`, and finds a value that overlaps itself in time linear in the text. The TUI's
+study screen shows the expected analysis cost line that `study check` prints, telemetry reads
+`CI=false` as off, and `humanish keys set constructor` is refused with the list of provider keys.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.115.0)
+
 ## 0.114.0: Reviewer notes, expected analysis cost, percent-encoded UTF-8 in verify (2026-10-08)
 
 humanish 0.114.0 lets a reviewer note a moment of a recorded run, admits post-run analysis on its

package/CONTEXT.md

@@ -41,7 +41,7 @@ bundle and output fields keep older spellings; the second table maps them.
 | analysis            | An independent model reading of a finished run's retained evidence, kept apart from participant feedback. Supported live runs request it automatically, and `humanish analyze` runs it on demand. It records findings and observations as `humanish.study-analysis.v1`.                                                                                                                                                                                                                                                               | `src/analysis/`; `runAutomaticAnalysis` in `src/analysis/automatic.ts`; `analyzeRun` in `src/analysis/service.ts`; `ANALYSIS_SCHEMA` in `src/analysis/types.ts`                                                                                                                                                                                                                                             |
 | finding             | A result of analysis, with citations to evidence in the run. Each finding groups the observations that support it.                                                                                                                                                                                                                                                                                                                                                                                                                    | `src/analysis/`                                                                                                                                                                                                                                                                                                                                                                                             |
 | observation         | One claim in analysis with its basis, evidence ids and limitation. `concernReviews[]` gives each material concern's observation a disposition: `finding`, `context` or `unsupported`.                                                                                                                                                                                                                                                                                                                                                 | `src/analysis/`                                                                                                                                                                                                                                                                                                                                                                                             |
-| reviewer note       | Free text a person adds at a moment of a recorded run, for one participant or the whole run, kept in the run directory as its own file, `notes/<id>.json` (`humanish.run-note.v1`). It is not participant feedback or analysis. `humanish notes` and an Observer served on loopback add notes.                                                                                                                                                                                                                                        | `addRunNote` in `src/run/notes.ts`; `readRunNotes` in `src/run/note-files.ts`; `createNotesWriter` in `src/observer/notes-route.ts`                                                                                                                                                                                                                                                                         |
+| reviewer note       | Free text a person adds at a moment of a recorded run, for one participant or the whole run, kept in the run directory as its own file, `notes/<id>.json` (`humanish.run-note.v1`). It is not participant feedback or analysis. `humanish notes` and an Observer served on loopback add notes.                                                                                                                                                                                                                                        | `RunNote` and its limits in `src/run/note-shape.ts`; `addRunNote` in `src/run/notes.ts`; `readRunNotes` in `src/run/note-files.ts`; `createNotesWriter` in `src/observer/notes-route.ts`                                                                                                                                                                                                                    |
 
 ## Read these field spellings as the concept they name
 

package/README.md

@@ -276,9 +276,10 @@ sensitive to capture in the first place.
 **What the automated gate enforces.** `humanish verify` scans public-bound
 artifacts and fails closed on secret, key, and token shapes and on known local
 path shapes. It reads text only, judged by a file's bytes rather than its name:
-any file in the run folder that is not UTF-8 text, other than a stream
-screenshot or recording, keeps the run `local_only` (`UNSCANNED_ARTIFACT`). It
-matches after undoing escapes, percent-encoding, HTML entities and base64. It
+any file in the run folder that is not UTF-8 text or is larger than 32 MiB,
+other than a stream screenshot or recording, keeps the run `local_only`
+(`UNSCANNED_ARTIFACT`). It matches after undoing escapes, percent-encoding, HTML
+entities and base64. It
 does not yet detect free-form PII or PHI such as names, emails,
 phone numbers, dates of birth, or medical identifiers. Keeping those out depends
 on using synthetic data and on review, so `redaction: passed` means the
@@ -483,9 +484,9 @@ At most once a day, a command run at a terminal also asks the npm registry for
 the latest humanish version, and a later command prints one line on stderr when
 yours is older. That request is a plain `GET` of humanish's dist-tags with no
 machine id, version, command or path. It is skipped in CI, without a terminal,
-for `--json`, and with `DO_NOT_TRACK=1`, `HUMANISH_TELEMETRY_DISABLED=1` or
-`HUMANISH_NO_UPDATE_CHECK=1`. [TELEMETRY.md](TELEMETRY.md#the-update-check)
-describes it.
+for `--json`, and with `DO_NOT_TRACK=1`, `HUMANISH_TELEMETRY_DISABLED=1`,
+`HUMANISH_NO_UPDATE_CHECK=1` or update-notifier's `NO_UPDATE_NOTIFIER=1`.
+[TELEMETRY.md](TELEMETRY.md#the-update-check) describes it.
 
 ## Contribute
 

package/TELEMETRY.md

@@ -132,4 +132,10 @@ participant, and when any of these is set:
 DO_NOT_TRACK=1
 HUMANISH_TELEMETRY_DISABLED=1
 HUMANISH_NO_UPDATE_CHECK=1
+NO_UPDATE_NOTIFIER=1
 ```
+
+`NO_UPDATE_NOTIFIER` is the variable the update-notifier package reads, so a
+machine set up to silence the CLIs built on it gets no humanish notice either.
+humanish reads it as update-notifier does: any value turns the check off,
+including an empty one, `0` or `false`.

package/dist/actors/closing-report-limits.d.ts

@@ -0,0 +1,11 @@
+/**
+ * How much a participant's closing report may hold. Participants are asked for no more, and a
+ * reply that holds more is rejected. Characters are counted as `String.length` counts them.
+ */
+export declare const CLOSING_REPORT_LIMITS: Readonly<{
+    summaryChars: 4000;
+    frictionReports: 8;
+    frictionReportChars: 2000;
+    impressions: 6;
+    impressionChars: 500;
+}>;

package/dist/actors/closing-report-limits.js

@@ -0,0 +1,13 @@
+// The closing report's limits, kept apart from its zod schema in closing-report.ts so the
+// Observer can read them: it bundles this module, and zod stays out of its page.
+/**
+ * How much a participant's closing report may hold. Participants are asked for no more, and a
+ * reply that holds more is rejected. Characters are counted as `String.length` counts them.
+ */
+export const CLOSING_REPORT_LIMITS = Object.freeze({
+    summaryChars: 4000,
+    frictionReports: 8,
+    frictionReportChars: 2000,
+    impressions: 6,
+    impressionChars: 500,
+});

package/dist/actors/closing-report.d.ts

@@ -0,0 +1,68 @@
+import { z } from "zod";
+declare const impressionSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        liked: "liked";
+        missing: "missing";
+        unclear: "unclear";
+        unfinished: "unfinished";
+        unlike_my_work: "unlike_my_work";
+        untrustworthy: "untrustworthy";
+    }>;
+    text: z.ZodString;
+}, z.core.$strict>;
+/** The impressions a participant gave; an empty list means it had none. */
+export declare const participantImpressionsSchema: z.ZodArray<z.ZodObject<{
+    kind: z.ZodEnum<{
+        liked: "liked";
+        missing: "missing";
+        unclear: "unclear";
+        unfinished: "unfinished";
+        unlike_my_work: "unlike_my_work";
+        untrustworthy: "untrustworthy";
+    }>;
+    text: z.ZodString;
+}, z.core.$strict>>;
+/**
+ * A closing report. A report without impressions is still valid: third-party provider ports and
+ * stored traces do not have them.
+ */
+export declare const closingReportSchema: z.ZodObject<{
+    summary: z.ZodString;
+    frictionReports: z.ZodArray<z.ZodString>;
+    impressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            liked: "liked";
+            missing: "missing";
+            unclear: "unclear";
+            unfinished: "unfinished";
+            unlike_my_work: "unlike_my_work";
+            untrustworthy: "untrustworthy";
+        }>;
+        text: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+/** The reply to an impressions-only request: the impressions and nothing else. */
+export declare const impressionsReplySchema: z.ZodObject<{
+    impressions: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            liked: "liked";
+            missing: "missing";
+            unclear: "unclear";
+            unfinished: "unfinished";
+            unlike_my_work: "unlike_my_work";
+            untrustworthy: "untrustworthy";
+        }>;
+        text: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** The participant's account, not an independently confirmed product diagnosis. */
+export type ParticipantClosingReport = z.infer<typeof closingReportSchema>;
+/** One first-person impression about something the participant saw in the session. */
+export type ParticipantImpression = z.infer<typeof impressionSchema>;
+/**
+ * The JSON Schema a strict structured-output request sends for `schema`. Strict mode needs every
+ * field, so optional ones become required. `$schema` is left out, so the request carries only
+ * keywords both providers' strict modes are known to accept.
+ */
+export declare function strictOutputSchema(schema: z.ZodObject): Record<string, unknown>;
+export {};

package/dist/actors/closing-report.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+import { CLOSING_REPORT_LIMITS as LIMITS } from "./closing-report-limits.js";
+// What a participant says at the end of a session: the closing report and its impressions. This
+// schema is the one description of them. The providers send the JSON Schema made from it, and
+// every reply is parsed with it, so a participant is asked for exactly what is accepted.
+/**
+ * What a participant can say about the product at the end of a session, beyond friction.
+ * `unlike_my_work` compares the screen with how the persona does the same task in its own work or
+ * life.
+ */
+const PARTICIPANT_IMPRESSION_KINDS = [
+    "unclear",
+    "unfinished",
+    "untrustworthy",
+    "liked",
+    "missing",
+    "unlike_my_work",
+];
+/**
+ * Text the participant wrote. The JSON Schema carries the length limits; the check that it is not
+ * only whitespace runs on the reply.
+ */
+const said = (maxChars) => z
+    .string()
+    .min(1)
+    .max(maxChars)
+    .refine((text) => text.trim() !== "");
+const impressionSchema = z.strictObject({
+    kind: z.enum(PARTICIPANT_IMPRESSION_KINDS),
+    text: said(LIMITS.impressionChars),
+});
+/** The impressions a participant gave; an empty list means it had none. */
+export const participantImpressionsSchema = z.array(impressionSchema).max(LIMITS.impressions);
+/**
+ * A closing report. A report without impressions is still valid: third-party provider ports and
+ * stored traces do not have them.
+ */
+export const closingReportSchema = z.strictObject({
+    summary: said(LIMITS.summaryChars),
+    frictionReports: z.array(said(LIMITS.frictionReportChars)).max(LIMITS.frictionReports),
+    impressions: participantImpressionsSchema.optional(),
+});
+/** The reply to an impressions-only request: the impressions and nothing else. */
+export const impressionsReplySchema = z.strictObject({
+    impressions: participantImpressionsSchema,
+});
+/**
+ * The JSON Schema a strict structured-output request sends for `schema`. Strict mode needs every
+ * field, so optional ones become required. `$schema` is left out, so the request carries only
+ * keywords both providers' strict modes are known to accept.
+ */
+export function strictOutputSchema(schema) {
+    const { $schema: _dialect, ...json } = z.toJSONSchema(schema.required(), { io: "input" });
+    return json;
+}

package/dist/actors/codex/app-server-ui.js

@@ -2,7 +2,7 @@ import { createServer } from "node:http";
 import path from "node:path";
 import { digestText } from "../../evidence/redaction.js";
 import { CODEX_APP_SERVER_ARTIFACTS, CODEX_APP_SERVER_DIRECTORY, runCodexAppServerSessionInPreparedRoot, } from "./app-server.js";
-import { prepareContainedOutputDirectory, prepareContainedOutputFile, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, prepareSelectedOutputFile, readContainedRegularFile, writeContainedOutputFile, writePreparedSelectedOutputFile, } from "../../run/contained-output.js";
+import { prepareContainedOutputDirectory, prepareContainedOutputFile, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, prepareSelectedOutputFile, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, writePreparedSelectedOutputFile, } from "../../run/contained-output.js";
 const CODEX_APP_SERVER_UI_SCHEMA = "humanish.codex-app-server-ui.v1";
 export async function startCodexAppServerUi(options) {
     const cwd = path.resolve(options.cwd);
@@ -128,13 +128,20 @@ export async function startCodexAppServerUi(options) {
     };
 }
 async function serveArtifact(args) {
-    const body = await readContainedRegularFile(args.runRoot, args.requestPath);
-    if (body) {
+    const read = await readContainedRegularFile(args.runRoot, args.requestPath, RUN_ARTIFACT_MAX_BYTES);
+    if (read.status === "read") {
         args.response.writeHead(200, {
             "cache-control": "no-store",
             "content-type": contentTypeFor(args.requestPath),
         });
-        args.response.end(body);
+        args.response.end(read.bytes);
+        return;
+    }
+    // A file over the limit is there: a 404 would tell the page it does not exist. A link, or a
+    // path outside the run, is served as absent, as it always was.
+    if (read.status === "refused" && read.reason === "too-large") {
+        args.response.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+        args.response.end(`${refusalText(args.requestPath, read)}.`);
         return;
     }
     args.response.writeHead(404);

package/dist/actors/codex/restricted-participant-policy.d.ts

@@ -1,5 +1,6 @@
-import { type CuaTurn } from "../computer-use/loop.js";
-import { type ActorExecutionProfile, type ParticipantClosingReport } from "../contract.js";
+import { type ParticipantClosingReport } from "../closing-report.js";
+import type { CuaTurn } from "../computer-use/loop.js";
+import type { ActorExecutionProfile } from "../contract.js";
 /** The declared profile. A participant replaces cliVersion with its detected CLI release, or with
  * this host's newest qualified release before its first launch. */
 export declare const PARTICIPANT_PROFILE: Readonly<ActorExecutionProfile>;
@@ -16,51 +17,7 @@ export declare const PARTICIPANT_LIMITS: Readonly<{
 }>;
 export declare function participantToolSchema(speechEnabled?: boolean): Record<string, unknown>;
 export declare const PARTICIPANT_TOOL_SCHEMA: Record<string, unknown>;
-export declare const PARTICIPANT_FINAL_SCHEMA: {
-    type: string;
-    additionalProperties: boolean;
-    required: string[];
-    properties: {
-        outcome: {
-            type: string;
-            enum: string[];
-        };
-        summary: {
-            type: string;
-            minLength: number;
-            maxLength: number;
-        };
-        frictionReports: {
-            type: string;
-            maxItems: number;
-            items: {
-                type: string;
-                minLength: number;
-                maxLength: number;
-            };
-        };
-        impressions: {
-            type: string;
-            maxItems: number;
-            items: {
-                type: string;
-                additionalProperties: boolean;
-                required: string[];
-                properties: {
-                    kind: {
-                        type: string;
-                        enum: ("liked" | "missing" | "unclear" | "unfinished" | "unlike_my_work" | "untrustworthy")[];
-                    };
-                    text: {
-                        type: string;
-                        minLength: number;
-                        maxLength: number;
-                    };
-                };
-            };
-        };
-    };
-};
+export declare const PARTICIPANT_FINAL_SCHEMA: Record<string, unknown>;
 /** humanish tool arguments, validated before the shared executor sees a batch. */
 export declare function parseParticipantTool(value: unknown, speechEnabled?: boolean): CuaTurn;
 export declare function parseParticipantFinal(value: unknown): CuaTurn & {

package/dist/actors/codex/restricted-participant-policy.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import { BROWSER_CONTROL_LIMITS, browserControlActionSchema, browserOnlyControlActionSchema, validateBrowserControlAction, } from "../../browser-control/protocol.js";
-import { validClosingReport } from "../computer-use/loop.js";
-import { PARTICIPANT_IMPRESSION_KINDS, } from "../contract.js";
+import { closingReportSchema, strictOutputSchema, } from "../closing-report.js";
 /** The declared profile. A participant replaces cliVersion with its detected CLI release, or with
  * this host's newest qualified release before its first launch. */
 export const PARTICIPANT_PROFILE = Object.freeze({
@@ -38,33 +37,12 @@ export function participantToolSchema(speechEnabled = false) {
     return z.toJSONSchema(toolInput(speechEnabled), { io: "input" });
 }
 export const PARTICIPANT_TOOL_SCHEMA = participantToolSchema();
-export const PARTICIPANT_FINAL_SCHEMA = {
-    type: "object",
-    additionalProperties: false,
-    required: ["outcome", "summary", "frictionReports", "impressions"],
-    properties: {
-        outcome: { type: "string", enum: ["reached", "not_reached", "blocked"] },
-        summary: { type: "string", minLength: 1, maxLength: 4000 },
-        frictionReports: {
-            type: "array",
-            maxItems: 8,
-            items: { type: "string", minLength: 1, maxLength: 2000 },
-        },
-        impressions: {
-            type: "array",
-            maxItems: 6,
-            items: {
-                type: "object",
-                additionalProperties: false,
-                required: ["kind", "text"],
-                properties: {
-                    kind: { type: "string", enum: [...PARTICIPANT_IMPRESSION_KINDS] },
-                    text: { type: "string", minLength: 1, maxLength: 500 },
-                },
-            },
-        },
-    },
-};
+/** The participant's final account: how the task went, then its closing report. */
+const participantFinal = z.strictObject({
+    outcome: z.enum(["reached", "not_reached", "blocked"]),
+    ...closingReportSchema.shape,
+});
+export const PARTICIPANT_FINAL_SCHEMA = strictOutputSchema(participantFinal);
 /**
  * Shorten each wait longer than one browser-control request may wait. A failed tool call ends the
  * native run, so a wait that asks too much would otherwise end the whole session.
@@ -107,22 +85,16 @@ export function parseParticipantTool(value, speechEnabled = false) {
     };
 }
 export function parseParticipantFinal(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new Error("invalid_response");
-    const { outcome, ...report } = value;
-    if ((outcome !== "reached" && outcome !== "not_reached" && outcome !== "blocked") ||
-        !validClosingReport(report))
+    const final = participantFinal.safeParse(value);
+    if (!final.success)
         throw new Error("invalid_response");
+    const { outcome, ...closingReport } = final.data;
     return {
         actions: [],
         pendingSafetyChecks: [],
         done: true,
         outcome,
-        message: [report.summary, ...report.frictionReports].join("\n"),
-        closingReport: {
-            summary: report.summary,
-            frictionReports: [...report.frictionReports],
-            ...(report.impressions === undefined ? {} : { impressions: [...report.impressions] }),
-        },
+        message: [closingReport.summary, ...closingReport.frictionReports].join("\n"),
+        closingReport,
     };
 }

package/dist/actors/computer-use/loop/debrief.d.ts

@@ -1,4 +1,4 @@
-import { type ActorTrace, type ParticipantClosingReport, type ParticipantImpression } from "../../contract.js";
+import type { ActorTrace } from "../../contract.js";
 import type { DebriefTrigger } from "./ending.js";
 import type { LoopSession } from "./session.js";
 import type { CuaTurnRequest } from "./types.js";
@@ -9,15 +9,6 @@ export interface DebriefContext {
     readonly previousExecution: CuaTurnRequest["previousExecution"];
     readonly acknowledgedSafetyChecks: CuaTurnRequest["acknowledgedSafetyChecks"];
 }
-/**
- * Runtime validation is also required for third-party provider ports. A report without
- * impressions stays valid: older providers and stored traces do not have them.
- */
-export declare function validClosingReport(value: unknown): value is ParticipantClosingReport;
-/** The reply to an impressions-only request: an object with the impressions and nothing else. */
-export declare function validImpressionsReply(value: unknown): value is {
-    impressions: ParticipantImpression[];
-};
 /**
  * Ask the participant for its closing report after a structured stop, or for its impressions only
  * after it ended the session itself, or record why the request was skipped. Either way the result