humanish 0.114.0 → 0.116.0

package/dist/run/stored-runs.js

@@ -2,12 +2,12 @@ import { lstat, readdir } from "node:fs/promises";
 import path from "node:path";
 import { redactText } from "../evidence/redaction.js";
 import { bindExistingRunArtifactPaths, RUNS_RELATIVE_ROOT, isSafeRunIdSegment, resolveRunsRoot, } from "./paths.js";
-import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, } from "./contained-output.js";
+import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, refusalText, } from "./contained-output.js";
 import { RUN_BUNDLE_FILE } from "./bundle.js";
 import { isReviewSummary, isRunOutcome } from "./bundle-shape.js";
 import { bundleDisplayFacts, displayedReview, runDisplay, } from "./display.js";
 import { RUN_STATUS_FILE } from "./status.js";
-import { readLatest, readRunJsonIfExists, resolveRunPath } from "./locate.js";
+import { readLatest, readRunJsonIfExists, resolveRunPath, runJsonValue } from "./locate.js";
 import { withCuaReviewProvenance } from "./outcomes.js";
 import { isNodeError, isRecord } from "./type-guards.js";
 import { invalidRunStorageVerifyResult, verifyResolvedRun, } from "../verify/verify.js";
@@ -70,7 +70,8 @@ export async function listRuns(cwdInput) {
         if (runsRoot && entryRunPaths.physicalRunsRoot !== runsRoot.physicalPath) {
             return runsUnavailableResult(cwd, new Error("humanish runs root changed physical destination."));
         }
-        const bundle = await readRunJsonIfExists(entryRunPaths, RUN_BUNDLE_FILE);
+        // A listing shows what it can read: a run.json it refuses lists like a missing one.
+        const bundle = runJsonValue(await readRunJsonIfExists(entryRunPaths, RUN_BUNDLE_FILE));
         runs.push({
             runId: entryName,
             createdAt: isRecord(bundle) && typeof bundle.createdAt === "string" ? bundle.createdAt : null,
@@ -105,7 +106,7 @@ async function listedRunDisplay(runPaths, bundle) {
     if (displayed === undefined)
         return {};
     const status = displayed.outcome === undefined
-        ? await readRunJsonIfExists(runPaths, RUN_STATUS_FILE)
+        ? runJsonValue(await readRunJsonIfExists(runPaths, RUN_STATUS_FILE))
         : undefined;
     return { display: runDisplay(bundleDisplayFacts(displayed, status)) };
 }
@@ -155,18 +156,24 @@ export async function readReview(cwdInput, runInput) {
     if (!verified.ok || !verified.bundlePath) {
         return verified;
     }
-    const review = runPaths ? await readRunJsonIfExists(runPaths, "review.json") : null;
+    const reviewRead = runPaths ? await readRunJsonIfExists(runPaths, "review.json") : undefined;
+    const review = reviewRead === undefined ? null : runJsonValue(reviewRead);
     if (!isReviewSummary(review)) {
         return {
             ...verified,
             ok: false,
             error: {
                 code: "HUMANISH_INVALID_RUN_BUNDLE",
-                message: "review.json is missing or invalid.",
+                message: reviewRead?.status === "refused"
+                    ? `${refusalText("review.json", reviewRead)}.`
+                    : "review.json is missing or invalid.",
             },
         };
     }
-    const bundle = runPaths ? await readRunJsonIfExists(runPaths, RUN_BUNDLE_FILE) : null;
+    // The display reads what it can: a run.json refused here shows as a missing one does.
+    const bundle = runPaths
+        ? runJsonValue(await readRunJsonIfExists(runPaths, RUN_BUNDLE_FILE))
+        : null;
     const projected = isRecord(bundle) && Array.isArray(bundle.streams)
         ? withCuaReviewProvenance(review, bundle.streams.filter(isRecord))
         : review;

package/dist/run/transient-comms-secrets.d.ts

@@ -6,10 +6,11 @@ export declare function scrubTransientCommsText(text: string): string;
 /**
  * A scrub for text a model writes: each scope value as written and in its encoded forms
  * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
- * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
- * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
- * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
- * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
- * changes nothing.
+ * holds a value is returned decoded with each value replaced. Text without one keeps its original
+ * spelling, so an exact quote that holds an escape still matches its evidence. The literal scrub
+ * runs first, before decoding can rewrite a value that itself holds an escape, and last. The
+ * result is checked last of all: if it still holds a value as written or decoded, as a value
+ * holding part of a marker can after the literal scrub, the whole text is replaced. Outside a
+ * scope it changes nothing.
  */
 export declare function transientCommsKnownValueScrub(): (text: string) => string;

package/dist/run/transient-comms-secrets.js

@@ -1,7 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { decodeEscapes } from "../evidence/encoded-text.js";
-import { scrubSecretValues } from "../evidence/secret-scrub.js";
-import { escapeRegExp } from "./text.js";
+import { REDACTION_MARKERS } from "../evidence/redaction.js";
+import { holdsSecretValue, scrubSecretValues, scrubValuesAsWritten, } from "../evidence/secret-scrub.js";
 const scopes = new AsyncLocalStorage();
 const MAX_VALUES = 8192;
 const MAX_BYTES = 1024 * 1024;
@@ -15,7 +14,7 @@ function usable(scope) {
 function fail(scope) {
     scope.failed = true;
     scope.values.clear();
-    delete scope.pattern;
+    delete scope.literal;
     throw new Error("TRANSIENT_NARRATION_SECRET_LIMIT");
 }
 /** Enclose both participant execution and its automatic analysis in one scope. Nested runs isolate too. */
@@ -30,7 +29,7 @@ export async function withTransientCommsSecrets(work) {
         scope.closed = true;
         scope.values.clear();
         scope.bytes = 0;
-        delete scope.pattern;
+        delete scope.literal;
     }
 }
 export function registerTransientCommsSecrets(values) {
@@ -50,7 +49,7 @@ export function registerTransientCommsSecrets(values) {
             fail(scope);
         scope.values.add(value);
         scope.bytes += bytes;
-        delete scope.pattern;
+        delete scope.literal;
     }
 }
 /** Literal, longest-first replacement in one pass; replacement text is never matched recursively. */
@@ -59,46 +58,31 @@ export function scrubTransientCommsText(text) {
     if (!scope)
         return text;
     usable(scope);
-    if (!scope.values.size)
-        return text;
-    try {
-        scope.pattern ??= new RegExp([...scope.values]
-            .sort((a, b) => b.length - a.length)
-            .map(escapeRegExp)
-            .join("|"), "g");
-        return text.replace(scope.pattern, "[REDACTED_SECRET]");
-    }
-    catch {
-        return fail(scope);
-    }
+    scope.literal ??= scrubValuesAsWritten([...scope.values]);
+    return scope.literal(text);
 }
-/**
- * The scope's values as a scrubSecretValues scrub, which also finds them percent-encoded, escaped or
- * base64-encoded and returns decoded text. Outside a scope it changes nothing.
- */
-function transientCommsEncodedScrub() {
-    const scope = scopes.getStore();
-    if (!scope)
-        return (text) => text;
-    usable(scope);
-    return scrubSecretValues([...scope.values]);
-}
-const REDACTED = "[REDACTED_SECRET]";
-const markers = (text) => text.split(REDACTED).length - 1;
+const REDACTED = REDACTION_MARKERS.secret;
 /**
  * A scrub for text a model writes: each scope value as written and in its encoded forms
  * (percent-encoded, JSON-escaped, base64, base64url, hex), and where escapes split one. Text that
- * holds an encoded value is returned decoded with each value replaced. Text without one keeps its
- * original spelling, so an exact quote that holds an escape still matches its evidence. The literal
- * scrub runs first, before decoding can rewrite a value that itself holds an escape, and last,
- * because the encoded scrub leaves text inside marker-shaped spans alone. Outside a scope it
- * changes nothing.
+ * holds a value is returned decoded with each value replaced. Text without one keeps its original
+ * spelling, so an exact quote that holds an escape still matches its evidence. The literal scrub
+ * runs first, before decoding can rewrite a value that itself holds an escape, and last. The
+ * result is checked last of all: if it still holds a value as written or decoded, as a value
+ * holding part of a marker can after the literal scrub, the whole text is replaced. Outside a
+ * scope it changes nothing.
  */
 export function transientCommsKnownValueScrub() {
-    const encoded = transientCommsEncodedScrub();
+    const scope = scopes.getStore();
+    if (!scope)
+        return scrubTransientCommsText;
+    usable(scope);
+    const values = [...scope.values];
+    const encoded = scrubSecretValues(values);
+    const holds = holdsSecretValue(values);
     return (text) => {
         const literal = scrubTransientCommsText(text);
-        const found = encoded(literal);
-        return scrubTransientCommsText(markers(found) > markers(decodeEscapes(literal)) ? found : literal);
+        const result = scrubTransientCommsText(holds(literal) ? encoded(literal) : literal);
+        return holds(result) ? REDACTED : result;
     };
 }

package/dist/run-study.js

@@ -4,7 +4,6 @@
 // which runs the route's local checks that need no scorer (keys, subject env, the local agent) and
 // returns the route's run. prepareStudy is the same path in two steps, so the CLI can present either
 // refusal before it loads a declared review scorer.
-import { participantList } from "./study/study-fields.js";
 import { personaBackgroundWarnings } from "./study/warnings.js";
 import { resolveCommittedPersonasForCwd, studyPersonaIds } from "./study/persona-resolve.js";
 import { computerUseInput, scriptedInput, sharedWorldInput, terminalInput, } from "./study/route-inputs.js";
@@ -73,8 +72,12 @@ export async function prepareStudy(config, options, deps = {}) {
         outcome.result.warnings.push(...normalized.warnings);
         return { ok: false, outcome };
     }
-    const runWarnings = [...(planned.planned.plan.warnings ?? [])];
-    const plan = { ...planned.planned.plan, warnings: runWarnings };
+    // The run records the background warnings in its bundle with the plan's own.
+    const backgroundWarnings = await planBackgroundWarnings(planned.planned.plan, study, options.cwd);
+    const plan = {
+        ...planned.planned.plan,
+        warnings: [...(planned.planned.plan.warnings ?? []), ...backgroundWarnings],
+    };
     const admitted = await admitPlan(study, planning, plan, deps, normalized.emit);
     if (!admitted.ok) {
         await vm?.close();
@@ -97,16 +100,7 @@ export async function prepareStudy(config, options, deps = {}) {
                         return outcome;
                     }
                 }
-                // Admission keeps its refusal order; these warnings join the plan before its run scope opens.
-                const personas = route === "computer-use" || route === "shared-world"
-                    ? (await resolveCommittedPersonasForCwd(options.cwd, studyPersonaIds(study))).personas
-                    : new Map();
-                const backgroundWarnings = personaBackgroundWarnings(route === "computer-use" &&
-                    options.count !== undefined &&
-                    participantList(study) === undefined
-                    ? { ...study, participants: options.count }
-                    : study, personas);
-                runWarnings.splice(0, runWarnings.length, ...(planned.planned.plan.warnings ?? []), ...backgroundWarnings);
+                // A run's result lists the background warnings; a refusal before the run does not.
                 normalized.warnings.push(...backgroundWarnings);
                 // The route layers the scorer over the inputs it admitted, and the local study is not
                 // rebuilt for it. The admitted runSession, provider and participant desktop belong to this
@@ -125,6 +119,21 @@ export async function prepareStudy(config, options, deps = {}) {
         },
     };
 }
+/**
+ * A warning for each of the plan's participants whose persona has no background. Only
+ * computer-use and shared-world plans have participants; the committed personas are read for them.
+ */
+async function planBackgroundWarnings(plan, study, cwd) {
+    const participants = plan.route === "computer-use"
+        ? plan.runner.participants
+        : plan.route === "shared-world"
+            ? plan.plane.participants
+            : [];
+    if (participants.length === 0)
+        return [];
+    const { personas } = await resolveCommittedPersonasForCwd(cwd, studyPersonaIds(study));
+    return personaBackgroundWarnings(plan.studyId, participants, personas);
+}
 /** The route's admit function for a plan, with the route's input from the run's options. */
 async function admitPlan(config, options, plan, deps, emit) {
     switch (plan.route) {

package/dist/study/adapter-scorer-loader.js

@@ -18,7 +18,7 @@ import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { digestText, redactText } from "../evidence/redaction.js";
-import { prepareSelectedOutputDirectory, readContainedRegularFile, } from "../run/contained-output.js";
+import { prepareSelectedOutputDirectory, readContainedRegularFile, refusalText, PROJECT_FILE_MAX_BYTES, } from "../run/contained-output.js";
 /**
  * A scorer written for computer use and shared world, as `RunStudyOptions.scorer` takes it. Those
  * routes pass the browser context; another route that calls it passes a context it was not written
@@ -96,11 +96,13 @@ export async function loadAdapterScorer(args) {
     const relPosix = relative.split(path.sep).join("/");
     // Fail-closed containment gate on the entry file only: rejects symlink, nlink>1, realpath-escape,
     // TOCTOU. Its returned bytes are the digest input.
-    const bytes = await readContainedRegularFile(root, relPosix);
-    if (!bytes) {
+    const read = await readContainedRegularFile(root, relPosix, PROJECT_FILE_MAX_BYTES);
+    if (read.status === "refused" && read.reason === "too-large")
+        return fail("HUMANISH_STUDY_SCORER_NOT_FOUND", `review.scorer.ref "${trimmed}" could not be read: ${refusalText(relPosix, read)}.`);
+    if (read.status !== "read") {
         return fail("HUMANISH_STUDY_SCORER_NOT_FOUND", `review.scorer.ref "${trimmed}" could not be read as a regular file inside the project (${relPosix}). Use a plain file there: not a symlink or a hard link, and not a path that resolves outside the project.`);
     }
-    const digest = digestText(bytes.toString("utf8"));
+    const digest = digestText(read.bytes.toString("utf8"));
     // Import the entry module in a broad try/catch (ERR_MODULE_NOT_FOUND / SyntaxError / ERR_REQUIRE_ESM
     // / top-level throw). import() executes the transitive graph, and the cwd clamp guards only the entry
     // file; out-of-tree/transitive code is acceptable only because of the trust boundary above.

package/dist/study/discover.js

@@ -1,4 +1,4 @@
-import { personaBackgroundWarnings } from "./warnings.js";
+import { personaBackgroundWarnings, plannedParticipants } from "./warnings.js";
 import { studyPersonaIds, resolveCommittedPersonasForCwd } from "./persona-resolve.js";
 import { personaBrief, PersonaConfigError } from "./persona.js";
 import { constants } from "node:fs";
@@ -7,7 +7,7 @@ import path from "node:path";
 import { parse } from "yaml";
 import { parseStudy } from "./config.js";
 import { V2_SCHEMA } from "./migrate/v2.js";
-import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareSelectedOutputDirectory, readContainedRegularFile, } from "../run/contained-output.js";
+import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareSelectedOutputDirectory, readContainedRegularFile, refusalText, PROJECT_FILE_MAX_BYTES, } from "../run/contained-output.js";
 import { isNodeError } from "../run/type-guards.js";
 import { studyFileCandidates, STUDY_DIRECTORIES } from "./files.js";
 const STUDY_LIST_SCHEMA = "humanish.study-list.v1";
@@ -197,7 +197,7 @@ export async function inspectStudyManifest(cwd, study) {
         warnings: [
             ...resolved.warnings,
             ...personaResolution.warnings,
-            ...personaBackgroundWarnings(resolved.config, personaResolution.personas),
+            ...personaBackgroundWarnings(resolved.config.id, plannedParticipants(resolved.config), personaResolution.personas),
         ],
     };
 }
@@ -279,14 +279,17 @@ async function readManagedManifest(projectRoot, relativePath) {
     if (inspected.status !== "ok") {
         return inspected;
     }
-    const contents = await readContainedRegularFile(projectRoot, relativePath.replace(/\\/g, "/"));
-    if (!contents) {
+    const contents = await readContainedRegularFile(projectRoot, relativePath.replace(/\\/g, "/"), PROJECT_FILE_MAX_BYTES);
+    if (contents.status === "refused" && contents.reason === "too-large")
+        return { status: "unsafe", message: `${refusalText("The study file", contents)}.` };
+    // Gone or swapped since it was inspected above.
+    if (contents.status !== "read") {
         return {
             status: "unsafe",
             message: "The study file changed or failed containment validation.",
         };
     }
-    return { status: "ok", contents: contents.toString("utf8") };
+    return { status: "ok", contents: contents.bytes.toString("utf8") };
 }
 async function readExplicitManifest(projectRoot, requestedPath) {
     try {

package/dist/study/init-paths.js

@@ -4,7 +4,7 @@
 import { lstat } from "node:fs/promises";
 import path from "node:path";
 import { runtimeDirectories, starterFiles } from "./init-templates.js";
-import { assertPreparedSelectedOutputDirectory, readContainedRegularFile, } from "../run/contained-output.js";
+import { assertPreparedSelectedOutputDirectory, ContainedReadRefusedError, readContainedRegularFile, PROJECT_FILE_MAX_BYTES, } from "../run/contained-output.js";
 import { isPathInside } from "../run/paths.js";
 import { isNodeError } from "../run/type-guards.js";
 export async function validateInitProjectPaths(cwd) {
@@ -54,10 +54,12 @@ function unsafeProjectPath(relativePath) {
     };
 }
 export async function readTextIfExists(projectRoot, relativePath) {
-    const bytes = await readContainedRegularFile(projectRoot, relativePath);
-    if (bytes !== null) {
-        return bytes.toString("utf8");
-    }
+    const read = await readContainedRegularFile(projectRoot, relativePath, PROJECT_FILE_MAX_BYTES);
+    if (read.status === "read")
+        return read.bytes.toString("utf8");
+    // A file over the limit is a size problem, not an unsafe path.
+    if (read.status === "refused" && read.reason === "too-large")
+        throw new ContainedReadRefusedError(relativePath, read);
     const target = path.join(projectRoot.physicalPath, relativePath);
     try {
         await lstat(target);

package/dist/study/persona-resolve.d.ts

@@ -5,8 +5,8 @@ import type { StudyConfig } from "./types.js";
 export declare function personaTitleFromId(personaId: string): string;
 /**
  * Resolve one persona from `humanish/personas/`, then the ignored `.humanish/local/personas/`.
- * Returns `null` with a warning when the id is unsafe or no file exists. Invalid rich backgrounds
- * reject the study before execution.
+ * Returns `null` with a warning when the id is unsafe or no file exists. Invalid rich backgrounds,
+ * and a persona file that is there and cannot be read, reject the study before execution.
  */
 export declare function resolveCommittedPersona(projectRoot: PreparedSelectedOutputDirectory, personaId: string): Promise<{
     persona: ResolvedPersona | null;

package/dist/study/persona-resolve.js

@@ -2,7 +2,7 @@
 import { parse as parseYaml } from "yaml";
 import path from "node:path";
 import { parseResolvedPersona, PersonaConfigError } from "./persona.js";
-import { prepareSelectedOutputDirectory, readContainedRegularFile, } from "../run/contained-output.js";
+import { prepareSelectedOutputDirectory, readContainedRegularFile, PROJECT_FILE_MAX_BYTES, refusalText, } from "../run/contained-output.js";
 import { digestText, redactText } from "../evidence/redaction.js";
 import { realpath } from "node:fs/promises";
 import { participantList } from "./study-fields.js";
@@ -23,8 +23,8 @@ const PERSONA_DIRECTORIES = [
 ];
 /**
  * Resolve one persona from `humanish/personas/`, then the ignored `.humanish/local/personas/`.
- * Returns `null` with a warning when the id is unsafe or no file exists. Invalid rich backgrounds
- * reject the study before execution.
+ * Returns `null` with a warning when the id is unsafe or no file exists. Invalid rich backgrounds,
+ * and a persona file that is there and cannot be read, reject the study before execution.
  */
 export async function resolveCommittedPersona(projectRoot, personaId) {
     if (!PERSONA_ID_PATTERN.test(personaId)) {
@@ -37,9 +37,13 @@ export async function resolveCommittedPersona(projectRoot, personaId) {
         path.posix.join(directory, `${personaId}.yaml`),
         path.posix.join(directory, `${personaId}.yml`),
     ])) {
-        const bytes = await readContainedRegularFile(projectRoot, candidate);
-        if (!bytes)
+        const read = await readContainedRegularFile(projectRoot, candidate, PROJECT_FILE_MAX_BYTES);
+        if (read.status === "missing")
             continue;
+        // A candidate that is there and refused stops resolution: the next file is another persona.
+        if (read.status === "refused")
+            throw new PersonaConfigError(`Persona ${redactText(personaId)}: ${refusalText(candidate, read)}. Fix or remove that file; a lower-priority persona file is not used in its place.`);
+        const bytes = read.bytes;
         let raw;
         try {
             raw = parseYaml(bytes.toString("utf8"));

package/dist/study/plan-types.d.ts

@@ -196,8 +196,8 @@ export interface SharedWorldPlan extends PlanBase {
     readonly plane: SharedWorldPlane;
     /** At least 2. */
     readonly concurrency: number;
-    /** The declared participant session timeout; the route supplies its default. */
-    readonly sessionTimeoutMs?: number;
+    /** Each participant's session budget: execution.timeoutMs, else the plane's derived default. */
+    readonly sessionTimeoutMs: number;
     readonly brain: Extract<Brain, {
         kind: "openai" | "local-agent";
     }>;

package/dist/study/plan.d.ts

@@ -6,8 +6,10 @@ export { routeOf, type StudyRoute } from "./routing.js";
 /** Resolve dry-run: explicit override wins, else the scenario mode, else the given fallback. */
 export declare function resolveStudyDryRun(config: StudyConfig, override: boolean | undefined, fallback: boolean | undefined): boolean | undefined;
 /**
- * The plan a study runs under, built without reading files, env or the network. Each route's planner
- * makes every refusal that route makes, in the route's order and with its codes and messages; the
- * route's exported runner calls the same planner.
+ * The plan a study runs under, built without reading files or the network. From the environment
+ * (options.env, else process.env, as the routes read it) it reads one value, the E2B sandbox
+ * ceiling, which no study file can know. Each route's planner makes every refusal that route
+ * makes, in the route's order and with its codes and messages; the route's exported runner calls
+ * the same planner.
  */
 export declare function planStudy(config: StudyConfig, options: InternalRunStudyOptions, deps?: StudyDeps): PlanResult;

package/dist/study/plan.js

@@ -6,13 +6,14 @@ import { callerDrivingOf, planComputerUseStudy } from "../routes/computer-use/pl
 import { injectedBrowser, planScriptedStudy } from "../routes/scripted/plan.js";
 import { planSharedWorldStudy } from "../routes/shared-world/plan.js";
 import { planTerminalStudy } from "../routes/terminal/plan.js";
+import { sandboxCeiling } from "../substrates/e2b/lifetime.js";
 import { localBrowserDefaults } from "../substrates/local/runtime-config.js";
 import { THIS_REPO_DRY_RUN_ONLY } from "./composition-rules.js";
 import { planBase } from "./plan-base.js";
 import { routeOf } from "./routing.js";
 import { automaticAnalysisRouteReason, taskProtocolValidationReason } from "./validation.js";
 import { declaredParticipantCount } from "./study-fields.js";
-import { egressAllowIgnoredWarning, scriptedMissionWarnings } from "./warnings.js";
+import { recordedStudyWarnings } from "./warnings.js";
 export { routeOf } from "./routing.js";
 /** Resolve dry-run: explicit override wins, else the scenario mode, else the given fallback. */
 export function resolveStudyDryRun(config, override, fallback) {
@@ -63,20 +64,22 @@ function planPreview(config, options, input) {
     };
 }
 /**
- * The plan a study runs under, built without reading files, env or the network. Each route's planner
- * makes every refusal that route makes, in the route's order and with its codes and messages; the
- * route's exported runner calls the same planner.
+ * The plan a study runs under, built without reading files or the network. From the environment
+ * (options.env, else process.env, as the routes read it) it reads one value, the E2B sandbox
+ * ceiling, which no study file can know. Each route's planner makes every refusal that route
+ * makes, in the route's order and with its codes and messages; the route's exported runner calls
+ * the same planner.
  */
 export function planStudy(config, options, deps = {}) {
     const study = localBrowserDefaults(config);
     const input = { dryRun: resolveStudyDryRun(study, options.dryRun, true) ?? true };
-    const result = planRoute(routeOf(config), study, options, input, deps);
+    const ceiling = sandboxCeiling(options.env ?? process.env);
+    const result = planRoute(routeOf(config), study, options, input, deps, ceiling);
     if (!result.ok)
         return result;
     // The manifest the CLI resolved enters the plan here and nowhere else; the routes read
     // plan.study for the run's status record and bundle, and plan.warnings for its bundle events.
-    const warning = egressAllowIgnoredWarning(study);
-    const warnings = [...(warning === undefined ? [] : [warning]), ...scriptedMissionWarnings(study)];
+    const warnings = recordedStudyWarnings(study);
     const plan = {
         ...result.plan,
         ...(options.study === undefined ? {} : { study: options.study }),
@@ -84,7 +87,7 @@ export function planStudy(config, options, deps = {}) {
     };
     return { ok: true, planned: { plan } };
 }
-function planRoute(route, study, options, input, deps) {
+function planRoute(route, study, options, input, deps, sandboxCeiling) {
     switch (route) {
         case "preview":
             return planPreview(study, options, input);
@@ -95,14 +98,20 @@ function planRoute(route, study, options, input, deps) {
                 driving: callerDrivingOf(options),
                 ...(options.count === undefined ? {} : { countOverride: options.count }),
                 ...(options.rerun === undefined ? {} : { rerun: options.rerun }),
+                sandboxCeiling,
             });
         case "shared-world":
             return planSharedWorldStudy(study, {
                 ...input,
                 hasRunSession: deps.runSession !== undefined,
+                sandboxCeiling,
             });
         case "terminal":
-            return planTerminalStudy(study, { ...input, hasCostProbe: deps.costProbe !== undefined });
+            return planTerminalStudy(study, {
+                ...input,
+                hasCostProbe: deps.costProbe !== undefined,
+                sandboxCeiling,
+            });
         case "scripted":
             return planScriptedStudy(study, { ...input, injectedBrowser: injectedBrowser(deps) });
     }

package/dist/study/preflight-probes.js

@@ -4,7 +4,7 @@
 // the study and dispatches here.
 import { cloneProvisioningBudgetMs, provisionCloneSubject } from "../subject/clone.js";
 import { CUA_ACTOR_STUDY_PROVIDER_METADATA } from "../routes/computer-use/e2b-desktop/prepare.js";
-import { MAX_SANDBOX_MS } from "../substrates/e2b/lifetime.js";
+import { sandboxCeiling } from "../substrates/e2b/lifetime.js";
 import { abandonPreflightJournal, discardPreflightJournal, openPreflightJournal, } from "../run/preflight-receipts.js";
 import { probeUrl } from "../substrates/detached.js";
 import { loadE2BDesktopModule } from "../substrates/e2b/sdk.js";
@@ -147,8 +147,16 @@ async function withPreflightSandbox(ctx, args, callback) {
     let allocation;
     let failureMessage;
     // The lease is sized to the probe's work, never longer than a declared sandbox timeout (the run
-    // gets no more than that either) or E2B's maximum.
-    const timeoutMs = Math.min(args.leaseMs, ctx.config.execution?.desktop?.sandboxTimeoutMs ?? MAX_SANDBOX_MS);
+    // gets no more than that either) or the sandbox ceiling.
+    const ceiling = sandboxCeiling(ctx.env);
+    if (!ceiling.ok)
+        return {
+            ok: false,
+            result: fail(ctx, "HUMANISH_STUDY_PREFLIGHT_PROVISION_FAILED", ceiling.message, [
+                { name: "sandbox preflight", ok: false, message: ceiling.message },
+            ]),
+        };
+    const timeoutMs = Math.min(args.leaseMs, ctx.config.execution?.desktop?.sandboxTimeoutMs ?? ceiling.ms);
     // The receipt goes to a journal under .humanish/preflight, so `humanish reclaim --preflight`
     // can kill the probe if this process dies before the finally block does.
     let journal;

package/dist/study/preflight.js

@@ -1,4 +1,4 @@
-import { personaBackgroundWarnings } from "./warnings.js";
+import { personaBackgroundWarnings, plannedParticipants } from "./warnings.js";
 import { resolveCommittedPersonasForCwd, studyPersonaIds } from "./persona-resolve.js";
 import path from "node:path";
 import { isLoopbackUrl } from "./parse/subject.js";
@@ -37,9 +37,10 @@ export async function runStudyPreflight(options) {
             error: resolved.error,
         };
     }
-    const personas = resolved.config.route === "computer-use" || resolved.config.route === "shared-world"
-        ? (await resolveCommittedPersonasForCwd(cwd, studyPersonaIds(resolved.config))).personas
-        : new Map();
+    const participants = plannedParticipants(resolved.config);
+    const personas = participants.length === 0
+        ? new Map()
+        : (await resolveCommittedPersonasForCwd(cwd, studyPersonaIds(resolved.config))).personas;
     const route = routeOf(resolved.config);
     const ctx = {
         cwd,
@@ -59,7 +60,10 @@ export async function runStudyPreflight(options) {
         ],
         targets: collectTargets(resolved.config),
         sandbox: { created: false },
-        warnings: [...resolved.warnings, ...personaBackgroundWarnings(resolved.config, personas)],
+        warnings: [
+            ...resolved.warnings,
+            ...personaBackgroundWarnings(resolved.config.id, participants, personas),
+        ],
     };
     const machine = machineCheck(ctx.config);
     // A local study's app and desktops run on this machine, so the hosted probes do not apply.

package/dist/study/summary.d.ts

@@ -1,4 +1,5 @@
 import { type LocalRuntimeStatus } from "../substrates/local/runtime.js";
+import { type AutomaticAnalysisBudget } from "../analysis/automatic-config.js";
 import { type KeyResolutionDeps } from "../keys/key-resolution.js";
 export declare const STUDY_SUMMARY_SCHEMA = "humanish.study-summary.v1";
 export interface StudyCaps {
@@ -14,11 +15,9 @@ export interface StudySummary {
         message: string;
     };
     communications?: string;
-    analysis?: {
-        provider?: "openai" | "codex";
-        billing?: "api-estimate" | "account-unknown";
-        model: string;
-        maxCostUsd: number | null;
+    analysis?: AutomaticAnalysisBudget & {
+        /** The budget line `run` and `study check` print, from formatAutomaticAnalysisBudget. */
+        line: string;
     };
     schema: typeof STUDY_SUMMARY_SCHEMA;
     /** The study's `id`. */
@@ -39,9 +38,15 @@ export interface StudySummary {
      * default. A study variable you cannot see is one nobody chose.
      */
     reasoningEffort?: string;
-    caps: StudyCaps;
+    /** Absent on routes whose dollar caps the summary does not show; `{}` when none is declared. */
+    caps?: StudyCaps;
     /**
-     * Whether the configured route's required keys resolve. Dry runs require none. This checks key
+     * What `humanish run <study>` runs this file as: its `mode`, a dry run when it sets none. The TUI
+     * cannot start a live run of a dry-run file, because no `run` flag overrides the file to live.
+     */
+    mode: "live" | "dry-run";
+    /**
+     * Whether the keys a live run of this study needs resolve, whatever its mode. This checks key
      * presence, not local CLI authentication or provider validity. Undefined when not checked.
      */
     keysReady?: boolean;