humanish 0.115.0 → 0.117.0

package/CHANGELOG.md

@@ -8,6 +8,47 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.117.0: Long participant waits, OpenAI wait length, serve.build fails fast, TUI confirmations (2026-10-09)
+
+humanish 0.117.0 lets a participant wait through a long hosted study, gives an OpenAI
+participant's wait a usable length, and fails a broken `serve.build` within seconds. A
+participant's wait longer than one desktop call now lasts as long as it asked, up to the new study
+field `actor.maxWaitMs` (1 second to 10 minutes; 2 minutes by default, 30 seconds on a desktop with
+speech), and goes to the desktop in steps of at most 30 seconds. A Codex participant's longer wait
+was cut to 30 seconds before. An `openai-computer-use` participant's `wait` names no duration and
+lasted half a second on a hosted desktop; it now lasts `actor.idleWaitMs` (5 seconds by default) in
+a turn that only waits, and 500 ms after an action in the same turn. The participant's `actor.json`
+records these lengths as `waitSettings`. A `serve.install`, `serve.build` or seed step that bash
+cannot parse fails within seconds with bash's error, where the run waited out the step's limit (10
+minutes for `serve.build`), and a failed `serve.build` on the computer-use route has its own error
+code. In `humanish tui`, a two-Enter confirmation ends when the cursor leaves it. The terminal
+route's check after its sandbox kill carries the run's E2B key, and browser Back in the Observer
+clears a stale saved-moment message.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.117.0)
+
+## 0.116.0: Hosted keyboard input, E2B sandbox ceiling, bounded run reads, run header, TUI live starts (2026-10-09)
+
+humanish 0.116.0 delivers a hosted participant's arrow keys and punctuation, lets the operator
+raise the E2B sandbox lifetime, and reads run files within size limits. On hosted E2B desktops,
+`ARROWDOWN`, Page Up, Page Down, `?`, `/` and other names missing from `@e2b/desktop`'s key table
+reached xdotool unchanged, which ignored them while the run recorded the keypress as completed;
+both desktops now translate key names through one table and refuse a name outside it.
+`HUMANISH_E2B_MAX_SANDBOX_MINUTES` sets the longest sandbox lifetime the planners allow, 60 minutes
+when unset and up to 1440 on E2B's Pro plan. A refusal names the value that admits the study, and
+`humanish doctor` shows the ceiling. A route's sandbox kill, and the kills, checks and listings of
+`humanish reclaim`, carry the run's E2B key. `verify` reads at most 32 MiB of a run file and lists
+a larger file, or a run past 10,000 entries, as unscanned, and every contained read tells a missing
+file from one it refused. A run whose analysis did not complete reads `live run finished; the
+analysis did not complete`, a run refused before it was created prints no `analysis:` line, and a
+`desktop-cli` run names its product on the `subject:` line and in run.json. In `humanish tui`, the
+cursor follows the selected row through a refresh, a live start of a `mode: dry-run` file says
+`needs mode: live`, Run again on a live run asks for a second Enter, the confirm prompt restates
+the study's cost, and `c` lists every provider key. `NO_UPDATE_NOTIFIER` turns the update check
+off.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.116.0)
+
 ## 0.115.0: Closing report limits, admitted analysis cost, concurrent reviewer notes, known-value scrub (2026-10-08)
 
 humanish 0.115.0 asks the OpenAI computer-use participant for its closing report and impressions

package/README.md

@@ -276,9 +276,10 @@ sensitive to capture in the first place.
 **What the automated gate enforces.** `humanish verify` scans public-bound
 artifacts and fails closed on secret, key, and token shapes and on known local
 path shapes. It reads text only, judged by a file's bytes rather than its name:
-any file in the run folder that is not UTF-8 text, other than a stream
-screenshot or recording, keeps the run `local_only` (`UNSCANNED_ARTIFACT`). It
-matches after undoing escapes, percent-encoding, HTML entities and base64. It
+any file in the run folder that is not UTF-8 text or is larger than 32 MiB,
+other than a stream screenshot or recording, keeps the run `local_only`
+(`UNSCANNED_ARTIFACT`). It matches after undoing escapes, percent-encoding, HTML
+entities and base64. It
 does not yet detect free-form PII or PHI such as names, emails,
 phone numbers, dates of birth, or medical identifiers. Keeping those out depends
 on using synthetic data and on review, so `redaction: passed` means the
@@ -483,9 +484,9 @@ At most once a day, a command run at a terminal also asks the npm registry for
 the latest humanish version, and a later command prints one line on stderr when
 yours is older. That request is a plain `GET` of humanish's dist-tags with no
 machine id, version, command or path. It is skipped in CI, without a terminal,
-for `--json`, and with `DO_NOT_TRACK=1`, `HUMANISH_TELEMETRY_DISABLED=1` or
-`HUMANISH_NO_UPDATE_CHECK=1`. [TELEMETRY.md](TELEMETRY.md#the-update-check)
-describes it.
+for `--json`, and with `DO_NOT_TRACK=1`, `HUMANISH_TELEMETRY_DISABLED=1`,
+`HUMANISH_NO_UPDATE_CHECK=1` or update-notifier's `NO_UPDATE_NOTIFIER=1`.
+[TELEMETRY.md](TELEMETRY.md#the-update-check) describes it.
 
 ## Contribute
 

package/TELEMETRY.md

@@ -132,4 +132,10 @@ participant, and when any of these is set:
 DO_NOT_TRACK=1
 HUMANISH_TELEMETRY_DISABLED=1
 HUMANISH_NO_UPDATE_CHECK=1
+NO_UPDATE_NOTIFIER=1
 ```
+
+`NO_UPDATE_NOTIFIER` is the variable the update-notifier package reads, so a
+machine set up to silence the CLIs built on it gets no humanish notice either.
+humanish reads it as update-notifier does: any value turns the check off,
+including an empty one, `0` or `false`.

package/dist/actors/codex/app-server-ui.js

@@ -2,7 +2,7 @@ import { createServer } from "node:http";
 import path from "node:path";
 import { digestText } from "../../evidence/redaction.js";
 import { CODEX_APP_SERVER_ARTIFACTS, CODEX_APP_SERVER_DIRECTORY, runCodexAppServerSessionInPreparedRoot, } from "./app-server.js";
-import { prepareContainedOutputDirectory, prepareContainedOutputFile, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, prepareSelectedOutputFile, readContainedRegularFile, writeContainedOutputFile, writePreparedSelectedOutputFile, } from "../../run/contained-output.js";
+import { prepareContainedOutputDirectory, prepareContainedOutputFile, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, prepareSelectedOutputFile, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, writePreparedSelectedOutputFile, } from "../../run/contained-output.js";
 const CODEX_APP_SERVER_UI_SCHEMA = "humanish.codex-app-server-ui.v1";
 export async function startCodexAppServerUi(options) {
     const cwd = path.resolve(options.cwd);
@@ -128,13 +128,20 @@ export async function startCodexAppServerUi(options) {
     };
 }
 async function serveArtifact(args) {
-    const body = await readContainedRegularFile(args.runRoot, args.requestPath);
-    if (body) {
+    const read = await readContainedRegularFile(args.runRoot, args.requestPath, RUN_ARTIFACT_MAX_BYTES);
+    if (read.status === "read") {
         args.response.writeHead(200, {
             "cache-control": "no-store",
             "content-type": contentTypeFor(args.requestPath),
         });
-        args.response.end(body);
+        args.response.end(read.bytes);
+        return;
+    }
+    // A file over the limit is there: a 404 would tell the page it does not exist. A link, or a
+    // path outside the run, is served as absent, as it always was.
+    if (read.status === "refused" && read.reason === "too-large") {
+        args.response.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+        args.response.end(`${refusalText(args.requestPath, read)}.`);
         return;
     }
     args.response.writeHead(404);

package/dist/actors/codex/restricted-participant-policy.d.ts

@@ -10,8 +10,6 @@ export declare const PARTICIPANT_LIMITS: Readonly<{
     narration: 2000;
     output: number;
     actions: 4;
-    /** The longest wait one action lasts; a longer one is shortened to it. */
-    waitMs: 30000;
     requestMs: 180000;
     cleanupMs: 5000;
 }>;

package/dist/actors/codex/restricted-participant-policy.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { BROWSER_CONTROL_LIMITS, browserControlActionSchema, browserOnlyControlActionSchema, validateBrowserControlAction, } from "../../browser-control/protocol.js";
+import { participantActionSchema, participantSpeechActionSchema, } from "../../browser-control/protocol.js";
 import { closingReportSchema, strictOutputSchema, } from "../closing-report.js";
 /** The declared profile. A participant replaces cliVersion with its detected CLI release, or with
  * this host's newest qualified release before its first launch. */
@@ -21,15 +21,13 @@ export const PARTICIPANT_LIMITS = Object.freeze({
     narration: 2000,
     output: 256 * 1024,
     actions: 4,
-    /** The longest wait one action lasts; a longer one is shortened to it. */
-    waitMs: BROWSER_CONTROL_LIMITS.waitMs,
     requestMs: 180_000,
     cleanupMs: 5000,
 });
 const toolInput = (speechEnabled) => z.strictObject({
     narration: z.string().max(PARTICIPANT_LIMITS.narration),
     actions: z
-        .array(speechEnabled ? browserControlActionSchema : browserOnlyControlActionSchema)
+        .array(speechEnabled ? participantSpeechActionSchema : participantActionSchema)
         .min(1)
         .max(PARTICIPANT_LIMITS.actions),
 });
@@ -43,41 +41,15 @@ const participantFinal = z.strictObject({
     ...closingReportSchema.shape,
 });
 export const PARTICIPANT_FINAL_SCHEMA = strictOutputSchema(participantFinal);
-/**
- * Shorten each wait longer than one browser-control request may wait. A failed tool call ends the
- * native run, so a wait that asks too much would otherwise end the whole session.
- */
-function shortenWaits(value) {
-    const actions = value?.actions;
-    if (typeof value !== "object" || !Array.isArray(actions))
-        return { value, shortened: [] };
-    const shortened = [];
-    const limit = PARTICIPANT_LIMITS.waitMs;
-    const next = actions.map((action, index) => {
-        const wait = action;
-        if (wait?.kind !== "wait" ||
-            typeof wait.ms !== "number" ||
-            !Number.isFinite(wait.ms) ||
-            wait.ms <= limit)
-            return action;
-        shortened.push({ index, requestedMs: wait.ms, ms: limit });
-        return { ...wait, ms: limit };
-    });
-    return shortened.length === 0
-        ? { value, shortened }
-        : { value: { ...value, actions: next }, shortened };
-}
 /** humanish tool arguments, validated before the shared executor sees a batch. */
 export function parseParticipantTool(value, speechEnabled = false) {
     if (Buffer.byteLength(JSON.stringify(value) ?? "") > PARTICIPANT_LIMITS.output)
         throw new Error("invalid_response");
-    const { value: admitted, shortened } = shortenWaits(value);
-    const v = toolInput(speechEnabled).parse(admitted);
+    const v = toolInput(speechEnabled).parse(value);
     if (Buffer.byteLength(v.narration) > PARTICIPANT_LIMITS.narration)
         throw new Error("invalid_response");
     return {
-        actions: v.actions.map(validateBrowserControlAction),
-        ...(shortened.length === 0 ? {} : { shortenedWaits: shortened }),
+        actions: v.actions,
         pendingSafetyChecks: [],
         done: false,
         ...(v.narration ? { message: v.narration } : {}),

package/dist/actors/codex/restricted-participant.d.ts

@@ -17,6 +17,11 @@ export interface RestrictedParticipantOptions {
     reasoningEffort?: ReasoningEffort;
     /** Admit speech actions and heard-speaker evidence for a speech-capable desktop only. */
     speechEnabled?: boolean;
+    /**
+     * The study's actor.maxWaitMs, which the loop applies and the tool description states. Default
+     * defaultMaxWaitMs(speechEnabled), the same default the loop applies.
+     */
+    maxWaitMs?: number;
 }
 /** What doctor's hosted-participant check found, before any turn. */
 export interface ParticipantReadiness {

package/dist/actors/codex/restricted-participant.js

@@ -3,6 +3,7 @@ import { defaultCodexCliVersion, untestedOperatorReleaseWarning } from "./codex-
 import { IMPRESSIONS_ASK, } from "../computer-use/loop.js";
 import { ComputerUseProviderError, isComputerUseProviderError, } from "../computer-use/provider-error.js";
 import { validateBrowserControlPng, validateHeardSpeech } from "../../browser-control/protocol.js";
+import { defaultMaxWaitMs } from "../computer-use/wait.js";
 import { createRestrictedCodexSession, } from "./restricted-session.js";
 import { PARTICIPANT_PROFILE, PARTICIPANT_LIMITS as L, PARTICIPANT_FINAL_SCHEMA, participantToolSchema, parseParticipantTool, parseParticipantFinal, } from "./restricted-participant-policy.js";
 import { truncatedFrameWarning, unknownNotificationsWarning } from "./restricted-notifications.js";
@@ -40,7 +41,7 @@ function deferred() {
     return { promise, resolve, reject };
 }
 // prose-check: model prompt (Codex reads this tool description, not a person)
-const toolDescription = (speechEnabled) => `Act on the participant's browser through humanish. Submit one to four UI actions${speechEnabled ? ", including speak when you need to reply aloud," : ""} and a short public comment; never private reasoning. humanish returns a JSON STRING with execution acknowledgments${speechEnabled ? ", speech heard from the actual participant speaker sink," : ""} and a fresh screenshot. In Code Mode use: const r = JSON.parse(await tools.humanish_ui({narration: "...", actions: [...]})); text({acknowledgments: r.acknowledgments${speechEnabled ? ", heardSpeech: r.heardSpeech" : ""}, contextHint: r.contextHint, closing: r.closing}); image(r.imageUrl). Call serially and inspect each returned screenshot${speechEnabled ? " and heardSpeech array" : ""} before deciding what to do next. A wait action lasts at most ${L.waitMs} ms; a longer wait is shortened to ${L.waitMs} ms, so wait longer with another call.${speechEnabled ? " Use speak only after the visible UI shows that you joined the call and your microphone is unmuted; it sends audio into that call." : ""} Acknowledged input does not prove an application outcome. If closing is true, stop calling tools and give your final account.`;
+const toolDescription = (speechEnabled, maxWaitMs) => `Act on the participant's browser through humanish. Submit one to four UI actions${speechEnabled ? ", including speak when you need to reply aloud," : ""} and a short public comment; never private reasoning. humanish returns a JSON STRING with execution acknowledgments${speechEnabled ? ", speech heard from the actual participant speaker sink," : ""} and a fresh screenshot. In Code Mode use: const r = JSON.parse(await tools.humanish_ui({narration: "...", actions: [...]})); text({acknowledgments: r.acknowledgments${speechEnabled ? ", heardSpeech: r.heardSpeech" : ""}, contextHint: r.contextHint, closing: r.closing}); image(r.imageUrl). Call serially and inspect each returned screenshot${speechEnabled ? " and heardSpeech array" : ""} before deciding what to do next. A wait action lasts at most ${maxWaitMs} ms; a longer wait is shortened to ${maxWaitMs} ms, so wait longer with another call.${speechEnabled ? " Use speak only after the visible UI shows that you joined the call and your microphone is unmuted; it sends audio into that call." : ""} Acknowledged input does not prove an application outcome. If closing is true, stop calling tools and give your final account.`;
 const participantInstructions = (prompt, speechEnabled) => `${prompt}\n\nYou are the study participant throughout this conversation, including its closing account. Use only the supplied screenshots and humanish_ui tool to interact. The tool returns a JSON string: parse it, inspect acknowledgments${speechEnabled ? " and heardSpeech captured from the actual participant speaker sink" : ""}, and display imageUrl with Code Mode image(). Do not print the image data URL as text. Keep your persona and earlier observations throughout the session.${speechEnabled ? " A speak action plays into the participant microphone; use it only after the visible UI shows that you joined the call and the microphone is unmuted." : ""} Speak publicly about your experience, never reveal private reasoning. Completed inputs do not prove application outcomes; verify on the next screenshot. When the task ends, return only the required final JSON with outcome, summary, frictionReports and impressions. Report observed confusion and recovered mistakes as well as blockers. ${IMPRESSIONS_ASK} Do not invent observations.`;
 /** Turns and failures from the native run, handed in order to the next provider request. */
 class ParticipantEvents {
@@ -191,7 +192,7 @@ function participantSession(options, speechEnabled, effort, call) {
             reasoningEffort: effort,
             tool: {
                 name: "humanish_ui",
-                description: toolDescription(speechEnabled),
+                description: toolDescription(speechEnabled, options.maxWaitMs ?? defaultMaxWaitMs(speechEnabled)),
                 inputSchema: participantToolSchema(speechEnabled),
                 call,
             },

package/dist/actors/computer-use/actor.d.ts

@@ -38,6 +38,10 @@ export interface CuaActorSessionOptions {
     acknowledgeSafetyChecks?: (checks: CuaSafetyCheck[]) => CuaSafetyCheck[] | null;
     idleSteps?: number;
     noProgressSteps?: number;
+    /** The longest one wait action lasts, forwarded to the loop. See LoopRunOptions.maxWaitMs. */
+    maxWaitMs?: number;
+    /** How long a wait with no duration lasts in an idle turn. See LoopRunOptions.idleWaitMs. */
+    idleWaitMs?: number;
     /**
      * Redact persisted screenshots (blur+downscale). Default `false`: full fidelity for local use.
      * Set true for unowned subjects or share-as-is bundles. The provider always sees raw frames.

package/dist/actors/computer-use/actor.js

@@ -31,6 +31,8 @@ export async function runCuaActorSession(options) {
         ...(options.signal === undefined ? {} : { signal: options.signal }),
         ...(options.idleSteps === undefined ? {} : { idleSteps: options.idleSteps }),
         ...(options.noProgressSteps === undefined ? {} : { noProgressSteps: options.noProgressSteps }),
+        ...(options.maxWaitMs === undefined ? {} : { maxWaitMs: options.maxWaitMs }),
+        ...(options.idleWaitMs === undefined ? {} : { idleWaitMs: options.idleWaitMs }),
         ...(options.acknowledgeSafetyChecks === undefined
             ? {}
             : { acknowledgeSafetyChecks: options.acknowledgeSafetyChecks }),

package/dist/actors/computer-use/loop/actions.d.ts

@@ -1,5 +1,5 @@
 import type { LoopSession } from "./session.js";
-import type { CuaAction, CuaTurnRequest, ShortenedWait } from "./types.js";
+import type { CuaAction, CuaTurnRequest } from "./types.js";
 /** A public-safe one-line action label. Never includes raw typed text. */
 export declare function describeCuaAction(action: CuaAction): string;
 /**
@@ -16,8 +16,8 @@ export interface ActionBatch {
     /** Host input acknowledgements for the provider's next request. */
     readonly execution: NonNullable<CuaTurnRequest["previousExecution"]>;
     /**
-     * Guidance for the next request, set when the provider shortened a wait or a pre-dispatch
-     * rejection stopped the batch.
+     * Guidance for the next request, set when the loop shortened a wait or a pre-dispatch rejection
+     * stopped the batch.
      */
     readonly hint: string | undefined;
 }
@@ -26,4 +26,4 @@ export interface ActionBatch {
  * leaves the desktop usable; a failed desktop command skips its action; any other failure ends
  * the session.
  */
-export declare function runActionBatch(session: LoopSession, actions: readonly CuaAction[], shortenedWaits?: readonly ShortenedWait[]): Promise<ActionBatch>;
+export declare function runActionBatch(session: LoopSession, actions: readonly CuaAction[]): Promise<ActionBatch>;

package/dist/actors/computer-use/loop/actions.js

@@ -3,6 +3,7 @@ import { commandFailureInfo, isCommandExitError } from "../../../substrates/comm
 import { ComputerUseExecutorError, isComputerUseExecutorError, } from "../executor-error.js";
 import { CuaAbortError, CuaDeadlineError, CuaStallError, raceCallBound, raceSessionDeadline, requestScope, } from "./race.js";
 import { notice } from "./trace.js";
+import { planWait } from "../wait.js";
 // The participant's actions: their public labels, what counts as a material action, and how one
 // turn's batch is dispatched to the desktop.
 /** Click/scroll coordinates are bucketed to this many pixels before fingerprinting, so a one-pixel
@@ -109,31 +110,31 @@ function rejectedActionHint(title, reason) {
     const remedy = reason === undefined ? "" : ` ${REJECTION_REMEDIES[reason]}`;
     return `Your action (${title}) was rejected before dispatch. No input from that action or the rest of its batch was sent.${remedy} Choose your next action from the fresh screenshot; do not assume the rejected action succeeded.`;
 }
-function shortenedWaitHint(wait) {
-    return `Your wait of ${wait.requestedMs}ms was shortened to ${wait.ms}ms, the longest one wait action lasts. To keep waiting, send another wait.`;
-}
-/** Record a wait the provider shortened, and return the participant's note about it. */
-function recordShortenedWait(session, title, wait) {
-    session.trace.record("notice", () => notice("warn", "wait shortened", `action: ${title}; requested: ${wait.requestedMs}ms; waited: ${wait.ms}ms, the longest one wait action lasts; the session continued`));
-    return shortenedWaitHint(wait);
+/** Record a wait the loop shortened, and return the participant's note about it. */
+function recordShortenedWait(session, title, requestedMs) {
+    const ms = session.waits.maxWaitMs;
+    session.trace.record("notice", () => notice("warn", "wait shortened", `action: ${title}; requested: ${requestedMs}ms; waited: ${ms}ms, the longest one wait action lasts (actor.maxWaitMs); the session continued`));
+    return `Your wait of ${requestedMs}ms was shortened to ${ms}ms, the longest one wait action lasts. To keep waiting, send another wait.`;
 }
 /**
  * Dispatch one turn's actions in order. A declared pre-dispatch rejection stops the batch and
  * leaves the desktop usable; a failed desktop command skips its action; any other failure ends
  * the session.
  */
-export async function runActionBatch(session, actions, shortenedWaits = []) {
+export async function runActionBatch(session, actions) {
     const execution = { actions: [] };
     const { actionHistory, trace } = session;
     const notes = [];
     const hint = () => (notes.length === 0 ? undefined : notes.join(" "));
-    for (const [index, action] of actions.entries()) {
+    const idleTurn = isIdleTurn(actions);
+    for (const [index, requested] of actions.entries()) {
         if (session.signal?.aborted)
             throw new CuaAbortError();
+        const wait = requested.kind === "wait" ? planWait(session.waits, requested.ms, idleTurn) : undefined;
+        const action = wait === undefined ? requested : { kind: "wait", ms: wait.ms };
         const title = describeCuaAction(action);
-        const shortened = shortenedWaits.find((wait) => wait.index === index);
-        if (shortened !== undefined)
-            notes.push(recordShortenedWait(session, title, shortened));
+        if (wait?.shortenedFromMs !== undefined)
+            notes.push(recordShortenedWait(session, title, wait.shortenedFromMs));
         actionHistory.lastActionTitle = title;
         actionHistory.recentActionTitles.push(title);
         if (actionHistory.recentActionTitles.length > RECENT_ACTION_TITLES)
@@ -146,7 +147,7 @@ export async function runActionBatch(session, actions, shortenedWaits = []) {
         session.phase = `executing ${title}`;
         let status;
         try {
-            status = await dispatchAction(session, action, title);
+            status = await dispatchAction(session, action, title, wait?.steps);
         }
         catch (error) {
             const declared = isComputerUseExecutorError(error)
@@ -201,17 +202,23 @@ function countAttempt(session, action, title, status) {
 }
 /**
  * Execute one action. Idle actions only look: a `wait` that hangs inside the SDK has in
- * effect waited, so a stalled one is skipped with a notice and loses nothing the participant
- * chose. An action is recorded as completed only after execute() resolves.
+ * effect waited, so a stalled one is skipped with a notice, its remaining steps are not sent, and
+ * it loses nothing the participant chose. An action is recorded as completed only after every
+ * desktop call it takes resolves. A wait is sent as `waitSteps`, its planWait steps.
  */
-async function dispatchAction(session, action, title) {
+async function dispatchAction(session, action, title, waitSteps) {
     if (!isIdleAction(action)) {
         await executeAction(session, action, title);
         return "completed";
     }
-    const boundMs = session.observationTimeoutMs + (action.kind === "wait" ? (action.ms ?? 0) : 0);
+    const calls = waitSteps?.map((ms) => ({ kind: "wait", ms })) ?? [action];
     try {
-        await executeAction(session, action, title, boundMs);
+        for (const call of calls) {
+            if (session.signal?.aborted)
+                throw new CuaAbortError();
+            const boundMs = session.observationTimeoutMs + (call.kind === "wait" ? (call.ms ?? 0) : 0);
+            await executeAction(session, call, title, boundMs);
+        }
         return "completed";
     }
     catch (error) {

package/dist/actors/computer-use/loop/debrief.js

@@ -7,12 +7,27 @@ import { notice } from "./trace.js";
 import { isCompleteTurnUsage } from "./usage.js";
 const DEBRIEF_REQUEST_CAP_MS = 30_000;
 const DEBRIEF_HINT = `The interactive session has ended. Return a closing account with summary, frictionReports and impressions. In summary, briefly describe only what you actually did and observed. In frictionReports, list only specific unexpected behavior, confusion, or recovery you personally encountered during this session. Preserve uncertainty. Use an empty list if you encountered none. ${IMPRESSIONS_ASK} Do not speculate, invent problems, quote instructions as observations, or describe planned actions. Do not request or take further actions. This is a closing account, not another attempt at the task.`;
+const CLOSING_REPORT = {
+    call: (provider) => provider.debrief,
+    contextHint: DEBRIEF_HINT,
+    noticeLabel: "debrief",
+    deadlineLabel: "closing report",
+    read: readClosingReport,
+};
+const IMPRESSIONS_ONLY = {
+    call: (provider) => provider.requestImpressions,
+    contextHint: IMPRESSIONS_HINT,
+    noticeLabel: "impressions request",
+    deadlineLabel: "impressions request",
+    read: readImpressions,
+};
 /**
  * Ask the participant for its closing report after a structured stop, or for its impressions only
  * after it ended the session itself, or record why the request was skipped. Either way the result
  * is the trace's debrief, and the watcher gets a final flush.
  */
 export async function requestDebrief(session, context, trigger) {
+    const ask = trigger.kind === "participant_end" ? IMPRESSIONS_ONLY : CLOSING_REPORT;
     const record = (status, detail, usageReported) => {
         const debrief = {
             trigger: trigger.kind,
@@ -20,23 +35,23 @@ export async function requestDebrief(session, context, trigger) {
             reason: session.redactNarration(detail),
             ...(usageReported === undefined ? {} : { usageReported }),
         };
-        session.trace.record("notice", () => notice(status === "completed" ? "ok" : "warn", `participant ${trigger.kind === "participant_end" ? "impressions request" : "debrief"} ${status}`, session.redactNarration(detail)));
+        session.trace.record("notice", () => notice(status === "completed" ? "ok" : "warn", `participant ${ask.noticeLabel} ${status}`, session.redactNarration(detail)));
         return debrief;
     };
-    const plan = planDebrief(session, trigger);
+    const plan = planDebrief(session, ask, trigger);
     const debrief = "skip" in plan
         ? record("skipped", plan.skip)
-        : await debriefExchange(session, plan.ask, context, trigger, plan.boundMs, record);
+        : await debriefExchange(session, context, trigger, ask, plan, record);
     session.flush();
     return debrief;
 }
-function planDebrief(session, trigger) {
+function planDebrief(session, ask, trigger) {
     const { provider, signal, usage } = session;
     const { maxUsd, overRunBudget, estimateTurnCostUsd } = session.settings;
     if (session.trace.counts.turns === 0)
         return { skip: "the study stopped before any participant turn" };
-    const ask = trigger.kind === "participant_end" ? provider.requestImpressions : provider.debrief;
-    if (ask === undefined)
+    const send = ask.call(provider)?.bind(provider);
+    if (send === undefined)
         return { skip: "this provider does not support read-only closing reports" };
     if (usage.cleanupUnconfirmed)
         return { skip: "participant request cleanup is unconfirmed" };
@@ -68,9 +83,9 @@ function planDebrief(session, trigger) {
             skip: signal?.aborted ? "the study was cancelled" : "the session deadline was reached",
         };
     }
-    return { ask, boundMs };
+    return { send, boundMs };
 }
-async function debriefExchange(session, ask, context, trigger, boundMs, record) {
+async function debriefExchange(session, context, trigger, ask, { send, boundMs }, record) {
     const { signal, provider } = session;
     const scope = requestScope(signal);
     const timer = setTimeout(() => scope.end(), boundMs);
@@ -89,12 +104,12 @@ async function debriefExchange(session, ask, context, trigger, boundMs, record)
             ...(context.acknowledgedSafetyChecks === undefined
                 ? {}
                 : { acknowledgedSafetyChecks: context.acknowledgedSafetyChecks }),
-            contextHint: trigger.kind === "participant_end" ? IMPRESSIONS_HINT : DEBRIEF_HINT,
+            contextHint: ask.contextHint,
         };
         const turn = provider.requestPolicy === "fail_closed"
-            ? await singleDispatch(session, "debrief", (dispatchSignal) => ask.call(provider, request, dispatchSignal), boundMs)
-            : await raceSessionDeadline(ask.call(provider, request, scope.signal), boundMs, signal);
-        return acceptDebriefTurn(session, turn, trigger, record);
+            ? await singleDispatch(session, "debrief", (dispatchSignal) => send(request, dispatchSignal), boundMs)
+            : await raceSessionDeadline(send(request, scope.signal), boundMs, signal);
+        return acceptDebriefTurn(session, turn, ask, record);
     }
     catch (error) {
         // A failed optional report cannot rewrite the already observed structured completion.
@@ -104,7 +119,7 @@ async function debriefExchange(session, ask, context, trigger, boundMs, record)
         const detail = signal?.aborted
             ? "cancelled"
             : scope.signal.aborted || error instanceof CuaDeadlineError
-                ? `${trigger.kind === "participant_end" ? "impressions request" : "closing report"} deadline reached`
+                ? `${ask.deadlineLabel} deadline reached`
                 : error instanceof Error
                     ? error.message
                     : String(error);
@@ -117,7 +132,7 @@ async function debriefExchange(session, ask, context, trigger, boundMs, record)
         scope.end();
     }
 }
-function acceptDebriefTurn(session, turn, trigger, record) {
+function acceptDebriefTurn(session, turn, ask, record) {
     const { maxUsd, overRunBudget, estimateTurnCostUsd } = session.settings;
     session.usage.record(turn, "debrief");
     session.lastResponseId = turn.responseId ?? session.lastResponseId;
@@ -133,19 +148,17 @@ function acceptDebriefTurn(session, turn, trigger, record) {
         return record("failed", "the closing response requested actions or safety checks; none were executed and its report was not accepted", usageReported);
     }
     // First-party providers parse their replies already; these parses cover third-party ports.
-    if (trigger.kind === "participant_end") {
-        const impressions = participantImpressionsSchema.safeParse(turn.impressions);
-        if (!impressions.success) {
-            return record("failed", turn.interruption === "output_limit"
-                ? "the reply was cut off by the output limit"
-                : "the reply did not contain valid impressions", usageReported);
-        }
-        session.impressions = recordImpressions(session, impressions.data);
-        return record("completed", "one read-only impressions request; no additional desktop actions; the participant's own ending is unchanged", usageReported);
-    }
+    const { status, detail, ...added } = ask.read(session, turn);
+    return { ...record(status, detail, usageReported), ...added };
+}
+/** A closing report: its summary and friction as one participant message, then its impressions. */
+function readClosingReport(session, turn) {
     const closing = closingReportSchema.safeParse(turn.closingReport);
     if (!closing.success) {
-        return record("failed", "the closing response did not contain a valid structured participant report", usageReported);
+        return {
+            status: "failed",
+            detail: "the closing response did not contain a valid structured participant report",
+        };
     }
     const report = {
         summary: session.redactNarration(closing.data.summary.trim()),
@@ -160,6 +173,27 @@ function acceptDebriefTurn(session, turn, trigger, record) {
     }));
     session.trace.bump("messages");
     session.impressions = recordImpressions(session, closing.data.impressions);
-    const debrief = record("completed", "one read-only report; no additional desktop actions; original stop and task outcomes preserved", usageReported);
-    return { ...debrief, report, messageId };
+    return {
+        status: "completed",
+        detail: "one read-only report; no additional desktop actions; original stop and task outcomes preserved",
+        report,
+        messageId,
+    };
+}
+/** Impressions alone, after the participant ended the session itself. */
+function readImpressions(session, turn) {
+    const impressions = participantImpressionsSchema.safeParse(turn.impressions);
+    if (!impressions.success) {
+        return {
+            status: "failed",
+            detail: turn.interruption === "output_limit"
+                ? "the reply was cut off by the output limit"
+                : "the reply did not contain valid impressions",
+        };
+    }
+    session.impressions = recordImpressions(session, impressions.data);
+    return {
+        status: "completed",
+        detail: "one read-only impressions request; no additional desktop actions; the participant's own ending is unchanged",
+    };
 }

package/dist/actors/computer-use/loop/session.d.ts

@@ -5,6 +5,7 @@ import type { DebriefTrigger, Stop } from "./ending.js";
 import { TraceRecorder } from "./trace.js";
 import type { CuaExecutor, CuaProvider, CuaSafetyCheck, LoopRunOptions } from "./types.js";
 import { UsageLedger } from "./usage.js";
+import { type WaitSettings } from "../wait.js";
 export type ScreenshotRef = NonNullable<ActorTraceItem["screenshotRef"]>;
 /**
  * The options with no default, read once at entry and passed through. Defaulted options and
@@ -34,6 +35,8 @@ export declare class LoopSession {
     readonly timeoutMs: number;
     readonly idleSteps: number;
     readonly noProgressSteps: number;
+    /** How long each wait lasts: the study's wait fields or their defaults. */
+    readonly waits: WaitSettings;
     readonly redactScreenshots: boolean;
     readonly now: () => number;
     readonly acknowledgeSafetyChecks: (checks: CuaSafetyCheck[]) => CuaSafetyCheck[] | null;

package/dist/actors/computer-use/loop/session.js

@@ -1,6 +1,7 @@
 import { TaskTracker } from "../../../study/tasks.js";
 import { TraceRecorder } from "./trace.js";
 import { UsageLedger } from "./usage.js";
+import { resolveWaitSettings } from "../wait.js";
 // The state one loop session shares across its phases: the options as read at entry, the session
 // clock, the trace being recorded, the usage ledger, and what the participant has done so far.
 // Waiting is a legitimate strategy. A persona verifying a sign-up by email polls its inbox
@@ -24,6 +25,8 @@ export class LoopSession {
     timeoutMs;
     idleSteps;
     noProgressSteps;
+    /** How long each wait lasts: the study's wait fields or their defaults. */
+    waits;
     redactScreenshots;
     // Injected functions are wrapped so they are called without a receiver, as plain functions.
     now;
@@ -67,7 +70,7 @@ export class LoopSession {
     scrubText;
     constructor(options) {
         // Read once, in this order: a caller mutating its options object mid-run changes nothing.
-        const { instructions, provider, executor, persona, redaction, timeoutMs, now, signal, idleSteps = DEFAULT_IDLE_STEPS, noProgressSteps = DEFAULT_NO_PROGRESS_STEPS, acknowledgeSafetyChecks = () => null, redactScreenshots = false, scrubText = (text) => text, writeScreenshot = async (name) => `screenshots/${name}`, stopWhen, dwell, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), tasks, maxUsd, overRunBudget, estimateTurnCostUsd, requireReportedUsageForSpendCap = false, onObservedUrl, onMessage, onScreenshot, onTrace, } = options;
+        const { instructions, provider, executor, persona, redaction, timeoutMs, now, signal, idleSteps = DEFAULT_IDLE_STEPS, noProgressSteps = DEFAULT_NO_PROGRESS_STEPS, maxWaitMs, idleWaitMs, acknowledgeSafetyChecks = () => null, redactScreenshots = false, scrubText = (text) => text, writeScreenshot = async (name) => `screenshots/${name}`, stopWhen, dwell, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), tasks, maxUsd, overRunBudget, estimateTurnCostUsd, requireReportedUsageForSpendCap = false, onObservedUrl, onMessage, onScreenshot, onTrace, } = options;
         this.settings = {
             instructions,
             persona,
@@ -89,6 +92,11 @@ export class LoopSession {
         this.timeoutMs = timeoutMs;
         this.idleSteps = idleSteps;
         this.noProgressSteps = noProgressSteps;
+        this.waits = resolveWaitSettings({
+            maxWaitMs,
+            idleWaitMs,
+            speechEnabled: executor.speechEnabled === true,
+        });
         this.redactScreenshots = redactScreenshots;
         this.now = () => now();
         this.acknowledgeSafetyChecks = (checks) => acknowledgeSafetyChecks(checks);

package/dist/actors/computer-use/loop/trace.js

@@ -123,6 +123,7 @@ export function loopResult(session, stop, debrief) {
                         : { maxOutputTokens: provider.modelSettings.maxOutputTokens }),
                 },
             }),
+        waitSettings: { ...session.waits },
         counts,
         items: recorder.items,
         ...(session.actionHistory.affordances.length > 0