humanish 0.115.0 → 0.117.0

package/dist/cli/findings.js

@@ -1,10 +1,11 @@
 // A run's analysis findings for `review`, `analyze show` and the end of a live `run`: the
-// `humanish.analysis-findings.v1` projection and its text. The analysis artifact stays the record;
-// this reads the version `analyze show` selects and never starts an analysis.
+// `humanish.analysis-findings.v1` projection, read from the run. findings-text.ts prints it. The
+// analysis artifact stays the record; this reads the version `analyze show` selects and never
+// starts an analysis.
 import path from "node:path";
 import { costRefusal } from "../analysis/admission.js";
 import { DEFAULT_ANALYSIS_MAX_COST_USD } from "../analysis/automatic-config.js";
-import { bySeverity, findingLead } from "../analysis/finding-lead.js";
+import { bySeverity } from "../analysis/finding-lead.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { projectShareCheckedAnalysis } from "../analysis/sharing.js";
 import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
@@ -15,6 +16,7 @@ import { routeOf } from "../study/routing.js";
 import { plural } from "../run/text.js";
 import { shellQuote } from "../substrates/shell.js";
 import { analysisOutcomeText, wantsJson } from "./io.js";
+import { formatFindingsSummary } from "./findings-text.js";
 import { cli } from "./invocation.js";
 export const ANALYSIS_FINDINGS_SCHEMA = "humanish.analysis-findings.v1";
 /** ` --cwd <dir>`, or "" when `cwd` is the current directory. */
@@ -287,170 +289,6 @@ export async function readRunFindings(cwd, run, analysisId) {
     const source = await readRunAnalysis(cwd, run, analysisId);
     return source ? analysisFindings(source) : missingRunFindings(cwd, run);
 }
-const IMPACT_TEXT = {
-    blocked_task: "blocked task",
-    friction: "friction",
-    recovery: "recovery",
-    uncertain: "uncertain",
-};
-const RECOVERY_TEXT = {
-    recovered: "recovered",
-    not_observed: "no recovery observed",
-    unknown: "recovery unknown",
-};
-/** `+1:05` from milliseconds since the first retained capture. */
-function elapsedText(ms) {
-    const seconds = Math.floor(ms / 1000);
-    const minutes = Math.floor(seconds / 60);
-    const hours = Math.floor(minutes / 60);
-    const ss = String(seconds % 60).padStart(2, "0");
-    return hours > 0
-        ? `+${hours}:${String(minutes % 60).padStart(2, "0")}:${ss}`
-        : `+${minutes}:${ss}`;
-}
-/** One participant's cited moments: each frame once, at its earliest cited time. */
-function momentsText(evidence) {
-    const frames = new Map();
-    let unframed = 0;
-    for (const entry of evidence) {
-        if (entry.frame === null) {
-            unframed++;
-            continue;
-        }
-        const earlier = frames.get(entry.frame);
-        if (earlier === undefined ||
-            (entry.elapsedMs !== null && (earlier ?? Infinity) > entry.elapsedMs))
-            frames.set(entry.frame, entry.elapsedMs);
-    }
-    const parts = [...frames]
-        .sort(([a], [b]) => a - b)
-        .map(([frame, ms]) => `frame ${frame}${ms === null ? "" : ` at ${elapsedText(ms)}`}`);
-    if (unframed > 0)
-        parts.push(`${plural(unframed, "item")} with no frame`);
-    return parts.join(", ");
-}
-/** The capture files, relative to the run directory, in frame order. */
-function captureFiles(evidence, runRoot) {
-    return [
-        ...new Set(evidence
-            .filter((entry) => entry.capture !== null)
-            .sort((a, b) => (a.frame ?? 0) - (b.frame ?? 0))
-            .map((entry) => (runRoot ? path.relative(runRoot, entry.capture) : entry.capture))),
-    ];
-}
-function findingLines(finding, runRoot) {
-    const cited = [...new Set(finding.evidence.map((entry) => entry.streamId))];
-    const labels = new Map(finding.affected.map((p) => [p.streamId, p.label]));
-    const affectedIds = finding.affected.map((p) => p.streamId);
-    const streams = [...affectedIds, ...cited.filter((id) => !labels.has(id))];
-    const captures = captureFiles(finding.evidence, runRoot);
-    const correction = finding.correction;
-    const lead = findingLead(finding, correction);
-    return [
-        ...(lead === null
-            ? [`${finding.id} ${finding.title}`]
-            : [
-                `${finding.id} ${lead.headline}`,
-                ...(lead.account === null ? [] : [`   ${lead.account}`]),
-                `   evidence: ${finding.title}`,
-            ]),
-        `   impact: ${IMPACT_TEXT[finding.impact]} · confidence: ${finding.confidence} · recovery: ${RECOVERY_TEXT[finding.recovery]}`,
-        `   ${finding.summary}`,
-        `   affected: ${finding.affected.length} of ${plural(finding.exposedCount, "exposed participant")}`,
-        ...streams.map((streamId) => {
-            const moments = momentsText(finding.evidence.filter((entry) => entry.streamId === streamId));
-            const label = `${labels.get(streamId) ?? streamId}${labels.has(streamId) ? "" : " (cited, not affected)"}`;
-            return `   - ${label}${moments ? `: ${moments}` : ""}`;
-        }),
-        ...(captures.length === 0 ? [] : [`   captures: ${captures.join(", ")}`]),
-        `   next step: ${finding.nextStep}`,
-        ...(correction === null
-            ? []
-            : [
-                `   human review: ${correction.status}, ${correction.reason}${correction.replacementClaim ? ` Amended claim: ${correction.replacementClaim}` : ""}`,
-            ]),
-    ];
-}
-function designFindingLines(finding, runRoot) {
-    const captures = captureFiles(finding.evidence, runRoot);
-    return [
-        `${finding.id} ${finding.severity}: ${finding.headline}`,
-        `   screen: ${finding.screen}`,
-        `   notice: ${finding.notice}`,
-        `   why it matters: ${finding.whyItMatters}`,
-        `   suggestion: ${finding.suggestion}`,
-        `   seen by: ${finding.seenBy.map((p) => p.label).join(", ")} · confidence: ${finding.confidence}`,
-        ...(captures.length === 0 ? [] : [`   captures: ${captures.join(", ")}`]),
-    ];
-}
-/** Nothing for an analysis written before design findings. */
-function designSection(view) {
-    const design = view.designFindings;
-    if (design === null)
-        return [];
-    if (design.length === 0)
-        return ["", "design findings: none in the reviewed captures"];
-    return [
-        "",
-        `design findings: ${design.length}, most severe first`,
-        ...design.flatMap((finding, index) => [
-            ...(index === 0 ? [] : [""]),
-            ...designFindingLines(finding, view.runPath ?? ""),
-        ]),
-    ];
-}
-/** The full findings block: the analysis, every finding with its evidence, and its limitations. */
-export function formatFindings(view) {
-    if (view.state !== "ready" && view.state !== "stale")
-        return [`findings: none. ${view.message}`, ...(view.next ? [`next: ${view.next}`] : [])];
-    const model = [view.provider, view.model].filter(Boolean).join(" ");
-    const cost = view.estimatedCostUsd === null ? "" : `, estimated $${view.estimatedCostUsd.toFixed(2)}`;
-    return [
-        `findings: ${view.findings.length} from analysis ${view.analysisId} (${view.status}, ${model}${cost})`,
-        ...(view.state === "stale" ? [`warning: ${view.message}`, `next: ${view.next}`] : []),
-        ...(view.summary ? [view.summary] : []),
-        ...view.findings.flatMap((finding) => ["", ...findingLines(finding, view.runPath ?? "")]),
-        ...designSection(view),
-        ...(view.limitations.length === 0
-            ? []
-            : ["", "limitations:", ...view.limitations.map((limitation) => `- ${limitation}`)]),
-        ...view.warnings.map((warning) => `warning: ${warning}`),
-        "",
-        `analysis: ${view.path}`,
-    ];
-}
-/** At most `limit` findings, one line each, and the command that prints all of them. */
-export function formatFindingsSummary(view, fullCommand, limit = 3) {
-    if (view.state !== "ready" && view.state !== "stale")
-        return [`findings: ${view.message}`, ...(view.next ? [`next: ${view.next}`] : [])];
-    const shown = view.findings.slice(0, limit);
-    const design = view.designFindings;
-    return [
-        `findings: ${view.findings.length === 0 ? "none" : view.findings.length}${view.state === "stale" ? " (stale)" : ""}`,
-        ...shown.map((finding) => {
-            const qualities = `${IMPACT_TEXT[finding.impact]}, ${finding.confidence} confidence, ${RECOVERY_TEXT[finding.recovery]}`;
-            const lead = findingLead(finding, finding.correction);
-            if (lead === null)
-                return `- ${finding.id} ${qualities}: ${finding.title}`;
-            return `- ${finding.id} ${lead.headline} (${lead.corrected ? "corrected in human review" : qualities})`;
-        }),
-        ...(view.findings.length > limit
-            ? [`- and ${plural(view.findings.length - limit, "more finding")}`]
-            : []),
-        ...(design === null
-            ? []
-            : [
-                `design findings: ${design.length === 0 ? "none" : design.length}`,
-                ...design
-                    .slice(0, limit)
-                    .map((finding) => `- ${finding.id} ${finding.severity}: ${finding.headline}`),
-                ...(design.length > limit
-                    ? [`- and ${plural(design.length - limit, "more design finding")}`]
-                    : []),
-            ]),
-        `all findings: ${fullCommand}`,
-    ];
-}
 /**
  * The end of a live run's human output, after its `analysis:` line: the findings of the analysis
  * the run just completed. Prints nothing for --json, or when the run's analysis did not complete,

package/dist/cli/io.js

@@ -186,7 +186,12 @@ export function writeResult(command, io, result, formatHuman) {
     }
     else {
         writeHuman(command, io, formatHuman(output));
-        if (output !== null && typeof output === "object" && "automaticAnalysis" in output) {
+        // A run refused before it was created has no analysis to report, so its output ends with the
+        // refusal. Its JSON keeps the skip record.
+        if (output !== null &&
+            typeof output === "object" &&
+            "automaticAnalysis" in output &&
+            output.runId !== "not-created") {
             const analysis = output.automaticAnalysis;
             const cost = analysis?.result?.admission && refusedCost(analysis.result.admission);
             const refusal = cost && costRefusal(cost, `--run ${analysis.result?.run ?? "latest"}`, cli);

package/dist/cli/update-check.js

@@ -61,7 +61,9 @@ function dayPassed(timestamp, now) {
  * Only a person at a terminal is told, and only when nothing has switched the check off. A pipe,
  * CI and a JSON document have a program reading them. A study participant runs the version the
  * study chose, and a notice would send it to another. The telemetry switches turn this off too:
- * someone who opted out of telemetry expects no unprompted requests.
+ * someone who opted out of telemetry expects no unprompted requests. NO_UPDATE_NOTIFIER is the
+ * switch the update-notifier package reads, and it is read the same way, so any value, even `0`,
+ * turns the check off for someone who set it for the CLIs built on that package.
  */
 function checkAllowed(context) {
     const env = context.env;
@@ -70,6 +72,7 @@ function checkAllowed(context) {
         !context.ownCheckout &&
         !envFlag(env.CI) &&
         !envFlag(env.HUMANISH_NO_UPDATE_CHECK) &&
+        env.NO_UPDATE_NOTIFIER === undefined &&
         !envFlag(env.HUMANISH_STUDY_PARTICIPANT) &&
         !disabledByEnvironment(env));
 }

package/dist/comms/connections.js

@@ -54,12 +54,13 @@ export async function readCommsConnections(cwd) {
         return empty();
     if ((await lstat(file)).size > 65_536)
         throw new Error("Connection configuration is too large.");
-    const bytes = await readContainedRegularFile(root, "comms.yaml");
-    if (!bytes || bytes.length > 65_536)
+    const read = await readContainedRegularFile(root, "comms.yaml", 65_536);
+    // Gone since the check above, or refused: either way it cannot be read safely.
+    if (read.status !== "read")
         throw new Error("Cannot safely read connection configuration.");
     // YAML diagnostics may echo the offending value; do not let them reach a status or frame.
     try {
-        return parseConnections(parse(bytes.toString("utf8"), { maxAliasCount: 0 }));
+        return parseConnections(parse(read.bytes.toString("utf8"), { maxAliasCount: 0 }));
     }
     catch {
         throw new Error("Invalid connection configuration.");

package/dist/comms/setup.js

@@ -13,6 +13,14 @@ import { resolveStudyManifest } from "../study/discover.js";
 import { assertPreparedSelectedOutputDirectory, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, readContainedRegularFile, writeContainedOutputFile, } from "../run/contained-output.js";
 import { otherStudyFiles } from "../study/files.js";
 import { isNodeError } from "../run/type-guards.js";
+/** The most of a study file the receiving copy reads, for its source and its destination. */
+const MAX_STUDY_COPY_BYTES = 1024 * 1024;
+/** The read found exactly `expected`, or found nothing where `expected` is null. */
+function readsAs(read, expected) {
+    return expected === null
+        ? read.status === "missing"
+        : read.status === "read" && read.bytes.equals(expected);
+}
 export async function checkCommsConnection(args) {
     const base = {
         schema: "humanish.comms-check.v1",
@@ -128,9 +136,10 @@ export async function configureCommsStudy(args) {
         const rel = path
             .relative(root.requestedPath, path.resolve(args.cwd, source.path))
             .replace(/\\/g, "/");
-        const bytes = await readContainedRegularFile(root, rel);
-        if (!bytes || bytes.length > 1024 * 1024)
+        const sourceRead = await readContainedRegularFile(root, rel, MAX_STUDY_COPY_BYTES);
+        if (sourceRead.status !== "read")
             return { ...base, message: "The study file is missing or too large." };
+        const bytes = sourceRead.bytes;
         const text = bytes.toString("utf8");
         const raw = parse(text);
         if (!raw || typeof raw !== "object" || Array.isArray(raw))
@@ -182,13 +191,12 @@ export async function configureCommsStudy(args) {
                 ...base,
                 message: `${others.join(", ")} already uses the name ${stem}. Rename or remove it before configuring email, so \`run ${stem}\` reads one file.`,
             };
-        let prior;
-        try {
-            prior = await readContainedRegularFile(root, destination);
-        }
-        catch {
+        // An existing destination is replaced only when its bytes are in the plan token, so one that
+        // cannot be read whole is refused instead of being taken as absent.
+        const destinationRead = await readContainedRegularFile(root, destination, MAX_STUDY_COPY_BYTES);
+        if (destinationRead.status === "refused")
             return { ...base, message: "The local destination could not be read safely." };
-        }
+        const prior = destinationRead.status === "read" ? destinationRead.bytes : null;
         const content = String(study);
         const token = createHash("sha256")
             .update(bytes)
@@ -219,10 +227,8 @@ export async function configureCommsStudy(args) {
         const lock = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
         const identity = await lock.stat();
         try {
-            const currentSource = await readContainedRegularFile(root, rel);
-            const currentDestination = await readContainedRegularFile(root, destination);
-            if (!currentSource?.equals(bytes) ||
-                (prior === null ? currentDestination !== null : !currentDestination?.equals(prior)))
+            const reread = (file) => readContainedRegularFile(root, file, MAX_STUDY_COPY_BYTES);
+            if (!readsAs(await reread(rel), bytes) || !readsAs(await reread(destination), prior))
                 return { ...base, message: "Files changed while saving. Preview again." };
             await writeContainedOutputFile(directory, filename, content, "utf8");
         }

package/dist/evidence/redaction.js

@@ -182,7 +182,15 @@ export function containsSensitive(text) {
 // suffix so redaction cannot turn a string's contents into JSON delimiters.
 // This also works when the closing quote arrives in a later stream callback.
 function redactLocalPaths(text, label) {
-    return LOCAL_PATH_PATTERNS.reduce((current, [pattern, replacement]) => current.replace(pattern, (match) => (label ?? replacement) + (match.match(/\\+$/)?.[0] ?? "")), text);
+    return LOCAL_PATH_PATTERNS.reduce((current, [pattern, replacement]) => current.replace(pattern, (match) => (label ?? replacement) + trailingBackslashes(match)), text);
+}
+// Read from the end: `/\\+$/` retries a run of backslashes from each of its characters when
+// something follows the run, which took 1.4 s on a path holding 40,000 of them.
+function trailingBackslashes(text) {
+    let start = text.length;
+    while (start > 0 && text.charCodeAt(start - 1) === 0x5c)
+        start -= 1;
+    return text.slice(start);
 }
 /**
  * What a shared copy of a run says in place of a provider sandbox id. scripts/public-surface-scan.mjs

package/dist/evidence/secret-scrub.d.ts

@@ -1,12 +1,22 @@
 /**
  * A value as written, and percent-encoded, JSON-escaped once (also with non-ASCII characters as
- * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 at each
- * byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as
- * a string. An
- * escaped form is searched for at any length, as the value is: it holds a backslash or a `%`, so it
- * is not ordinary text.
+ * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 padded,
+ * unpadded and at each byte offset, base64url and hex. Twice, because a JSON event can carry a
+ * command's JSON output as a string. An escaped form is searched for at any length, as the value
+ * is: it holds a backslash or a `%`, so it is not ordinary text. A base64 or hex form is searched
+ * for from MIN_ENCODED_FORM characters, so a four-byte value is found in base64 written whole and
+ * not inside a longer run, where four or five of its characters do not depend on its neighbours.
  */
 export declare function encodedForms(value: string): string[];
+/**
+ * A scrub that replaces each non-empty value as written with `[REDACTED_SECRET]`, markers
+ * included. From the start of the text, the longest value that starts at a position is replaced
+ * and the search goes on after it, so the marker it writes is never searched. One global regex of
+ * the values, longest first, does that fastest. V8 compiles it at its first use and refuses it
+ * once a value has 32,768 characters; the scrub then finds each value itself, with the same
+ * output, in time linear in the text for each value.
+ */
+export declare function scrubValuesAsWritten(values: readonly string[]): (text: string) => string;
 /**
  * A check that the text holds one of the values' forms outside the markers in any of its
  * readingsOf. A scrub's output must pass it.

package/dist/evidence/secret-scrub.js

@@ -10,9 +10,12 @@ const REDACTED = REDACTION_MARKERS.secret;
 // of the marker's name. Other bracketed text, such as `[REDACTED_373433393231]`, is searched like
 // any text.
 const MARKER = new RegExp(Object.values(REDACTION_MARKERS).map(escapeRegExp).join("|"), "g");
-// The shortest encoded form searched for. Shorter base64 or hex runs are ordinary text often enough
-// that matching them would redact words. A value itself is searched for at any length.
-const MIN_ENCODED_FORM = 8;
+// The shortest encoded form searched for: the unpadded base64 of a four-byte value, such as a
+// four-digit code. A given form of n characters turns up by chance in random base64 about once in
+// 64^n characters, once in 69 billion at 6 and once in 17 million at 4. In the text of 9 real runs
+// (2.5 million characters) no 6- or 7-character form of any 4-, 5- or 6-digit code occurred. A
+// value itself is searched for at any length.
+const MIN_ENCODED_FORM = 6;
 /**
  * The characters of a value's base64 encoding that do not depend on its neighbours, with 0, 1 or
  * 2 bytes before it. A prefix byte shares the next character with the value, and so does the byte
@@ -31,11 +34,12 @@ function base64Middles(bytes, encoding) {
 }
 /**
  * A value as written, and percent-encoded, JSON-escaped once (also with non-ASCII characters as
- * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 at each
- * byte offset, base64url and hex. Twice, because a JSON event can carry a command's JSON output as
- * a string. An
- * escaped form is searched for at any length, as the value is: it holds a backslash or a `%`, so it
- * is not ordinary text.
+ * `\u` escapes) and twice, its UTF-8 bytes read one per character and the reverse, base64 padded,
+ * unpadded and at each byte offset, base64url and hex. Twice, because a JSON event can carry a
+ * command's JSON output as a string. An escaped form is searched for at any length, as the value
+ * is: it holds a backslash or a `%`, so it is not ordinary text. A base64 or hex form is searched
+ * for from MIN_ENCODED_FORM characters, so a four-byte value is found in base64 written whole and
+ * not inside a longer run, where four or five of its characters do not depend on its neighbours.
  */
 export function encodedForms(value) {
     const bytes = Buffer.from(value, "utf8");
@@ -51,8 +55,10 @@ export function encodedForms(value) {
     catch {
         // no percent-encoded form
     }
+    const base64 = bytes.toString("base64");
     const binary = [
-        bytes.toString("base64"),
+        base64,
+        base64.replace(/=+$/, ""),
         bytes.toString("base64url"),
         bytes.toString("hex"),
         ...base64Middles(bytes, "base64"),
@@ -127,6 +133,58 @@ function eachOccurrence(text, form, found) {
         at = matched > 0 ? -1 : text.indexOf(form, next);
     }
 }
+/**
+ * Each value's occurrences, the longest value that starts at a position replaced from the start of
+ * the text on, in time linear in the text for each value.
+ */
+function replaceLongestFirst(text, values) {
+    // The length of the longest value that starts at each position, allocated at the first find.
+    let longest;
+    for (const value of values)
+        eachOccurrence(text, value, (at) => {
+            longest ??= new Uint32Array(text.length);
+            longest[at] = Math.max(longest[at], value.length);
+        });
+    if (longest === undefined)
+        return text;
+    let result = "";
+    let cursor = 0;
+    for (let at = 0; at < text.length; at += 1) {
+        if (longest[at] === 0)
+            continue;
+        result += text.slice(cursor, at) + REDACTED;
+        cursor = at + longest[at];
+        at = cursor - 1;
+    }
+    return result + text.slice(cursor);
+}
+/**
+ * A scrub that replaces each non-empty value as written with `[REDACTED_SECRET]`, markers
+ * included. From the start of the text, the longest value that starts at a position is replaced
+ * and the search goes on after it, so the marker it writes is never searched. One global regex of
+ * the values, longest first, does that fastest. V8 compiles it at its first use and refuses it
+ * once a value has 32,768 characters; the scrub then finds each value itself, with the same
+ * output, in time linear in the text for each value.
+ */
+export function scrubValuesAsWritten(values) {
+    const written = [...new Set(values)].filter((value) => value.length > 0);
+    if (written.length === 0)
+        return (text) => text;
+    let pattern = new RegExp([...written]
+        .sort((left, right) => right.length - left.length)
+        .map(escapeRegExp)
+        .join("|"), "g");
+    return (text) => {
+        if (pattern !== undefined)
+            try {
+                return text.replace(pattern, REDACTED);
+            }
+            catch {
+                pattern = undefined;
+            }
+        return replaceLongestFirst(text, written);
+    };
+}
 /** Every occurrence of every form not wholly inside a marker, in no order. */
 function occurrences(text, forms) {
     const markers = [];

package/dist/feedback/draft.js

@@ -11,7 +11,7 @@ import { loadRunBundlePrepared } from "../run/locate.js";
 import { isFeedbackIdempotencyKey } from "../run/feedback-shape.js";
 import { runNoteFile } from "../run/note-files.js";
 import { byRunTime } from "../run/note-shape.js";
-import { formatRunTime } from "../run/notes.js";
+import { formatRunTime } from "../run/run-clock.js";
 import { runParticipantCaptions } from "../run/participant-records.js";
 import { isRecord } from "../run/type-guards.js";
 import { feedbackProofCommands, projectFeedbackAcceptanceProof } from "./proof.js";

package/dist/feedback/export-bundle.js

@@ -12,16 +12,16 @@ import { inventorySandboxIds, scrubSandboxIdBytes } from "../run/sandbox-ids.js"
 import { containsSensitive, redactSandboxIds, redactScreenshot, redactText, } from "../evidence/redaction.js";
 import { decodeEscapes, readingsOf } from "../evidence/encoded-text.js";
 import { readPlainText } from "../evidence/plain-text.js";
-import { streamScreenshotPaths } from "../verify/artifacts.js";
+import { MAX_RUN_ENTRIES, streamScreenshotPaths } from "../verify/artifacts.js";
 import { verifyRunPrepared } from "../verify/verify.js";
 import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
 import {} from "../run/bundle.js";
 import { runIdOf, isPathInside, prepareRunArtifactPaths, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { isAnalysisRecordPath } from "../analysis/sharing.js";
 import { LOCAL_ONLY_RUN_FILES } from "../run/local-only-files.js";
-import { assertPreparedSelectedOutputDirectory, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, readContainedRegularFile, writeContainedOutputFile, } from "../run/contained-output.js";
+import { readUnchangedFile } from "../run/evidence-files.js";
+import { assertPreparedSelectedOutputDirectory, prepareManagedHumanishOutputDirectory, prepareSelectedOutputDirectory, writeContainedOutputFile, } from "../run/contained-output.js";
 const DERIVATION_SCHEMA = "humanish.redacted-derivation.v1";
-const MAX_FILES = 10_000;
 const TEXT_EXTENSIONS = new Set([
     ".json",
     ".ndjson",
@@ -69,8 +69,8 @@ async function inventory(root, maxBytes) {
         if (!before.isDirectory() || before.isSymbolicLink())
             throw new Error("Source contains an unsafe directory.");
         for (const name of (await readdir(directory)).sort()) {
-            if (++entriesSeen > MAX_FILES)
-                throw new Error(`Source exceeds ${MAX_FILES} inventory entries.`);
+            if (++entriesSeen > MAX_RUN_ENTRIES)
+                throw new Error(`Source exceeds ${MAX_RUN_ENTRIES} inventory entries.`);
             if (name.includes("\\") || name.includes("\0"))
                 throw new Error("Source contains an unsafe path segment.");
             const rel = relative ? `${relative}/${name}` : name;
@@ -86,15 +86,17 @@ async function inventory(root, maxBytes) {
             else {
                 if (path.extname(rel).toLowerCase() === ".mp4")
                     throw new Error("Continuous video/audio cannot be redacted by bundle export. Use --local-only HTML export for a snapshot-only copy.");
-                if (info.size > BigInt(maxBytes - total))
-                    throw new Error("Source inventory exceeds --max-bytes.");
-                const bytes = await readContainedRegularFile(root, rel);
-                if (bytes === null)
+                // At most what is left of --max-bytes, so a file that grows after this lstat is refused
+                // unread. With nothing left, an empty file still reads and any other is refused.
+                const read = await readUnchangedFile(root, rel, Math.max(1, maxBytes - total));
+                if (read.state === "unavailable")
                     throw new Error("Source artifact could not be read through its bound identity.");
-                total += bytes.length;
+                if (read.state === "limit")
+                    throw new Error("Source inventory exceeds --max-bytes.");
+                total += read.bytes.length;
                 if (total > maxBytes)
                     throw new Error("Source inventory exceeds --max-bytes.");
-                files.push({ path: rel, bytes, sha256: hash(bytes) });
+                files.push({ path: rel, bytes: read.bytes, sha256: hash(read.bytes) });
             }
         }
         const after = await lstat(directory, { bigint: true });
@@ -541,10 +543,12 @@ async function buildDerivative(stage, source, runId, bundle, maxBytes) {
         throw new Error("Derivative Observer could not be rebuilt.");
     const generated = [];
     for (const relative of ["observer/index.html", "observer/observer-data.json"]) {
-        const bytes = await readContainedRegularFile(stagePaths, relative);
-        if (bytes === null)
+        const read = await readUnchangedFile(stagePaths, relative, maxBytes);
+        if (read.state === "limit")
+            throw new Error("The regenerated Observer exceeds --max-bytes.");
+        if (read.state === "unavailable")
             throw new Error("Regenerated Observer artifact could not be read safely.");
-        generated.push({ path: relative, sha256: hash(bytes) });
+        generated.push({ path: relative, sha256: hash(read.bytes) });
     }
     await writeContainedOutputFile(stagePaths, "derivation.json", jsonBytes({ ...receipt, generated }));
     const derivativeVerify = await verifyRunPrepared(stage.physicalPath, runId, stagePaths);

package/dist/feedback/feedback.js

@@ -4,7 +4,7 @@ import { realpath } from "node:fs/promises";
 import { runNotFoundMessage } from "../run/run-not-found.js";
 import path from "node:path";
 import { bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveLatestRunDirectory, validatePreparedRunArtifactPaths, } from "../run/paths.js";
-import { bindExistingManagedHumanishOutputDirectory, readContainedRegularFile, writeContainedOutputFile, } from "../run/contained-output.js";
+import { bindExistingManagedHumanishOutputDirectory, ContainedReadRefusedError, LATEST_POINTER_MAX_BYTES, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, } from "../run/contained-output.js";
 import { loadRunBundlePrepared } from "../run/locate.js";
 import { readNotesForSharing } from "../run/note-files.js";
 import { cli } from "../cli/invocation.js";
@@ -208,7 +208,9 @@ async function isSafeFeedbackEvidenceFile(context, evidencePath) {
         path.isAbsolute(relative)) {
         return false;
     }
-    return (await readContainedRegularFile(context.preparedRunPaths, relative)) !== null;
+    // Evidence a draft cites must be readable: a refused file is listed with the missing ones.
+    const read = await readContainedRegularFile(context.preparedRunPaths, relative, RUN_ARTIFACT_MAX_BYTES);
+    return read.status === "read";
 }
 export async function renderIssueMarkdown(cwdInput, runInput, repo, options = {}) {
     const verified = await verifyFeedbackBound(cwdInput, runInput, options);
@@ -253,9 +255,22 @@ export async function listFeedback(cwdInput, runInput) {
             },
         };
     }
-    const draftBytes = await readContainedRegularFile(context.preparedRunPaths, path.join("feedback", "draft.json"));
-    const draft = draftBytes === null ? undefined : JSON.parse(draftBytes.toString("utf8"));
+    const draftRead = await readContainedRegularFile(context.preparedRunPaths, path.join("feedback", "draft.json"), RUN_ARTIFACT_MAX_BYTES);
     const draftPath = path.join(context.preparedRunPaths.relativeRunRoot, "feedback", "draft.json");
+    if (draftRead.status === "refused")
+        return {
+            schema: FEEDBACK_RESULT_SCHEMA,
+            ok: false,
+            cwd,
+            run: runInput,
+            error: {
+                code: "HUMANISH_INVALID_FEEDBACK_DRAFT",
+                message: `The feedback draft could not be read: ${refusalText(draftPath, draftRead)}.`,
+            },
+        };
+    const draft = draftRead.status === "missing"
+        ? undefined
+        : JSON.parse(draftRead.bytes.toString("utf8"));
     return {
         schema: FEEDBACK_RESULT_SCHEMA,
         ok: true,
@@ -284,10 +299,13 @@ async function resolveFeedbackRunContext(cwd, runInput) {
         const runsRoot = await bindExistingManagedHumanishOutputDirectory(physicalCwd, "runs");
         if (!runsRoot)
             return null;
-        const pointerBytes = await readContainedRegularFile(runsRoot, "latest.json");
-        if (!pointerBytes)
+        const pointerRead = await readContainedRegularFile(runsRoot, "latest.json", LATEST_POINTER_MAX_BYTES);
+        if (pointerRead.status === "missing")
             return null;
-        const pointer = JSON.parse(pointerBytes.toString("utf8"));
+        // A pointer that is there and refused names no run, and saying so beats "run not found".
+        if (pointerRead.status === "refused")
+            throw new ContainedReadRefusedError(path.join(".humanish", "runs", "latest.json"), pointerRead);
+        const pointer = JSON.parse(pointerRead.bytes.toString("utf8"));
         if (typeof pointer.runId !== "string" ||
             typeof pointer.path !== "string" ||
             !resolveLatestRunDirectory(physicalCwd, { path: pointer.path, runId: pointer.runId })) {

package/dist/guest/desktop-executor.js

@@ -1,5 +1,6 @@
 import { perceptualSignature } from "../evidence/frame-signature.js";
 import { setTimeout as delay } from "node:timers/promises";
+import { CUA_WAIT_LIMITS } from "../actors/computer-use/wait.js";
 import { BROWSER_CONTROL_LIMITS, validateBrowserControlAction, validateBrowserControlPng, } from "../browser-control/protocol.js";
 import { ComputerUseExecutorError, isComputerUseExecutorError, } from "../actors/computer-use/executor-error.js";
 import { xdotoolChord, xdotoolHeldModifiers } from "./desktop-keys.js";
@@ -104,8 +105,9 @@ async function executeAction(context, state, value, callerSignal) {
                 throw error;
             }
         }
+        // The loop sends every wait with its length; planWait owns the lengths.
         if (action.kind === "wait")
-            await delay(action.ms ?? 250, undefined, { signal });
+            await delay(action.ms ?? CUA_WAIT_LIMITS.settleMs, undefined, { signal });
         for (const command of commands) {
             assertOpen(state, signal, progress.dispatched);
             // No await between authority check and the native port invocation.