humanish 0.122.0 → 0.123.0

package/dist/run/stream-trace.js

@@ -0,0 +1,260 @@
+// Where a participant's trace lives. A v1 run.json holds every stream's trace items and screenshot
+// entries inline. From v2 the run writer moves them into one file per stream and leaves an index
+// in run.json, so run.json stays a summary whatever the length of the sessions. Every reader that
+// needs the items loads them here, which accepts both versions and checks a file against its index.
+import { createHash } from "node:crypto";
+import { RUN_BUNDLE_SCHEMA } from "./bundle.js";
+import { readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
+import { isRunStreamArtifact, isStreamTraceIndex, isStreamTracePath } from "./stream-shape.js";
+import { isRecord } from "./type-guards.js";
+/** A trace that does not match its index, or cannot be read. The message names the stream. */
+export class StreamTraceRefusedError extends Error {
+    streamId;
+    constructor(streamId, detail) {
+        super(`Participant ${streamId}'s trace was not read: ${detail}. A trace file must stay as the run wrote it; restore the run folder from a copy.`);
+        this.streamId = streamId;
+        this.name = "StreamTraceRefusedError";
+    }
+}
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const isScreenshot = (artifact) => artifact.kind === "screenshot";
+/**
+ * The file a trace path names on any file system. Trace file names are ASCII (isStreamTracePath),
+ * so lower case folds them as a case-insensitive file system does: actors/Case.json and
+ * actors/case.json are one file there.
+ */
+const traceFileKey = (tracePath) => tracePath.toLowerCase();
+/** Names of the form actors/<n>.json, which the splitter gives by position and never reuses. */
+const POSITION_TRACE_FILE = /^actors\/\d+\.json$/;
+/**
+ * The stream's actor trace artifact (actor.json, actors/<stream>.json, actor-<surface>.json) when
+ * no earlier stream claimed it (compared by traceFileKey), else actors/<position>.json. The
+ * position names are a namespace of their own: an artifact named that way is not reused, so two
+ * streams never get one file. Another trace artifact (the scripted route's traces/<surface>.json
+ * holds its native step trace) keeps its own file.
+ */
+function tracePath(stream, index, claimed) {
+    const own = stream.artifacts.find((artifact) => artifact.kind === "trace" &&
+        isStreamTracePath(artifact.path) &&
+        !POSITION_TRACE_FILE.test(artifact.path))?.path;
+    return own !== undefined && !claimed.has(traceFileKey(own)) ? own : `actors/${index + 1}.json`;
+}
+/**
+ * The run.json the run writes, and the trace files it writes first. Each stream with a finished
+ * actor keeps that actor without `items`, its artifacts other than screenshots, and an index of its
+ * trace file; the file is the actor trace with the stream's screenshot entries as `artifacts`. A
+ * stream already split (its actor read back from a v2 run.json without its items) keeps its index,
+ * since its file is on disk.
+ */
+export function splitStreamTraces(bundle) {
+    const files = [];
+    const claimed = new Set();
+    for (const stream of bundle.streams)
+        if (stream.trace)
+            claimed.add(traceFileKey(stream.trace.path));
+    const streams = bundle.streams.map((stream, index) => {
+        const actor = stream.actor;
+        if (actor === undefined || !Array.isArray(actor.items))
+            return stream;
+        const { trace: _previous, ...rest } = stream;
+        const filePath = tracePath(rest, index, claimed);
+        // Only a stream already split that moved position can hold this stream's position name.
+        if (claimed.has(traceFileKey(filePath)))
+            throw new Error(`Two participants' traces would both be written to ${filePath}.`);
+        claimed.add(traceFileKey(filePath));
+        const screenshots = stream.artifacts.filter(isScreenshot);
+        const bytes = Buffer.from(`${JSON.stringify({ ...actor, artifacts: screenshots }, null, 2)}\n`);
+        files.push({ path: filePath, bytes });
+        const { items, ...summary } = actor;
+        return {
+            ...rest,
+            // run.json's actor is the summary: every field of the trace except its items.
+            actor: summary,
+            artifacts: stream.artifacts.filter((artifact) => !isScreenshot(artifact)),
+            trace: {
+                path: filePath,
+                bytes: bytes.length,
+                sha256: sha256(bytes),
+                items: items.length,
+                screenshots: screenshots.length,
+            },
+        };
+    });
+    return { bundle: { ...bundle, schema: RUN_BUNDLE_SCHEMA, streams }, files };
+}
+function containedReader(runPaths) {
+    return async (relativePath, maxBytes) => {
+        const read = await readContainedRegularFile(runPaths, relativePath, maxBytes);
+        if (read.status === "missing")
+            return { refused: `${relativePath} is missing` };
+        if (read.status === "refused")
+            return { refused: refusalText(relativePath, read) };
+        return { bytes: read.bytes };
+    };
+}
+/**
+ * The stream from the bytes of its trace file: its actor with the file's items, and its artifacts
+ * followed by the file's screenshot entries, without the index.
+ */
+function joinTrace(stream, bytes) {
+    const index = stream.trace;
+    const refuse = (detail) => {
+        throw new StreamTraceRefusedError(stream.id, detail);
+    };
+    if (bytes.length !== index.bytes)
+        refuse(`${index.path} holds ${bytes.length} bytes and run.json records ${index.bytes} bytes`);
+    if (sha256(bytes) !== index.sha256)
+        refuse(`${index.path} does not match the sha256 run.json records for it`);
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        refuse(`${index.path} is not JSON`);
+    }
+    if (!isRecord(value) || !Array.isArray(value.items) || !Array.isArray(value.artifacts))
+        return refuse(`${index.path} has no items or artifacts list`);
+    const artifacts = value.artifacts;
+    if (!artifacts.every((artifact) => isRunStreamArtifact(artifact) && isScreenshot(artifact)))
+        refuse(`${index.path} lists an artifact that is not a screenshot entry`);
+    if (value.items.length !== index.items || artifacts.length !== index.screenshots)
+        refuse(`${index.path} holds ${value.items.length} items and ${artifacts.length} screenshots and run.json records ${index.items} and ${index.screenshots}`);
+    const { trace: _index, ...rest } = stream;
+    return {
+        ...rest,
+        actor: { ...stream.actor, items: value.items },
+        artifacts: [...stream.artifacts, ...artifacts],
+    };
+}
+/** Refuses an index the shape check would refuse, naming a file that is not a trace file name. */
+function assertIndex(stream) {
+    const index = stream.trace;
+    if (isRecord(index) && typeof index.path === "string" && !isStreamTracePath(index.path))
+        throw new StreamTraceRefusedError(stream.id, `run.json indexes ${index.path}, which is not a trace file name (actor.json, actors/<stream>.json or actor-<surface>.json)`);
+    if (!isStreamTraceIndex(index) || stream.actor === undefined)
+        throw new StreamTraceRefusedError(stream.id, "run.json records a malformed trace index");
+    if (stream.actor.items !== undefined)
+        throw new StreamTraceRefusedError(stream.id, "run.json holds items beside its trace index");
+}
+/** The stream with its trace joined, and the bytes it was joined from when it has an index. */
+async function readStreamTrace(read, stream, maxBytes) {
+    if (stream.trace === undefined)
+        return { stream };
+    assertIndex(stream);
+    const file = await read(stream.trace.path, maxBytes);
+    if ("refused" in file)
+        throw new StreamTraceRefusedError(stream.id, file.refused);
+    return { stream: joinTrace(stream, file.bytes), bytes: file.bytes };
+}
+/**
+ * The stream as a v1 run.json held it: its actor with every item and every artifact entry. A
+ * stream without an index is returned as it is (a v1 stream, or one with no actor). An indexed
+ * stream's file must have a trace file name (isStreamTracePath); it is read under `maxBytes` and
+ * checked against the index's byte count, sha256, item count and screenshot count, and any
+ * difference throws StreamTraceRefusedError. The rules that need the whole bundle (an unindexed v2
+ * actor, two participants indexing one file) are loadStreamTraces'.
+ */
+export async function loadStreamTrace(runPaths, stream, maxBytes = RUN_ARTIFACT_MAX_BYTES) {
+    return (await readStreamTrace(containedReader(runPaths), stream, maxBytes)).stream;
+}
+/**
+ * Why a stream of this bundle cannot be read, before any file is. A trace file belongs to one
+ * participant, so every stream indexing a path another stream indexes, compared as a
+ * case-insensitive file system compares them, is refused. In v2 the writer
+ * indexes every actor on every write, mid-run flushes included, so a v2 actor without an index lost
+ * its trace file, and inline items never come from the writer. A run still writing carries its
+ * participants' items so far as `liveActor` (humanish.live-actor.v1), which no index binds; a
+ * run.json whose outcome says the run finished never does, since the final write replaces it.
+ */
+function bundleRefusal(bundle, stream, owners) {
+    const shared = isRecord(stream.trace)
+        ? owners.get(traceFileKey(String(stream.trace.path)))
+        : undefined;
+    if (shared !== undefined && shared.length > 1)
+        return `run.json indexes ${String(stream.trace.path)} for participants ${shared.join(", ")} (paths that differ only in case name one file on some file systems), and a trace file belongs to one participant`;
+    if (bundle.schema !== RUN_BUNDLE_SCHEMA)
+        return undefined;
+    if (stream.actor !== undefined && stream.trace === undefined)
+        return "run.json holds its actor and names no trace file";
+    if (stream.liveActor !== undefined && bundle.outcome?.state === "finished")
+        return "run.json records a finished run and still holds in-progress items";
+    return undefined;
+}
+/**
+ * Every stream of the bundle loaded through loadStreamTrace, one file at a time, and the refusal
+ * of each stream that could not be (see bundleRefusal for the rules that need the whole bundle).
+ * Each refused stream is kept as run.json holds it; a reader that shows the run passes the result
+ * to displayedTraces. `source` is the run's prepared paths, or a TraceFileReader. `onTrace`
+ * receives each trace file's path and the bytes the stream was joined from, after they matched
+ * the index, so a caller scans exactly what it reads.
+ */
+export async function loadStreamTraces(source, bundle, options = {}) {
+    const read = typeof source === "function" ? source : containedReader(source);
+    const owners = new Map();
+    for (const stream of bundle.streams)
+        if (isRecord(stream.trace)) {
+            const key = traceFileKey(String(stream.trace.path));
+            owners.set(key, [...(owners.get(key) ?? []), stream.id]);
+        }
+    const streams = [];
+    const refused = [];
+    for (const stream of bundle.streams) {
+        try {
+            const reason = bundleRefusal(bundle, stream, owners);
+            if (reason !== undefined)
+                throw new StreamTraceRefusedError(stream.id, reason);
+            const loaded = await readStreamTrace(read, stream, options.maxBytes ?? RUN_ARTIFACT_MAX_BYTES);
+            if (loaded.bytes !== undefined)
+                options.onTrace?.(stream.trace.path, loaded.bytes);
+            streams.push(loaded.stream);
+        }
+        catch (error) {
+            if (!(error instanceof StreamTraceRefusedError))
+                throw error;
+            refused.push(error);
+            streams.push(stream);
+        }
+    }
+    return { bundle: { ...bundle, streams }, refused };
+}
+/**
+ * A loaded bundle as a reader that shows a run presents it. A refused stream keeps run.json's
+ * summary, shows none of the items run.json or a file supplied for it (its actor's items, its
+ * in-progress items, its screenshot entries), and carries `traceUnavailable` with the reason; a
+ * warn event on its timeline says the same.
+ */
+export function displayedTraces(loaded) {
+    const reasons = new Map(loaded.refused.map((error) => [error.streamId, error.message]));
+    if (reasons.size === 0)
+        return loaded.bundle;
+    const streams = loaded.bundle.streams.map((stream) => {
+        const reason = reasons.get(stream.id);
+        if (reason === undefined)
+            return stream;
+        const { liveActor: _live, trace: _index, actor, ...rest } = stream;
+        return {
+            ...rest,
+            ...(actor === undefined ? {} : { actor: { ...actor, items: [] } }),
+            artifacts: stream.artifacts.filter((artifact) => !isScreenshot(artifact)),
+            traceUnavailable: reason,
+        };
+    });
+    const events = loaded.bundle.streams
+        .filter((stream) => reasons.has(stream.id))
+        .map((stream) => ({
+        id: `event-trace-unavailable-${stream.id}`,
+        at: stream.updatedAt,
+        level: "warn",
+        type: "trace.unavailable",
+        message: reasons.get(stream.id),
+        streamId: stream.id,
+    }));
+    return { ...loaded.bundle, streams, events: [...loaded.bundle.events, ...events] };
+}
+/** The bundle with every stream loaded; the first refusal throws. */
+export async function loadRunTraces(source, bundle, maxBytes) {
+    const loaded = await loadStreamTraces(source, bundle, maxBytes === undefined ? {} : { maxBytes });
+    if (loaded.refused[0])
+        throw loaded.refused[0];
+    return loaded.bundle;
+}

package/dist/run/streams.d.ts

@@ -142,6 +142,18 @@ export interface RunDesktopGeometry {
     /** Public-safe geometry measurement/fill warnings retained with the stream evidence. */
     warnings?: string[];
 }
+/**
+ * A stream's trace file in a v2 run.json: the actor trace with its items and the stream's
+ * screenshot entries as `artifacts`. `bytes` and `sha256` bind the file to run.json; `items` and
+ * `screenshots` are what it holds, so a reader can list them without opening it.
+ */
+export interface StreamTraceIndex {
+    path: string;
+    bytes: number;
+    sha256: string;
+    items: number;
+    screenshots: number;
+}
 /** The original participant-facing assignment, before runtime access/coordination details. */
 export interface RunParticipantAssignment {
     mission: string;
@@ -189,6 +201,12 @@ export interface RunStream {
      *  and never persisted into bundles; declared here because the served observer-data carries it
      *  and the client is typed against this contract. */
     liveEnded?: boolean;
+    /**
+     * Set by a reader that shows the run (displayedTraces in src/run/stream-trace.ts) when the loader
+     * refused this participant's trace: the reason. Runtime-only and never persisted; the stream then
+     * carries none of the refused items.
+     */
+    traceUnavailable?: string;
     /**
      * Browser CSS layout viewport. Deterministic browser adapters may declare and render this
      * exactly; hosted-desktop CUA producers set it only from a runtime measurement. Historical
@@ -234,6 +252,8 @@ export interface RunStream {
         turnId?: string;
     };
     actor?: ActorTrace;
+    /** Present in a v2 run.json on each stream with an actor: where its items and screenshots are. */
+    trace?: StreamTraceIndex;
     /**
      * Mid-run partial actor evidence: the redacted trace items recorded so far,
      * flushed while a live participant is still running so the attached Observer's timeline can

package/dist/study/bundle-estimate.d.ts

@@ -0,0 +1,48 @@
+import type { DwellWindow } from "../actors/stop-conditions.js";
+/** One participant as the plan has it: when it starts and ends, and its dwell window. */
+export interface EstimatedParticipant {
+    readonly startAfterMs?: number;
+    readonly endAfterMs?: number;
+    readonly limits: {
+        readonly dwell?: DwellWindow;
+    };
+}
+/** A run's estimated bundle, and the scan's limit for its participants. */
+export interface BundleEstimate {
+    /** run.json, which analysis reads whole. */
+    readonly runFileBytes: number;
+    /** The largest file: observer/observer-data.json, or the Observer page for a small run. */
+    readonly largestFileBytes: number;
+    /** Every file, screenshots included. */
+    readonly totalBytes: number;
+    /** Files and folders in the run folder, as the public-safety scan counts them. */
+    readonly entries: number;
+    /** The most entries the scan reads in a run of these participants (runEntryLimit). */
+    readonly entryLimit: number;
+    /** What the estimate assumed, for its messages. */
+    readonly basis: {
+        readonly participants: number;
+        /** Participants with a declared end, counted for their whole window, and the longest window. */
+        readonly scheduled: number;
+        readonly longestWindowMs: number;
+        /** Participants without one, and how long each is counted at most. */
+        readonly open: number;
+        readonly openMs: number;
+        readonly dwell: boolean;
+    };
+}
+/**
+ * The bundle a live run of `participants` leaves, each in its session of `sessionMs` unless it
+ * declares an end. A participant with an end works its whole window; one without is counted for
+ * the measured open session above, or its budget when that is shorter. Each takes a model turn at
+ * the measured pace, and a dwell window adds a frame every `everyMs` for its length, cut to the
+ * session, and the frame after it.
+ */
+export declare function estimateBundle(participants: readonly EstimatedParticipant[], sessionMs: number): BundleEstimate;
+/**
+ * The warning for a run whose estimate passes a limit, or undefined: each limit it passes, what the
+ * estimate counted, how high it runs, and what to change.
+ */
+export declare function bundleLimitReason(estimate: BundleEstimate): string | undefined;
+/** The estimate beside the limits, for `study check`. */
+export declare function describeBundle(estimate: BundleEstimate): string;

package/dist/study/bundle-estimate.js

@@ -0,0 +1,159 @@
+// How large a computer-use run's bundle grows, estimated from its plan before anything runs, and
+// whether it would pass a limit a later command holds it to: analysis reads a run.json of at most
+// EVIDENCE_LIMITS.sourceBytes, verify reads no file larger than RUN_ARTIFACT_MAX_BYTES, and the
+// public-safety scan visits at most runEntryLimit(participants) files and folders.
+import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
+import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
+import { formatDuration } from "../run/projection.js";
+import { plural } from "../run/text.js";
+import { runEntryLimit } from "../verify/scan-limit.js";
+// Measured on 2026-10-12. Live: the hosted computer-use bundles kept on the maintainer's machine,
+// 219 runs since 2026-10-01 for run.json's size (a least-squares fit gave 372 bytes a run, 14,368
+// a participant and 2,423 a turn), and for the pace the 42 participant sessions of 5 minutes or
+// more among every kept run since August. Synthetic: runStudyWith on fake desktops, with the live median
+// of about 270 characters of reasoning and message a turn, from 10 to 2,000 turns and from 1 to
+// 16 participants. An adopter's 39-minute run grew run.json about 7 KB a minute for a participant
+// working the whole window; these rates give 12.6 KB, so the estimate errs high, and a limit it
+// passes is a warning.
+const RATES = Object.freeze({
+    /** run.json bytes a minute of the one long live participant measured: the adopter's run. */
+    measuredLongRunBytesPerMinute: 7_000,
+    /** run.json bytes for the run itself: its header, study and scenario. */
+    runBytes: 400,
+    /** run.json bytes for each participant before its turns: its records, events and cost lines. */
+    participantBytes: 14_400,
+    /** run.json bytes a model turn adds. Synthetic: 2,094 to 2,125 a turn over 10 to 2,000 turns. */
+    turnBytes: 2_100,
+    /** run.json bytes a dwell frame adds. Synthetic: 6,247 for 10 frames and the frame after. */
+    frameBytes: 570,
+    /** Seconds between model turns: the median of the 42 long live sessions was 10.3. */
+    secondsPerTurn: 10,
+    /**
+     * How long a participant with no declared end is counted, at most its session budget. It ends
+     * when it finishes its mission: 90 % of 974 live sessions ended within 184 s.
+     */
+    openSessionMs: 3 * 60_000,
+    /** observer-data.json bytes beyond run.json's for each participant: 0.9 to 2.6 KB live. */
+    observerDataParticipantBytes: 2_600,
+    /** observer/index.html: the page, and a share of run.json it embeds (synthetic, 10 to 2,000 turns). */
+    observerPageBytes: 1_190_000,
+    observerPageShare: 0.62,
+    /** A desktop screenshot: the median of 249 live PNG frames was 108,565 bytes. */
+    screenshotBytes: 110_000,
+    /** Run files and folders besides the participants': run.json, status, review, events, receipts, the Observer, analysis. */
+    runEntries: 20,
+    /** A participant's entries besides its turn screenshots: its trace file, its screenshot folder, its first frame. */
+    participantEntries: 3,
+});
+const MIB = 1024 * 1024;
+/**
+ * The bundle a live run of `participants` leaves, each in its session of `sessionMs` unless it
+ * declares an end. A participant with an end works its whole window; one without is counted for
+ * the measured open session above, or its budget when that is shorter. Each takes a model turn at
+ * the measured pace, and a dwell window adds a frame every `everyMs` for its length, cut to the
+ * session, and the frame after it.
+ */
+export function estimateBundle(participants, sessionMs) {
+    let turns = 0;
+    let frames = 0;
+    let longestWindowMs = 0;
+    const openMs = Math.min(sessionMs, RATES.openSessionMs);
+    for (const participant of participants) {
+        const windowMs = participant.endAfterMs === undefined
+            ? undefined
+            : participant.endAfterMs - (participant.startAfterMs ?? 0);
+        if (windowMs !== undefined)
+            longestWindowMs = Math.max(longestWindowMs, windowMs);
+        turns += Math.ceil((windowMs ?? openMs) / (RATES.secondsPerTurn * 1000));
+        const dwell = participant.limits.dwell;
+        if (dwell !== undefined)
+            frames += Math.floor(Math.min(dwell.ms, windowMs ?? sessionMs) / dwell.everyMs) + 1;
+    }
+    const count = participants.length;
+    const runFileBytes = RATES.runBytes +
+        count * RATES.participantBytes +
+        turns * RATES.turnBytes +
+        frames * RATES.frameBytes;
+    const observerDataBytes = runFileBytes + count * RATES.observerDataParticipantBytes;
+    const pageBytes = RATES.observerPageBytes + Math.round(RATES.observerPageShare * runFileBytes);
+    const screenshots = count + turns + frames;
+    const scheduled = participants.filter((participant) => participant.endAfterMs !== undefined);
+    return {
+        runFileBytes,
+        largestFileBytes: Math.max(observerDataBytes, pageBytes),
+        // Each participant's trace file holds about what its stream holds in run.json.
+        totalBytes: 2 * runFileBytes + observerDataBytes + pageBytes + screenshots * RATES.screenshotBytes,
+        entries: RATES.runEntries + count * RATES.participantEntries + turns + frames,
+        entryLimit: runEntryLimit(count),
+        basis: {
+            participants: count,
+            scheduled: scheduled.length,
+            longestWindowMs,
+            open: count - scheduled.length,
+            openMs,
+            dwell: frames > 0,
+        },
+    };
+}
+/**
+ * The warning for a run whose estimate passes a limit, or undefined: each limit it passes, what the
+ * estimate counted, how high it runs, and what to change.
+ */
+export function bundleLimitReason(estimate) {
+    const passed = [
+        ...(estimate.runFileBytes > EVIDENCE_LIMITS.sourceBytes
+            ? [
+                `This study's run.json may grow to about ${mib(estimate.runFileBytes)}, past the ${mib(EVIDENCE_LIMITS.sourceBytes)} analysis reads.`,
+            ]
+            : []),
+        ...(estimate.largestFileBytes > RUN_ARTIFACT_MAX_BYTES
+            ? [
+                `Its largest file, observer/observer-data.json, may grow to about ${mib(estimate.largestFileBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file.`,
+            ]
+            : []),
+        ...(estimate.entries > estimate.entryLimit
+            ? [
+                `It may hold about ${count(estimate.entries)} files and folders, past the ${count(estimate.entryLimit)} the public-safety scan reads in a run of ${plural(estimate.basis.participants, "participant")}.`,
+            ]
+            : []),
+    ];
+    if (passed.length === 0)
+        return undefined;
+    const { scheduled, longestWindowMs, open, openMs, dwell } = estimate.basis;
+    const counted = [
+        ...(scheduled > 0
+            ? [
+                `${plural(scheduled, "participant")} working their declared windows of up to ${formatDuration(longestWindowMs)}`,
+            ]
+            : []),
+        ...(open > 0
+            ? [
+                `${scheduled > 0 ? open : plural(open, "participant")} for up to ${formatDuration(openMs)} each`,
+            ]
+            : []),
+    ];
+    const changes = [
+        ...(scheduled > 0 ? ["shorten the longest windows (participants[].endAfterMs)"] : []),
+        ...(dwell ? ["shorten the dwell window (dwell.ms) or capture less often (dwell.everyMs)"] : []),
+    ];
+    const split = "split the participants across studies";
+    const advice = changes.length === 0 ? split : `${changes.join(", ")}, or ${split}`;
+    const perMinute = (RATES.turnBytes * 60) / RATES.secondsPerTurn;
+    return [
+        ...passed,
+        `The estimate counts ${counted.join(" and ")}, at a model turn every ${formatDuration(RATES.secondsPerTurn * 1000)} that adds about ${(RATES.turnBytes / 1000).toFixed(1)} KB.`,
+        `It runs high, about ${(perMinute / RATES.measuredLongRunBytesPerMinute).toFixed(1)} times the one long live run measured, so the run goes ahead.`,
+        `To stay under the limit, ${advice}.`,
+    ].join(" ");
+}
+/** The estimate beside the limits, for `study check`. */
+export function describeBundle(estimate) {
+    return `run.json about ${mib(estimate.runFileBytes)} of the ${mib(EVIDENCE_LIMITS.sourceBytes)} analysis reads; largest file about ${mib(estimate.largestFileBytes)} of the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads; about ${count(estimate.entries)} files and folders of the ${count(estimate.entryLimit)} the public-safety scan reads; about ${mib(estimate.totalBytes, 0)} in all. Participants with a declared end are counted for their whole window and the others for up to ${formatDuration(estimate.basis.openMs)}, at a model turn every ${formatDuration(RATES.secondsPerTurn * 1000)}.`;
+}
+function mib(bytes, digits = 1) {
+    const value = bytes / MIB;
+    return `${Number.isInteger(value) ? value : value.toFixed(digits)} MiB`;
+}
+function count(value) {
+    return value.toLocaleString("en-US");
+}

package/dist/study/doctor.js

@@ -172,6 +172,10 @@ export async function studySetupChecks(args) {
             keys: [],
             checks: [...checks, { name: "live route", ok: false, message: planned.refusal.message }],
         };
+    // A plan warning, such as a bundle estimated past a limit, is a note: the run still goes ahead.
+    for (const warning of planned.planned.plan.warnings ?? [])
+        if (!resolved.warnings.includes(warning))
+            checks.push({ name: "plan", ok: true, status: "note", message: warning });
     const requirements = planned.planned.plan.requirements;
     const keys = requiredKeys(requirements, args.keyPresent);
     // This flag controls the hosted desktop SDK check as well as its API key.

package/dist/study/plan-types.d.ts

@@ -6,6 +6,7 @@ import type { ScriptedRefusal } from "../routes/scripted/plan.js";
 import type { TerminalRefusal } from "../routes/terminal/plan.js";
 import type { RunStudyProvenance } from "../run/study-provenance.js";
 import type { ArrivalPlan } from "./arrivals.js";
+import type { BundleEstimate } from "./bundle-estimate.js";
 import type { ComputerUseRefusal } from "../routes/computer-use/plan.js";
 import type { SharedWorldRefusal } from "../routes/shared-world/plan.js";
 import type { ComputerUseParticipant, ExternalPublicParticipant, ProvisionedParticipant } from "./plan-participants.js";
@@ -275,6 +276,8 @@ export interface ScriptedPlan extends PlanBase {
 export type StudyPlan = PreviewPlan | ComputerUsePlan | SharedWorldPlan | TerminalPlan | ScriptedPlan;
 interface PlannedStudy {
     readonly plan: StudyPlan;
+    /** A computer-use plan's estimated bundle, which planStudy checked against the bundle limits. */
+    readonly bundle?: BundleEstimate;
 }
 /**
  * The error a route returns before a run starts: the route, its error code and a message. Each

package/dist/study/plan.js

@@ -9,6 +9,7 @@ import { planTerminalStudy } from "../routes/terminal/plan.js";
 import { concurrentSandboxes, sandboxCeiling, } from "../substrates/e2b/lifetime.js";
 import { localBrowserDefaults } from "../substrates/local/runtime-config.js";
 import { THIS_REPO_DRY_RUN_ONLY } from "./composition-rules.js";
+import { bundleLimitReason, estimateBundle } from "./bundle-estimate.js";
 import { planBase } from "./plan-base.js";
 import { routeOf } from "./routing.js";
 import { automaticAnalysisRouteReason, taskProtocolValidationReason } from "./validation.js";
@@ -81,15 +82,34 @@ export function planStudy(config, options, deps = {}) {
     const result = planRoute(routeOf(config), study, options, input, deps, e2b);
     if (!result.ok)
         return result;
+    const bundle = plannedBundle(result.plan);
     // The manifest the CLI resolved enters the plan here and nowhere else; the routes read
     // plan.study for the run's status record and bundle, and plan.warnings for its bundle events.
-    const warnings = [...recordedStudyWarnings(study), ...(result.plan.warnings ?? [])];
+    const warnings = [
+        ...recordedStudyWarnings(study),
+        ...(result.plan.warnings ?? []),
+        ...(bundle.warning === undefined ? [] : [bundle.warning]),
+    ];
     const plan = {
         ...result.plan,
         ...(options.study === undefined ? {} : { study: options.study }),
         ...(warnings.length === 0 ? {} : { warnings }),
     };
-    return { ok: true, planned: { plan } };
+    return {
+        ok: true,
+        planned: { plan, ...(bundle.estimate === undefined ? {} : { bundle: bundle.estimate }) },
+    };
+}
+/**
+ * The bundle a computer-use plan's participants leave, each session at the plan's budget, and the
+ * warning for a live plan whose estimate passes a bundle limit. A dry run records no turns.
+ */
+function plannedBundle(plan) {
+    if (plan.route !== "computer-use")
+        return {};
+    const estimate = estimateBundle(plan.runner.participants, plan.sessionBudgetMs);
+    const warning = plan.dryRun ? undefined : bundleLimitReason(estimate);
+    return warning === undefined ? { estimate } : { estimate, warning };
 }
 function planRoute(route, study, options, input, deps, e2b) {
     const { sandboxCeiling } = e2b;

package/dist/study/preflight.js

@@ -7,6 +7,7 @@ import { runPublicPreviewPreflight, runSandboxLoopbackPreflight } from "./prefli
 import { digest, fail, finalize, STUDY_CHECK_SCHEMA } from "./preflight-result.js";
 import { planStudy, routeOf } from "./plan.js";
 import { describeArrivals, describeWindows } from "./arrivals.js";
+import { describeBundle } from "./bundle-estimate.js";
 import { resolveStudyManifest } from "./discover.js";
 import { participantList } from "./study-fields.js";
 import { isLocalBrowserStudy } from "../substrates/local/runtime-config.js";
@@ -81,6 +82,13 @@ export async function runStudyPreflight(options) {
     const windows = windowsCheck(planned.planned.plan);
     if (windows !== undefined)
         ctx.checks.push(windows);
+    const bundle = planned.planned.bundle;
+    if (bundle !== undefined)
+        ctx.checks.push({ name: "bundle size", ok: true, message: describeBundle(bundle) });
+    // The plan's warnings, which the run records; the study file's own are already listed.
+    for (const warning of planned.planned.plan.warnings ?? [])
+        if (!ctx.warnings.includes(warning))
+            ctx.warnings.push(warning);
     const machine = machineCheck(ctx.config);
     // A local study's app and desktops run on this machine, so the hosted probes do not apply.
     if (reachability !== "metadata" && isLocalBrowserStudy(ctx.config))