humanish 0.133.0 → 0.134.0

package/dist/actors/contract.d.ts

@@ -88,7 +88,9 @@ export interface ActorTraceItem {
      *  the observation read no URL, on other producers and in older bundles. */
     page?: TracePage;
     /** On the computer-use `ui_action` of the wait during which a watch ended: the watch the loop
-     *  ran in place of a turn that only waited. Additive: absent on plain waits, on other items and
+     *  ran in place of a turn that only waited. A watch no wait carries, which a participant held to
+     *  its scheduled end gets for a turn of only screenshots or after a repeated action, is on a
+     *  `notice` titled `watched the screen`. Additive: absent on plain waits, on other items and
      *  producers, and in older bundles. */
     watch?: ActorWatch;
     /** On a computer-use wait's `ui_action`: the length in milliseconds the participant named for

package/dist/analysis/service.js

@@ -11,7 +11,7 @@ import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
 import { physicalCwdOf, runIdOf, resolvePhysicalCwd, validatePreparedRunRootIdentity, } from "../run/paths.js";
 import { isRunStatusRecord, RUN_STATUS_FILE } from "../run/status.js";
 import { captureEvidence, EVIDENCE_LIMITS } from "./evidence.js";
-import { AnalysisSourceRefusedError, runFileTooLarge } from "./source.js";
+import { AnalysisSourceRefusedError, runFileTooLarge, throwAsAnalysisRefusal } from "./source.js";
 import { pathMissing, readBoundedFile, readBoundedFileResult } from "../run/evidence-files.js";
 import { estimateAnalysisAdmission, preferLargerAnalysisOutput, runAnalysis, ANALYSIS_PROMPT_VERSION, } from "./execute.js";
 import { appendAnalysisCorrection, assertAnalysisPublicationCapacity, listAnalyses, writeAnalysis, } from "./store.js";
@@ -155,7 +155,8 @@ export async function readCompletedAnalysisSource(cwd, prepared) {
     const verified = await verifyRunPrepared(cwd, runIdOf(prepared), prepared);
     if (!verified.ok && verified.recordingOk !== true)
         throw new Error("ANALYSIS_VERIFY_FAILED");
-    const loaded = await loadRunBundlePrepared(cwd, prepared);
+    // Verify passes a run whose trace is past the read limit, which analysis does not read.
+    const loaded = await loadRunBundlePrepared(cwd, prepared).catch(throwAsAnalysisRefusal);
     if (!loaded || loaded.bundle.streams.length === 0)
         throw new Error("ANALYSIS_NO_PARTICIPANTS");
     if (loaded.bundle.mode !== "live")

package/dist/analysis/source.d.ts

@@ -26,3 +26,9 @@ export declare function parseAnalysisSource(prepared: PreparedRunArtifactPaths,
  * ANALYSIS_SOURCE_TOO_LARGE, and any other trace the loader refuses as ANALYSIS_SOURCE_INVALID.
  */
 export declare function readParticipantTraces<T>(prepared: PreparedRunArtifactPaths, bundle: StoredRunBundle, keep: (stream: RunStream, index: number) => T): Promise<T[]>;
+/**
+ * The trace loader's refusal as analysis gives it, ANALYSIS_SOURCE_TOO_LARGE for a trace past the
+ * read limit and ANALYSIS_SOURCE_INVALID for any other; another error as it is. The loader's
+ * message names the participant, the file, why, and what to do.
+ */
+export declare function throwAsAnalysisRefusal(error: unknown): never;

package/dist/analysis/source.js

@@ -78,20 +78,22 @@ export function parseAnalysisSource(prepared, bytes) {
  * ANALYSIS_SOURCE_TOO_LARGE, and any other trace the loader refuses as ANALYSIS_SOURCE_INVALID.
  */
 export async function readParticipantTraces(prepared, bundle, keep) {
-    try {
-        return await reduceRunTraces(prepared, bundle, (stream, index) => {
-            validateTraceItems(stream);
-            return keep(stream, index);
-        });
-    }
-    catch (error) {
-        // The loader's refusal names the participant, the file, why, and what to do.
-        if (error instanceof StreamTraceRefusedError)
-            throw new AnalysisSourceRefusedError(error instanceof StreamTraceTooLargeError
-                ? "ANALYSIS_SOURCE_TOO_LARGE"
-                : "ANALYSIS_SOURCE_INVALID", error.message);
+    return reduceRunTraces(prepared, bundle, (stream, index) => {
+        validateTraceItems(stream);
+        return keep(stream, index);
+    }).catch(throwAsAnalysisRefusal);
+}
+/**
+ * The trace loader's refusal as analysis gives it, ANALYSIS_SOURCE_TOO_LARGE for a trace past the
+ * read limit and ANALYSIS_SOURCE_INVALID for any other; another error as it is. The loader's
+ * message names the participant, the file, why, and what to do.
+ */
+export function throwAsAnalysisRefusal(error) {
+    if (!(error instanceof StreamTraceRefusedError))
         throw error;
-    }
+    throw new AnalysisSourceRefusedError(error instanceof StreamTraceTooLargeError
+        ? "ANALYSIS_SOURCE_TOO_LARGE"
+        : "ANALYSIS_SOURCE_INVALID", error.message);
 }
 function validateTraceItems(stream) {
     const actor = stream.actor;

package/dist/cli/commands/run-signals.js

@@ -134,8 +134,12 @@ async function stopActiveRuns(io, signal, stopping, options) {
     // not swept; verify grades a file that names a receipt's id local_only.
     Promise.all(stopping
         .filter((stop) => stop.report !== null)
-        .map((stop) => scrubRunSandboxIds(stop.run.paths).catch((error) => {
-        // A file the sweep refused to read may still name a sandbox; say which.
+        .map((stop) => scrubRunSandboxIds(stop.run.paths).then(
+    // A file the sweep refused to read may still name a sandbox; say which.
+    (unread) => {
+        if (unread !== undefined)
+            say(io, `humanish: ${signal}: ${unread}`);
+    }, (error) => {
         if (error instanceof Error)
             say(io, `humanish: ${signal}: ${error.message}`);
     }))));

package/dist/evidence/json-split.d.ts

@@ -0,0 +1,21 @@
+/** The JSON text of a value cut around the elements of one of its arrays. */
+export interface ArraySplit {
+    /** The array's elements, read as JSON.stringify reads them. */
+    readonly elements: readonly Record<string, unknown>[];
+    /** The value's JSON text up to and including the array's `[`. */
+    before(): string;
+    /** The value's JSON text from the array's `]` on. */
+    after(): string;
+}
+/**
+ * The cut of JSON.stringify(value) around the elements of its array `value[key]`, when that text
+ * holds each element's text as JSON.stringify(element) writes it: `value` is a plain object that
+ * has `key` among its own enumerable keys, `value[key]` is a plain array with no holes, and each
+ * element is a plain object. A plain object has Object.prototype or null as its prototype, a plain
+ * array Array.prototype, and neither has a toJSON. Otherwise undefined: the caller needs the whole
+ * text. Getters, proxies and a toJSON that changes `value` while it is serialized are not detected:
+ * the elements are read before anything is serialized. before() and after() serialize the members
+ * on their side of the array when called, so a caller that calls before(), serializes each element
+ * and then calls after() runs every toJSON in the order JSON.stringify(value) runs them.
+ */
+export declare function splitAtArray(value: unknown, key: string): ArraySplit | undefined;

package/dist/evidence/json-split.js

@@ -0,0 +1,57 @@
+// When the JSON text of a value can be worked on one element of an array at a time. A run bundle
+// holds every participant's trace in its `streams` array, and the bundle's whole text can pass
+// V8's longest string, 536,870,888 characters on Node 24.
+//
+// JSON.stringify calls a toJSON with the value's key in its parent, and an element serialized
+// alone gets "" in place of its index. It writes a boxed primitive as the primitive. A plain object
+// or array with no toJSON is written as its own keys or items wherever it sits, and every value
+// inside an element gets the same key alone as inside the whole value.
+import { isRecord } from "../run/type-guards.js";
+/**
+ * The cut of JSON.stringify(value) around the elements of its array `value[key]`, when that text
+ * holds each element's text as JSON.stringify(element) writes it: `value` is a plain object that
+ * has `key` among its own enumerable keys, `value[key]` is a plain array with no holes, and each
+ * element is a plain object. A plain object has Object.prototype or null as its prototype, a plain
+ * array Array.prototype, and neither has a toJSON. Otherwise undefined: the caller needs the whole
+ * text. Getters, proxies and a toJSON that changes `value` while it is serialized are not detected:
+ * the elements are read before anything is serialized. before() and after() serialize the members
+ * on their side of the array when called, so a caller that calls before(), serializes each element
+ * and then calls after() runs every toJSON in the order JSON.stringify(value) runs them.
+ */
+export function splitAtArray(value, key) {
+    // JSON.stringify writes only own enumerable keys.
+    if (!isPlainRecord(value))
+        return undefined;
+    const keys = Object.keys(value);
+    const at = keys.indexOf(key);
+    if (at === -1)
+        return undefined;
+    const array = value[key];
+    if (!isPlainArray(array))
+        return undefined;
+    // JSON.stringify reads the length once and then each index, so a hole reads as undefined and an
+    // own iterator is never called. Array.from would call that iterator, and every skips holes.
+    const elements = [];
+    for (let index = 0, length = array.length; index < length; index += 1)
+        elements.push(array[index]);
+    if (!elements.every(isPlainRecord))
+        return undefined;
+    // fromEntries keeps a key such as __proto__ an own property.
+    const members = (from, to) => Object.fromEntries(keys.slice(from, to).map((name) => [name, value[name]]));
+    return {
+        elements,
+        before: () => JSON.stringify({ ...members(0, at), [key]: [] }).slice(0, -"]}".length),
+        after: () => {
+            const text = JSON.stringify(members(at + 1));
+            return text === "{}" ? "]}" : `],${text.slice(1)}`;
+        },
+    };
+}
+const hasToJson = (value) => typeof value.toJSON === "function";
+function isPlainRecord(value) {
+    if (!isRecord(value) || hasToJson(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+const isPlainArray = (value) => Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype && !hasToJson(value);

package/dist/evidence/sensitive-json.js

@@ -21,7 +21,7 @@
 // piece up to its first slash or whitespace. A public E2B page after the scheme would need a space
 // or the text's end before the cut, so neither text exempts the URL. The scan holds one piece at a
 // time.
-import { isRecord } from "../run/type-guards.js";
+import { splitAtArray } from "./json-split.js";
 import { containsSandboxUrl, containsSensitive } from "./redaction.js";
 // The sandbox URL's scheme, `https://` or `https:\/\/` as JSON may escape it, at a text's end.
 const SCHEME_AT_END = /https?:\\?\/\\?\/$/i;
@@ -35,14 +35,11 @@ const SLASH_OR_SPACE = /[/\s]/;
  * them.
  */
 export function containsSensitiveJson(value, key) {
-    // JSON.stringify writes only own enumerable keys, and `around` cuts the text at this one.
-    const elements = isPlainRecord(value) && Object.keys(value).includes(key) ? value[key] : undefined;
-    // Array.from reads a hole as undefined, where every would skip it.
-    if (!isPlainRecord(value) ||
-        !isPlainArray(elements) ||
-        !Array.from(elements).every(isPlainRecord))
+    const split = splitAtArray(value, key);
+    if (split === undefined)
         return wholeTextSensitive(value);
-    const [prefix, suffix] = around(value, key);
+    const { elements } = split;
+    const [prefix, suffix] = [split.before(), split.after()];
     if (elements.length === 0)
         return containsSensitive(prefix + suffix);
     // The scheme of a URL no slash or whitespace has followed, from an earlier piece.
@@ -59,26 +56,6 @@ export function containsSensitiveJson(value, key) {
     return false;
 }
 const wholeTextSensitive = (value) => containsSensitive(JSON.stringify(value) ?? "");
-// JSON.stringify calls a toJSON with the value's key in its parent, and an element serialized
-// alone gets "" in place of its index. It writes a boxed primitive as the primitive. A plain object
-// or array with no toJSON is written as its own keys or items wherever it sits.
-const hasToJson = (value) => typeof value.toJSON === "function";
-function isPlainRecord(value) {
-    if (!isRecord(value) || hasToJson(value))
-        return false;
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
-const isPlainArray = (value) => Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype && !hasToJson(value);
-/** The document's text before the first element of `value[key]` and after its last. */
-function around(value, key) {
-    const keys = Object.keys(value);
-    const at = keys.indexOf(key);
-    const entries = (from, to) => Object.fromEntries(keys.slice(from, to).map((name) => [name, value[name]]));
-    const before = JSON.stringify({ ...entries(0, at), [key]: [] });
-    const after = JSON.stringify(entries(at + 1));
-    return [before.slice(0, -"]}".length), after === "{}" ? "]}" : `],${after.slice(1)}`];
-}
 /** `piece` up to and including its first slash or whitespace, or all of it when it has none. */
 function head(piece) {
     const at = piece.search(SLASH_OR_SPACE);

package/dist/observer/render.js

@@ -90,11 +90,13 @@ export async function renderObserver(cwdInput, runInput, options = {}) {
             ? "HUMANISH_RUN_NOT_FOUND"
             : "HUMANISH_INVALID_RUN_BUNDLE", verified.error?.message ?? "Run bundle failed verification.");
     }
-    const loaded = await loadRunBundlePrepared(selectedPhysicalCwd, preparedRunPaths);
+    // Verify passes a trace past the read limit, so its participant shows without its items.
+    const loaded = await loadRunBundlePrepared(selectedPhysicalCwd, preparedRunPaths, {
+        display: true,
+    });
     await validatePreparedRunArtifactPaths(preparedRunPaths);
-    if (!loaded) {
+    if (!loaded)
         return runNotFound(cwd, runInput);
-    }
     if (loaded.bundle.runId !== selection.runId ||
         (await realpath(loaded.runDir)) !== preparedRunPaths.physicalRunRoot) {
         throw new Error("Observer output directory does not match the selected run.");

package/dist/routes/computer-use/bundle-parts.d.ts

@@ -1,6 +1,15 @@
+import type { CuaLoopResult } from "../../actors/computer-use/loop.js";
 import { type RunProviderResource, type RunSubjectProvenance } from "../../run/bundle.js";
 import { type ParticipantIds } from "../../run/participant-records.js";
 import { type ParticipantRunOutcome } from "./types.js";
+/**
+ * The review's gap for the streaks a participant's trace records: turns that repeated a recent
+ * action on an unchanged screen past noProgressSteps, which did not end the session of a
+ * participant held to its scheduled end. Its session passes, so no other gap names them. One line
+ * names the first streak and counts the rest: a page that changes every minute, watched 1 s at a
+ * time, records a streak a minute, and a fan-out would list each.
+ */
+export declare function streakGaps(participantId: string, session: CuaLoopResult | undefined): string[];
 /** The human-readable state story appended to the provenance event (and review.md via it). */
 export declare function describeSubjectState(state: RunSubjectProvenance["state"], dryRun: boolean): string;
 /** Human-readable provenance line for the single-participant subject.provenance event of a clone

package/dist/routes/computer-use/bundle-parts.js

@@ -1,14 +1,34 @@
 // The parts both computer-use bundle shapes share: the subject-state story and provenance line,
-// provider-resource records, and the public-safe app URL label, the URL digest and the
-// subject-phase event id suffix. The builders are bundle.ts (the dispatcher and the judge),
-// single-bundle.ts and fanout-bundle.ts. Feedback candidates from participant reports are in
-// participant-feedback.ts, which the shared-world bundle reads too.
+// provider-resource records, the review's gap for a held participant's streak, and the public-safe
+// app URL label, the URL digest and the subject-phase event id suffix. The builders are bundle.ts
+// (the dispatcher and the judge), single-bundle.ts and fanout-bundle.ts. Feedback candidates from
+// participant reports are in participant-feedback.ts, which the shared-world bundle reads too.
+import { STREAK_TITLE } from "../../actors/computer-use/loop/streak.js";
 import { scanEncodedText } from "../../evidence/encoded-text.js";
 import { digestText } from "../../evidence/redaction.js";
 import {} from "../../run/bundle.js";
 import { participantResourceIds } from "../../run/participant-records.js";
 import {} from "./types.js";
 import { plural } from "../../run/text.js";
+/**
+ * The review's gap for the streaks a participant's trace records: turns that repeated a recent
+ * action on an unchanged screen past noProgressSteps, which did not end the session of a
+ * participant held to its scheduled end. Its session passes, so no other gap names them. One line
+ * names the first streak and counts the rest: a page that changes every minute, watched 1 s at a
+ * time, records a streak a minute, and a fan-out would list each.
+ */
+export function streakGaps(participantId, session) {
+    const texts = (session?.trace.items ?? []).flatMap((item) => item.kind === "notice" && item.title === STREAK_TITLE && item.text !== undefined
+        ? [item.text]
+        : []);
+    const [first] = texts;
+    if (first === undefined)
+        return [];
+    const more = texts.length > 1
+        ? ` It had ${plural(texts.length - 1, "more such streak")} after that; its trace records each.`
+        : "";
+    return [`${participantId}: ${first}${more}`];
+}
 /** The human-readable state story appended to the provenance event (and review.md via it). */
 export function describeSubjectState(state, dryRun) {
     switch (state.provenance) {

package/dist/routes/computer-use/fanout-bundle.js

@@ -5,7 +5,7 @@ import { cuaGoalSource } from "../../actors/goal-source.js";
 import { redactText } from "../../evidence/redaction.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, gapsListClause, skippedSentence, withCuaReviewProvenance, } from "../../run/outcomes.js";
-import { providerResourcesForOutcome, publicSafeAppUrlLabel } from "./bundle-parts.js";
+import { providerResourcesForOutcome, publicSafeAppUrlLabel, streakGaps } from "./bundle-parts.js";
 import { subjectName } from "../../run/subject-name.js";
 import { participantFeedbackCandidates } from "./participant-feedback.js";
 import { participantFactsOf } from "./participant-facts.js";
@@ -70,18 +70,20 @@ function fanoutSummary(args, facts) {
 }
 /**
  * The review's gaps: one line for the participants a host suspension likely failed, then a line
- * for each other participant that did not pass.
+ * for each other participant that did not pass, then a line for each held participant's streaks.
  */
 function fanoutGaps(args, judgment) {
     const suspended = new Set(args.hostSuspension?.participantIds ?? []);
     const others = judgment.participants.flatMap((participant, index) => participant.gapLine === undefined || suspended.has(args.specs[index].planned.id)
         ? []
         : [participant.gapLine]);
+    const streaks = args.specs.flatMap((spec, index) => streakGaps(spec.planned.id, args.outcomes?.[index]?.session));
     if (suspended.size === 0)
-        return others;
+        return [...others, ...streaks];
     return [
         `${[...suspended].join(", ")}: failed after the host was suspended, likely its effect. Each participant's record keeps its own error.`,
         ...others,
+        ...streaks,
     ];
 }
 function fanoutReview(args, streams, judgment) {

package/dist/routes/computer-use/single-bundle.js

@@ -6,7 +6,7 @@ import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, p
 import { participantCaption } from "../../run/participant-caption.js";
 import { actorEnding } from "../../actors/stop-cause.js";
 import { cuaGoalSource, ranUntilClockEnd } from "../../actors/goal-source.js";
-import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel, subjectProvenanceMessage, } from "./bundle-parts.js";
+import { describeSubjectState, phaseEventIdSuffix, publicSafeAppUrlLabel, streakGaps, subjectProvenanceMessage, } from "./bundle-parts.js";
 import { participantFeedbackCandidates } from "./participant-feedback.js";
 import { judgeParticipantRecords } from "../../run/judge.js";
 import { buildRunCostSummary } from "../../run/cost-summary.js";
@@ -348,7 +348,7 @@ function singleReview(args, view, stream) {
             ...(credibilityNote === undefined ? {} : { credibilityNote }),
         })}`,
         gaps: args.session || args.sessionError !== undefined
-            ? []
+            ? streakGaps(args.participantId ?? "lane-01", args.session)
             : args.inProgress === true
                 ? ["Live desktop session is still running."]
                 : ["Live desktop session not yet run (dry run only)."],

package/dist/run/locate.d.ts

@@ -55,8 +55,14 @@ export declare function loadRunBundle(cwdInput: string, runInput: string): Promi
     bundlePath: string;
     runDir: string;
 } | null>;
-/** loadRunBundle for a caller that already holds prepared paths. Revalidates them first. */
-export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths): Promise<{
+/**
+ * loadRunBundle for a caller that already holds prepared paths. Revalidates them first. With
+ * `display`, a participant whose trace the loader refuses, such as one past the read limit, is
+ * kept as displayedTraces shows it, for a page that shows the run.
+ */
+export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths, options?: {
+    display?: boolean;
+}): Promise<{
     bundle: RunBundle;
     bundlePath: string;
     runDir: string;

package/dist/run/locate.js

@@ -3,7 +3,7 @@ import { bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveExistingRunDir
 import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, ContainedReadRefusedError, LATEST_POINTER_MAX_BYTES, readContainedRegularFile, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
 import { RUN_BUNDLE_FILE } from "./bundle.js";
 import { isRunBundle, isRunPointer } from "./bundle-shape.js";
-import { loadRunTraces } from "./stream-trace.js";
+import { displayedTraces, loadRunTraces, loadStreamTraces } from "./stream-trace.js";
 import { readUnchangedFile } from "./evidence-files.js";
 /** The run input that resolves through latest.json rather than naming a run directory. */
 export const LATEST_RUN_ALIAS = "latest";
@@ -119,8 +119,12 @@ export async function loadRunBundle(cwdInput, runInput) {
     }
     return loadRunBundlePrepared(cwd, runPaths);
 }
-/** loadRunBundle for a caller that already holds prepared paths. Revalidates them first. */
-export async function loadRunBundlePrepared(cwdInput, runPaths) {
+/**
+ * loadRunBundle for a caller that already holds prepared paths. Revalidates them first. With
+ * `display`, a participant whose trace the loader refuses, such as one past the read limit, is
+ * kept as displayedTraces shows it, for a page that shows the run.
+ */
+export async function loadRunBundlePrepared(cwdInput, runPaths, options = {}) {
     const cwd = path.resolve(cwdInput);
     await validatePreparedRunArtifactPaths(runPaths);
     const bundlePath = path.join(runPaths.absoluteRunRoot, RUN_BUNDLE_FILE);
@@ -134,7 +138,9 @@ export async function loadRunBundlePrepared(cwdInput, runPaths) {
     }
     return {
         // A trace that does not match its index throws StreamTraceRefusedError, naming the participant.
-        bundle: await loadRunTraces(runPaths, bundle),
+        bundle: options.display === true
+            ? displayedTraces(await loadStreamTraces(runPaths, bundle))
+            : await loadRunTraces(runPaths, bundle),
         bundlePath: path.relative(cwd, bundlePath),
         runDir: runPaths.absoluteRunRoot,
     };

package/dist/run/run.js

@@ -148,6 +148,14 @@ async function writeRunJson(paths, liveItems, bundle) {
     });
     return { ...publicBundle, streams };
 }
+/** The warn event that names the files the final sandbox id sweep could not read. */
+const unsweptEvent = (message, at) => ({
+    id: "event-sandbox-ids-unresolved",
+    at: new Date(at).toISOString(),
+    level: "warn",
+    type: "sandbox-ids.unresolved",
+    message,
+});
 function runPublisher(args) {
     const { options, runId, createdAt, paths, runStatus, now, admit, participantsRan } = args;
     const observer = observerTarget(options);
@@ -161,11 +169,14 @@ function runPublisher(args) {
         type: "study.warning",
         message: redactText(message),
     }));
-    // So do the host suspensions the heartbeat has seen by the time of the write.
+    // So do the host suspensions the heartbeat has seen by the time of the write, and the files the
+    // final sandbox id sweep could not read.
+    let unswept = [];
     const withRunEvents = (events) => {
         const owned = [
             ...studyWarnings,
             ...hostSuspensionEvents(runStatus.suspensions(), Date.parse(createdAt)),
+            ...unswept,
         ];
         return [...events.filter((event) => !owned.some((mine) => mine.id === event.id)), ...owned];
     };
@@ -231,7 +242,12 @@ function runPublisher(args) {
         await writeBundleFiles(bundle, finishedOutcome(outcome), (publicBundle) => runStatus.finish(runStatusOutcome(publicBundle)));
         // The final run.json indexes each finished trace, so the live files are journal no reader needs.
         await liveItems.remove();
-        await scrubRunSandboxIds(paths);
+        const unread = await scrubRunSandboxIds(paths);
+        if (unread !== undefined) {
+            unswept = [unsweptEvent(unread, now())];
+            // The sweep reads the files the final write left, so run.json is written again to record it.
+            await writeBundleFiles(bundle, finishedOutcome(outcome), async () => { });
+        }
         await writePointer();
         let current = { ok: outcome.ok, execution: outcome.execution };
         // An Observer that did not render, judged under the route's policy and written to run.json

package/dist/run/sandbox-ids.d.ts

@@ -4,7 +4,12 @@ import { type PreparedRunArtifactPaths } from "./paths.js";
 export declare function scrubSandboxIds(text: string, ids: Iterable<string>, label?: (id: string) => string): string;
 /**
  * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
- * digest, and any raw id left in free text or a URL becomes its label.
+ * digest, and any raw id left in free text, a key or a URL becomes its label. When no label goes
+ * in, the result is the key-redacted value. Otherwise it is what JSON.parse returns for the
+ * scrubbed JSON text of that value. A run bundle is scrubbed one stream at a time, so no string
+ * holds two streams unless a member outside `streams` holds them too. An id that holds one of
+ * {}[],:"\ makes the scrub work on the whole text, which throws RangeError for a bundle past V8's
+ * longest string. No E2B id holds one.
  */
 export declare function publicSandboxView<T>(value: T, ids: Iterable<string>): T;
 /**
@@ -40,10 +45,11 @@ export declare function scrubSandboxIdBytes(file: string, bytes: Buffer, ids: re
  * receipts, with the label in place of the id. Writers such as a participant's actor.json can
  * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
  * Best effort for writes and listings: verify grades a file this misses. A text file it refuses
- * to read, or a journal it refuses, throws once the sweep ends, naming each, since such a file
- * may still hold an id.
+ * to read, such as a trace past RUN_ARTIFACT_MAX_BYTES, may still hold an id, so the sweep
+ * returns a warning that names each such file and why, for the caller to record; the run goes
+ * on. A journal it refuses throws, since without its ids no file can be swept.
  */
-export declare function scrubRunSandboxIds(paths: PreparedRunArtifactPaths): Promise<void>;
+export declare function scrubRunSandboxIds(paths: PreparedRunArtifactPaths): Promise<string | undefined>;
 /**
  * A run's result as it may be returned or printed: the same object when it names no sandbox,
  * otherwise its public view, scrubbed of the ids the run's receipts journal.

package/dist/run/sandbox-ids.js

@@ -4,6 +4,7 @@
 // so output an agent pastes into an issue never carries an id.
 import { opendir, realpath } from "node:fs/promises";
 import path from "node:path";
+import { splitAtArray } from "../evidence/json-split.js";
 import { readPlainText } from "../evidence/plain-text.js";
 import { collectSandboxIds, redactSandboxIds, sandboxIdDigest, REDACTED_SANDBOX_ID, } from "../evidence/redaction.js";
 import { ContainedReadRefusedError, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, } from "./contained-output.js";
@@ -26,20 +27,79 @@ export function scrubSandboxIds(text, ids, label = sandboxIdLabel) {
     unique.sort((left, right) => right.length - left.length);
     return unique.reduce((current, id) => current.split(id).join(label(id)), text);
 }
+// A run bundle holds every finished participant's trace, and its whole JSON text can pass V8's
+// longest string, 536,870,888 characters on Node 24. publicSandboxView scrubs such a bundle in
+// pieces: the shell, which is the bundle's JSON text with `streams` written as `[]`, and the JSON
+// text of each stream on its own. The pieces give what the whole text gives:
+// - An id that holds none of {}[],:"\ lies inside one token of the whole text. Each cut between
+//   pieces falls between two of the characters {}[], and the placeholder adds only [ and ], so no
+//   occurrence crosses a cut. A replacement leaves those characters in place, so the next id's
+//   occurrences cannot cross one either.
+// - A label holds no quote or backslash, so it never moves the end of a string. A label inside an
+//   escape, a number, true, false or null makes its piece fail to parse, and the whole text fails
+//   the same way.
+// - JSON.stringify writes a stream's members alone as it writes them inside the bundle, since each
+//   gets the same key for its toJSON. Only the stream itself would get "" in place of its index,
+//   and splitAtArray takes no stream with a toJSON. The members before `streams`, each stream and
+//   the members after are serialized in that order, which is the order the whole text runs each
+//   toJSON in.
+// - The parsed shell keeps its keys in the order JSON.parse gives for the whole text, and the
+//   streams go in at the place of `streams`. A key a label went into holds the label's `[`, so no
+//   other key becomes `streams`. An id inside the key `streams` itself takes the whole text.
+// - Once a label goes in, the view is parsed from the scrubbed pieces, as it was from the whole
+//   text. A piece kept as given could run a toJSON or getter again when the view is written.
+// - All of this holds for a bundle that serializing leaves unchanged, as every bundle JSON.parse
+//   returns is. splitAtArray reads the streams before any toJSON runs.
+/** The characters that let an id reach past one token of a JSON text or move where a string ends. */
+const CROSSES_TOKENS = /[{}[\],:"\\]/;
+/** Whether every occurrence of `id` in a bundle's JSON text stays inside one piece. */
+const staysInOnePiece = (id) => id.length === 0 || (!CROSSES_TOKENS.test(id) && !"streams".includes(id));
 /**
  * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
- * digest, and any raw id left in free text or a URL becomes its label.
+ * digest, and any raw id left in free text, a key or a URL becomes its label. When no label goes
+ * in, the result is the key-redacted value. Otherwise it is what JSON.parse returns for the
+ * scrubbed JSON text of that value. A run bundle is scrubbed one stream at a time, so no string
+ * holds two streams unless a member outside `streams` holds them too. An id that holds one of
+ * {}[],:"\ makes the scrub work on the whole text, which throws RangeError for a bundle past V8's
+ * longest string. No E2B id holds one.
  */
 export function publicSandboxView(value, ids) {
     const redacted = redactSandboxIds(value);
     const known = [...ids];
     if (known.length === 0)
         return redacted;
-    const text = JSON.stringify(redacted);
+    const split = known.every(staysInOnePiece) ? splitAtArray(redacted, "streams") : undefined;
+    return (split === undefined ? wholeTextView(redacted, known) : streamwiseView(redacted, split, known));
+}
+/** The scrub of `value`'s whole JSON text, parsed back when a label went in. */
+function wholeTextView(value, ids) {
+    const text = JSON.stringify(value);
     if (text === undefined)
-        return redacted;
-    const scrubbed = scrubSandboxIds(text, known);
-    return (scrubbed === text ? redacted : JSON.parse(scrubbed));
+        return value;
+    const scrubbed = scrubSandboxIds(text, ids);
+    return scrubbed === text ? value : JSON.parse(scrubbed);
+}
+/** The bundle's whole-text scrub, built from its shell and each stream scrubbed on its own. */
+function streamwiseView(bundle, split, ids) {
+    const before = split.before();
+    let changed = false;
+    // Each stream is parsed at its turn, even before any label goes in, since a later piece can still
+    // take one and by then the earlier streams' text is gone.
+    const streams = split.elements.map((stream) => {
+        const text = JSON.stringify(stream);
+        const scrubbed = scrubSandboxIds(text, ids);
+        if (scrubbed !== text)
+            changed = true;
+        return JSON.parse(scrubbed);
+    });
+    const shellText = before + split.after();
+    const shell = scrubSandboxIds(shellText, ids);
+    if (!changed && shell === shellText)
+        return bundle;
+    // Assigning to `streams` keeps its place among the keys.
+    const view = JSON.parse(shell);
+    view.streams = streams;
+    return view;
 }
 /** The raw sandbox ids a receipts journal names. */
 function receiptSandboxIds(journal) {
@@ -137,16 +197,17 @@ const MAX_SWEPT_ENTRIES = 10_000;
  * receipts, with the label in place of the id. Writers such as a participant's actor.json can
  * quote an SDK error that names the sandbox. Run.finish calls it before analysis reads the run.
  * Best effort for writes and listings: verify grades a file this misses. A text file it refuses
- * to read, or a journal it refuses, throws once the sweep ends, naming each, since such a file
- * may still hold an id.
+ * to read, such as a trace past RUN_ARTIFACT_MAX_BYTES, may still hold an id, so the sweep
+ * returns a warning that names each such file and why, for the caller to record; the run goes
+ * on. A journal it refuses throws, since without its ids no file can be swept.
  */
 export async function scrubRunSandboxIds(paths) {
     const ids = await readRunSandboxIds(paths);
     if (ids.length === 0)
-        return;
+        return undefined;
     const valid = await validatePreparedRunRootIdentity(paths).then(() => true, () => false);
     if (!valid)
-        return;
+        return undefined;
     const refused = [];
     const scrub = async (file) => {
         const read = await readContainedRegularFile(paths, file, RUN_ARTIFACT_MAX_BYTES);
@@ -182,8 +243,9 @@ export async function scrubRunSandboxIds(paths) {
     await walk("").catch(() => {
         // A directory that changed while it was listed ends the sweep; verify names what it missed.
     });
-    if (refused.length > 0)
-        throw new Error(`The sandbox id sweep could not read every run file, so these may still name a sandbox: ${refused.join("; ")}.`);
+    return refused.length === 0
+        ? undefined
+        : `The sandbox id sweep could not read every run file, so these may still name a sandbox: ${refused.join("; ")}.`;
 }
 /**
  * A run's result as it may be returned or printed: the same object when it names no sandbox,