humanish 0.134.0 → 0.136.0

package/dist/routes/computer-use/fanout-bundle.js

@@ -2,7 +2,7 @@ import { e2bDesktopTemplate } from "../../substrates/e2b/sandbox.js";
 import { receivingPublication } from "../../comms/receiving-runtime.js";
 import { actorEnding } from "../../actors/stop-cause.js";
 import { cuaGoalSource } from "../../actors/goal-source.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, gapsListClause, skippedSentence, withCuaReviewProvenance, } from "../../run/outcomes.js";
 import { providerResourcesForOutcome, publicSafeAppUrlLabel, streakGaps } from "./bundle-parts.js";
@@ -186,7 +186,7 @@ function fanoutFeedbackCandidates(args) {
                     participantId: spec.planned.id,
                     streamId: spec.streamId,
                     personaId: spec.persona.id,
-                    goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                    goal: redactEncodedText(spec.evidenceInstructions ?? spec.instructions),
                     ...(outcome?.session === undefined ? {} : { session: outcome.session }),
                     ...(outcome?.session === undefined
                         ? {}
@@ -270,7 +270,7 @@ export function buildCuaFanoutBundle(args) {
             // this writer produced. The only adopter-side workaround was scanner evasion.
             //
             // The instructions the model actually receives are untouched; only the persisted copy changes.
-            goal: redactText(specs[0].evidenceInstructions ?? specs[0].instructions),
+            goal: redactEncodedText(specs[0].evidenceInstructions ?? specs[0].instructions),
             source: `study:${plan.studyId}`,
             sourceDigest: specs[0].persona.promptDigest,
         },

package/dist/routes/computer-use/participant-execution.js

@@ -26,7 +26,7 @@ export function makeParticipantWriteScreenshot(artifactRoot, spec, screenshots)
         const rel = path.posix.join(relPrefix, name);
         // Evidence holds image data only, whatever the executor's frames carried.
         const frame = stripPngMetadataChunks(bytes);
-        assertScreenshotEvidence(rel, frame);
+        await assertScreenshotEvidence(rel, frame);
         await writeContainedOutputFile(artifactRoot, path.join(...dirParts, name), frame);
         screenshots.push(rel);
         return rel;

package/dist/routes/computer-use/participant-runs.js

@@ -6,7 +6,7 @@ import { isLocalBrowserStudy, LOCAL_BROWSER_LIFETIME_MS, } from "../../substrate
 import { resolveParticipant } from "../../run/participant.js";
 import {} from "../../study/types.js";
 import { scrubPersonaBrief } from "../../study/persona.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import {} from "../../run/bundle.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { resolveCommittedPersonas } from "../../study/persona-resolve.js";
@@ -237,7 +237,7 @@ export function sanitizeParticipantRuns(runs, scrub) {
     for (const spec of runs) {
         if (spec.evidenceAssignment)
             spec.evidenceAssignment = participantAssignment(spec.evidenceAssignment, scrub);
-        spec.evidenceInstructions = redactText(scrub(spec.instructions));
+        spec.evidenceInstructions = redactEncodedText(scrub(spec.instructions));
         spec.persona = scrubPersonaBrief(spec.persona, scrub);
     }
 }

package/dist/routes/computer-use/single-bundle.js

@@ -1,5 +1,5 @@
 import { participantAssignment } from "../../study/participant-assignment.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/streams.js";
 import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, participantSummary, withCuaReviewProvenance, } from "../../run/outcomes.js";
@@ -385,7 +385,7 @@ export function buildSingleParticipantBundle(args) {
         scenario: {
             id: `cua-${args.studyId}`,
             title: args.studyTitle ?? `Computer-use run: ${args.studyId}`,
-            goal: redactText(args.mission),
+            goal: redactEncodedText(args.mission),
             source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },
@@ -425,7 +425,7 @@ export function buildSingleParticipantBundle(args) {
                         participantId: args.participantId ?? "lane-01",
                         streamId: SINGLE.streamId,
                         personaId: args.persona.id,
-                        goal: redactText(args.mission),
+                        goal: redactEncodedText(args.mission),
                         ...(args.session === undefined ? {} : { session: args.session }),
                         ...(args.traceArtifactPath === undefined
                             ? {}

package/dist/routes/scripted/setup.js

@@ -8,6 +8,7 @@ import { resolveBrowserCommand } from "../../actors/scripted-browser/browser-com
 import { publicSafeToken } from "../../actors/scripted-browser/journey.js";
 import { prepareSelectedOutputDirectory } from "../../run/contained-output.js";
 import { RunSecrets } from "../../run/secrets.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { evidenceAppUrlOf } from "./plan.js";
 import { resolveScriptedScenario } from "./scenario.js";
 import {} from "./types.js";
@@ -55,6 +56,9 @@ export async function prepareScriptedRun(plan, input) {
             result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", scenario.message),
         };
     }
+    const steps = recordedStepIds(scenario.journey.steps, secrets);
+    if (!steps.ok)
+        return { ok: false, result: failed("HUMANISH_SCRIPTED_SCENARIO_INVALID", steps.message) };
     // The goal, title and step labels are recorded; a step's path, selector, value and expected text
     // drive the browser and stay as written.
     const journey = {
@@ -62,9 +66,9 @@ export async function prepareScriptedRun(plan, input) {
         scenarioId: idHoldsKnownValue(scenario.journey.scenarioId, secrets)
             ? "scenario"
             : scenario.journey.scenarioId,
-        goal: secrets.scrub(scenario.journey.goal),
-        scenarioTitle: secrets.scrub(scenario.journey.scenarioTitle),
-        steps: recordedStepIds(scenario.journey.steps, secrets),
+        goal: recordedText(scenario.journey.goal, secrets),
+        scenarioTitle: recordedText(scenario.journey.scenarioTitle, secrets),
+        steps: steps.steps,
     };
     // The plan lists E2B_API_KEY and the subject env only for a live clone.
     const { requirements } = plan;
@@ -127,6 +131,13 @@ export async function prepareScriptedRun(plan, input) {
         },
     };
 }
+/**
+ * Scenario text the run records, without the run's known values and then without keys as written
+ * or encoded, since verify decodes the files that record it.
+ */
+function recordedText(text, secrets) {
+    return redactEncodedText(secrets.scrub(text));
+}
 /**
  * Whether an id holds a known value as written or as the parser's id token of it, lower-cased with
  * other characters as `-`, which the scrub would not find.
@@ -139,22 +150,56 @@ function idHoldsKnownValue(id, secrets) {
         }));
 }
 /**
- * The steps with their labels scrubbed and their ids safe to record. A step id names the step's
- * screenshot file and is recorded beside it, and the parser derives an omitted id from the label,
- * lower-cased and cut to 80 characters, so the scrub may not find a value in it. A step whose
- * label or id holds a known value is renamed by its position instead.
+ * The steps with their labels redacted and their ids safe to record, or why the run is refused. A
+ * step id names the step's screenshot file and is recorded beside it, and the parser derives an
+ * omitted id from the label, lower-cased and cut to 80 characters, so the scrub may not find a
+ * value in it. A step whose label changes under recordedText, or whose id holds a known value, is
+ * renamed by its position instead.
  */
 function recordedStepIds(steps, secrets) {
     const taken = new Set(steps.map((step) => step.id));
-    return steps.map((step, index) => {
-        const label = secrets.scrub(step.label);
-        if (label === step.label && !idHoldsKnownValue(step.id, secrets))
-            return { ...step, label };
-        const position = `step-${String(index + 1).padStart(2, "0")}`;
-        let id = position;
-        for (let suffix = 2; taken.has(id); suffix += 1)
-            id = `${position}-${suffix}`;
+    const recorded = [];
+    for (const [index, step] of steps.entries()) {
+        const label = recordedText(step.label, secrets);
+        if (label === step.label && !idHoldsKnownValue(step.id, secrets)) {
+            recorded.push({ ...step, label });
+            continue;
+        }
+        const id = positionId(index, taken, secrets);
+        if (id === undefined)
+            return {
+                ok: false,
+                message: `The label or id of scenario step ${index + 1} holds a key, a local path or a value this run keeps out of its files, so the run renames the step by its position, and each id that position gives holds one of those values too. Remove it from the step's label and id.`,
+            };
         taken.add(id);
-        return { ...step, id, label };
-    });
+        recorded.push({ ...step, id, label });
+    }
+    return { ok: true, steps: recorded };
+}
+/**
+ * The id a renamed step takes by its position, such as step-03 for the third step, then step-03-2,
+ * step-03-3 and on when another step has it. A known value can be one of these ids, so one that
+ * holds a known value is passed over. Every id holds the position id, so a position id that holds a
+ * known value gives undefined at once. Otherwise taken.size + 1 ids that hold no known value are
+ * tried, which includes a free one, as long as known values pass over at most
+ * MAX_KNOWN_VALUE_SKIPS of them; a value such as `-01-` that every numbered id holds gives undefined.
+ */
+function positionId(index, taken, secrets) {
+    const position = `step-${String(index + 1).padStart(2, "0")}`;
+    if (idHoldsKnownValue(position, secrets))
+        return undefined;
+    let skips = 0;
+    for (let suffix = 1; suffix <= taken.size + 1 + skips; suffix += 1) {
+        const id = suffix === 1 ? position : `${position}-${suffix}`;
+        if (taken.has(id))
+            continue;
+        if (!idHoldsKnownValue(id, secrets))
+            return id;
+        if (skips === MAX_KNOWN_VALUE_SKIPS)
+            return undefined;
+        skips += 1;
+    }
+    return undefined;
 }
+// Known values are few, and a numbered id holds one only when the value matches its digits.
+const MAX_KNOWN_VALUE_SKIPS = 32;

package/dist/routes/shared-world/bundle.js

@@ -1,7 +1,7 @@
 // Builds the run bundle for a concurrent shared-world run: per-participant simulations, streams and
 // events, the sharedWorld evidence block and the review summary.
 import { receivingPublication } from "../../comms/receiving-runtime.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { planeStateOf } from "./plan.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import { SHARED_WORLD_SCHEMA, concurrencyFacts, sharedWorldParticipantKeys, } from "../../run/shared-world-evidence.js";
@@ -362,7 +362,7 @@ export function buildConcurrentSharedWorldBundle(args) {
         scenario: {
             id: `concurrent-shared-world-${plan.studyId}`,
             title: plan.title ?? `Concurrent shared-world: ${plan.studyId}`,
-            goal: redactText(actorSpecs[0]?.evidenceInstructions ??
+            goal: redactEncodedText(actorSpecs[0]?.evidenceInstructions ??
                 actorSpecs[0]?.instructions ??
                 "Concurrent shared-world interaction."),
             source: `study:${plan.studyId}`,
@@ -423,7 +423,7 @@ function sharedWorldFeedbackCandidates(args) {
                 participantId: spec.planned.id,
                 streamId: spec.streamId,
                 personaId: spec.persona.id,
-                goal: redactText(spec.evidenceInstructions ?? spec.instructions),
+                goal: redactEncodedText(spec.evidenceInstructions ?? spec.instructions),
                 ...(outcome?.session === undefined
                     ? {}
                     : { session: outcome.session, traceArtifactPath: spec.traceArtifactPath }),

package/dist/routes/shared-world/participant-specs.js

@@ -10,7 +10,7 @@ import { startLiveTraceFlush } from "../computer-use/live-flush.js";
 import { desktopParticipantDeps, } from "../computer-use/participant-deps.js";
 import { resolveCommittedPersonasForCwd } from "../../study/persona-resolve.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { sandboxHeadroomMs } from "../../substrates/e2b/lifetime.js";
 // prose-check: model prompt (the participant model reads this, not a person)
 const DEFAULT_MISSION = "You are one of MANY users hitting a shared web application at the same time. The browser is already open at the app. Accomplish your role's task, then stop.";
@@ -178,7 +178,7 @@ export async function buildParticipantSpecs(participants, cwd, scrubKnownValues)
     for (const spec of actorSpecs) {
         if (spec.evidenceAssignment)
             spec.evidenceAssignment = participantAssignment(spec.evidenceAssignment, scrubKnownValues);
-        spec.evidenceInstructions = redactText(scrubKnownValues(spec.instructions));
+        spec.evidenceInstructions = redactEncodedText(scrubKnownValues(spec.instructions));
         spec.persona = scrubPersonaBrief(spec.persona, scrubKnownValues);
     }
     return actorSpecs;

package/dist/routes/terminal/bundle.js

@@ -1,4 +1,4 @@
-import { redactText } from "../../evidence/redaction.js";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { participantAssignment } from "../../study/participant-assignment.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
 import {} from "../../run/judge.js";
@@ -250,7 +250,7 @@ function terminalRunBundle(args, parts) {
             // The author mission is public-safe committed study text. It is recorded plaintext as the goal,
             // redacted defensively before persisting (it never carries a secret, but the harness never
             // trusts that). The full composed prompt is bound by digest, not text.
-            goal: redactText(args.mission),
+            goal: redactEncodedText(args.mission),
             source: `study:${args.studyId}`,
             sourceDigest: args.persona.promptDigest,
         },

package/dist/run/bundle.d.ts

@@ -4,7 +4,7 @@ import type { ExecutionOutcome } from "./judge.js";
 import type { SharedWorldEvidence } from "./shared-world-evidence.js";
 import { type RunStudyProvenance } from "./study-provenance.js";
 import type { RunInterruptSignal } from "./status.js";
-import type { RunSimulationStatus, RunStream, RunStreamKind, StoredRunStream } from "./streams.js";
+import type { DisplayedRunStream, RunSimulationStatus, RunStream, RunStreamKind, StoredRunStream } from "./streams.js";
 /**
  * The run bundle version this release writes: each stream's trace, and each running participant's
  * items so far, are files run.json indexes, and each participant's per-request lists are only in
@@ -395,6 +395,10 @@ export interface RunBundle {
 export type StoredRunBundle = Omit<RunBundle, "streams"> & {
     streams: StoredRunStream[];
 };
+/** A loaded bundle as a reader that shows the run has it (displayedTraces): DisplayedRunStreams. */
+export type DisplayedRunBundle = Omit<RunBundle, "streams"> & {
+    streams: DisplayedRunStream[];
+};
 /**
  * How a run ended. `finished`: Run.finish published the final bundle with the route result's `ok`
  * and its execution outcome (`judgeExecution` in src/run/judge.ts). `interrupted`: the CLI's signal

package/dist/run/locate.d.ts

@@ -1,7 +1,7 @@
 import { type PreparedRunArtifactPaths } from "./paths.js";
 import { type ContainedRefusal, type PreparedSelectedOutputDirectory } from "./contained-output.js";
 import type { RunPointer } from "./results.js";
-import { type RunBundle } from "./bundle.js";
+import { type DisplayedRunBundle, type RunBundle } from "./bundle.js";
 import { type BoundedFileResult } from "./evidence-files.js";
 /** The run input that resolves through latest.json rather than naming a run directory. */
 export declare const LATEST_RUN_ALIAS = "latest";
@@ -55,15 +55,17 @@ export declare function loadRunBundle(cwdInput: string, runInput: string): Promi
     bundlePath: string;
     runDir: string;
 } | null>;
-/**
- * loadRunBundle for a caller that already holds prepared paths. Revalidates them first. With
- * `display`, a participant whose trace the loader refuses, such as one past the read limit, is
- * kept as displayedTraces shows it, for a page that shows the run.
- */
-export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths, options?: {
-    display?: boolean;
-}): Promise<{
-    bundle: RunBundle;
+/** A run's bundle, run.json's path relative to the working directory, and the run folder. */
+type LoadedRun<T> = {
+    bundle: T;
     bundlePath: string;
     runDir: string;
-} | null>;
+};
+/** loadRunBundle for a caller that already holds prepared paths. Revalidates them first. */
+export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths): Promise<LoadedRun<RunBundle> | null>;
+/**
+ * loadRunBundlePrepared for a page that shows the run: a participant whose trace the loader
+ * refuses, such as one past the read limit, is kept as displayedTraces shows it.
+ */
+export declare function loadDisplayedRunBundle(cwdInput: string, runPaths: PreparedRunArtifactPaths): Promise<LoadedRun<DisplayedRunBundle> | null>;
+export {};

package/dist/run/locate.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveExistingRunDirectory, resolveLatestRunDirectory, RUNS_RELATIVE_ROOT, validatePreparedRunArtifactPaths, } from "./paths.js";
 import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, ContainedReadRefusedError, LATEST_POINTER_MAX_BYTES, readContainedRegularFile, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
-import { RUN_BUNDLE_FILE } from "./bundle.js";
+import { RUN_BUNDLE_FILE, } from "./bundle.js";
 import { isRunBundle, isRunPointer } from "./bundle-shape.js";
 import { displayedTraces, loadRunTraces, loadStreamTraces } from "./stream-trace.js";
 import { readUnchangedFile } from "./evidence-files.js";
@@ -119,29 +119,36 @@ export async function loadRunBundle(cwdInput, runInput) {
     }
     return loadRunBundlePrepared(cwd, runPaths);
 }
+/** loadRunBundle for a caller that already holds prepared paths. Revalidates them first. */
+export async function loadRunBundlePrepared(cwdInput, runPaths) {
+    const run = await readPreparedRunJson(cwdInput, runPaths);
+    // A trace that does not match its index throws StreamTraceRefusedError, naming the participant.
+    return run === null ? null : { ...run, bundle: await loadRunTraces(runPaths, run.bundle) };
+}
 /**
- * loadRunBundle for a caller that already holds prepared paths. Revalidates them first. With
- * `display`, a participant whose trace the loader refuses, such as one past the read limit, is
- * kept as displayedTraces shows it, for a page that shows the run.
+ * loadRunBundlePrepared for a page that shows the run: a participant whose trace the loader
+ * refuses, such as one past the read limit, is kept as displayedTraces shows it.
  */
-export async function loadRunBundlePrepared(cwdInput, runPaths, options = {}) {
+export async function loadDisplayedRunBundle(cwdInput, runPaths) {
+    const run = await readPreparedRunJson(cwdInput, runPaths);
+    if (run === null)
+        return null;
+    return { ...run, bundle: displayedTraces(await loadStreamTraces(runPaths, run.bundle)) };
+}
+/** The prepared run's run.json when it is a run bundle, after revalidating the paths; else null. */
+async function readPreparedRunJson(cwdInput, runPaths) {
     const cwd = path.resolve(cwdInput);
     await validatePreparedRunArtifactPaths(runPaths);
-    const bundlePath = path.join(runPaths.absoluteRunRoot, RUN_BUNDLE_FILE);
     const read = await readRunJsonIfExists(runPaths, RUN_BUNDLE_FILE);
     // A run.json it refuses is no reason to call the run absent: the caller reports why.
     if (read.status === "refused")
         throw new ContainedReadRefusedError(RUN_BUNDLE_FILE, read);
     const bundle = read.status === "read" ? read.value : null;
-    if (!isRunBundle(bundle)) {
+    if (!isRunBundle(bundle))
         return null;
-    }
     return {
-        // A trace that does not match its index throws StreamTraceRefusedError, naming the participant.
-        bundle: options.display === true
-            ? displayedTraces(await loadStreamTraces(runPaths, bundle))
-            : await loadRunTraces(runPaths, bundle),
-        bundlePath: path.relative(cwd, bundlePath),
+        bundle,
+        bundlePath: path.relative(cwd, path.join(runPaths.absoluteRunRoot, RUN_BUNDLE_FILE)),
         runDir: runPaths.absoluteRunRoot,
     };
 }

package/dist/run/paths.js

@@ -1,5 +1,6 @@
 import { lstat, mkdir, readdir, realpath, rmdir } from "node:fs/promises";
 import path from "node:path";
+import { mapWithConcurrency } from "./concurrency.js";
 import { isNodeError } from "./type-guards.js";
 export const RUNS_RELATIVE_ROOT = path.join(".humanish", "runs");
 const LATEST_RUN_RELATIVE_PATH = path.join(RUNS_RELATIVE_ROOT, "latest.json");
@@ -262,35 +263,44 @@ export async function assertRegularFileOrMissing(filePath, subject = "humanish s
         throw error;
     }
 }
-async function assertNoSymlinkDescendants(directory) {
-    const entries = await readdir(directory, { withFileTypes: true });
-    for (const entry of entries) {
-        const child = path.join(directory, entry.name);
-        // A run directory can be written concurrently with this walk: the atomic writer creates a
-        // `.humanish-write-*.tmp` sibling and renames it, and a run now also refreshes its own status
-        // record on a cadence. An entry that vanished between readdir and lstat therefore proves
-        // nothing except that it is gone, and a path that no longer exists cannot be a symlink escape:
-        // skip it rather than failing the containment check on a benign race.
-        let stats;
-        try {
-            stats = await lstat(child);
-        }
-        catch (error) {
-            if (isNodeError(error) && error.code === "ENOENT") {
-                continue;
-            }
-            throw error;
-        }
-        if (stats.isSymbolicLink()) {
-            throw new Error("humanish run directories must not contain symbolic links.");
-        }
-        if (stats.isDirectory()) {
-            await assertNoSymlinkDescendants(child);
-        }
-        else if (!stats.isFile() || stats.nlink > 1) {
-            throw new Error("humanish run leaves must be single-link regular files, not hardlinks or special files.");
-        }
+// Entries the storage check lists or lstats at once. A run folder holds one entry per screenshot,
+// about 70,000 for 24 participants working 8 hours, and one call at a time left the process idle
+// between calls.
+const STORAGE_CHECK_CONCURRENCY = 32;
+/** Every entry under `root` is a directory or a single-link regular file, checked a level at a time. */
+async function assertNoSymlinkDescendants(root) {
+    let directories = [root];
+    while (directories.length > 0) {
+        const listed = await mapWithConcurrency(directories, STORAGE_CHECK_CONCURRENCY, async (dir) => (await readdir(dir, { withFileTypes: true })).map((entry) => path.join(dir, entry.name)));
+        const children = listed.flat();
+        const kinds = await mapWithConcurrency(children, STORAGE_CHECK_CONCURRENCY, storageEntryKind);
+        directories = children.filter((_, index) => kinds[index] === "directory");
+    }
+}
+async function storageEntryKind(child) {
+    // A run directory can be written concurrently with this walk: the atomic writer creates a
+    // `.humanish-write-*.tmp` sibling and renames it, and a run also refreshes its own status record
+    // on a cadence. An entry that vanished between readdir and lstat therefore proves nothing except
+    // that it is gone, and a path that no longer exists cannot be a symlink escape: skip it rather
+    // than failing the containment check on a benign race.
+    let stats;
+    try {
+        stats = await lstat(child);
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return "gone";
+        throw error;
+    }
+    if (stats.isSymbolicLink()) {
+        throw new Error("humanish run directories must not contain symbolic links.");
+    }
+    if (stats.isDirectory())
+        return "directory";
+    if (!stats.isFile() || stats.nlink > 1) {
+        throw new Error("humanish run leaves must be single-link regular files, not hardlinks or special files.");
     }
+    return "file";
 }
 async function capturePreparedRunArtifactPaths(paths, runRoot) {
     const physicalRunRoot = await realpath(runRoot);

package/dist/run/run.js

@@ -3,6 +3,7 @@
 // their own evidence files; this module owns when the run starts, how it is published, and how it
 // is closed on every exit.
 import { randomBytes } from "node:crypto";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 import { redactText } from "../evidence/redaction.js";
 import { buildObserverData } from "../observer/data.js";
 import { splitObserverData } from "../observer/participant-items.js";
@@ -160,14 +161,14 @@ function runPublisher(args) {
     const { options, runId, createdAt, paths, runStatus, now, admit, participantsRan } = args;
     const observer = observerTarget(options);
     // The study's warnings join whatever events the route wrote, once, in every write. A warning can
-    // quote the study file, which may name a sandbox URL a participant needs, so each goes through
-    // the redaction a run failure gets.
+    // quote the study file, which may name a sandbox URL a participant needs or hold an encoded key,
+    // so each goes through the redaction study text gets.
     const studyWarnings = (options.warnings ?? []).map((message, index) => ({
         id: `event-study-warning-${String(index + 1).padStart(3, "0")}`,
         at: createdAt,
         level: "warn",
         type: "study.warning",
-        message: redactText(message),
+        message: redactEncodedText(message),
     }));
     // So do the host suspensions the heartbeat has seen by the time of the write, and the files the
     // final sandbox id sweep could not read.

package/dist/run/stream-trace.d.ts

@@ -1,4 +1,4 @@
-import { type RunBundle, type StoredRunBundle } from "./bundle.js";
+import { type DisplayedRunBundle, type RunBundle, type StoredRunBundle } from "./bundle.js";
 import { type PreparedOutputRoot } from "./contained-output.js";
 import { type LiveItemsCursor } from "./live-items.js";
 import type { LiveItemsIndex, RunStream, StoredRunStream, WithoutRequestLists } from "./streams.js";
@@ -131,7 +131,7 @@ export declare function displayedTraces(loaded: {
     bundle: RunBundle;
     refused: readonly StreamTraceRefusedError[];
     live?: readonly LiveItemsRead[];
-}): RunBundle;
+}): DisplayedRunBundle;
 /**
  * What `reduce` returns for each stream of the bundle, loaded as loadRunTraces loads it, in stream
  * order; the first refusal throws. Streams are loaded one at a time and nothing of a stream's files

package/dist/run/stream-trace.js

@@ -178,7 +178,7 @@ function containedReader(runPaths) {
 }
 /**
  * The stream from the bytes of its trace file: its actor with the file's items, and its artifacts
- * followed by the file's screenshot entries, without the index.
+ * followed by the file's screenshot entries, without the index. Its live actor is as it was.
  */
 function joinTrace(stream, bytes) {
     const index = stream.trace;
@@ -246,12 +246,19 @@ function assertIndex(stream) {
         throw new StreamTraceRefusedError(stream.id, "run.json holds items beside its trace index");
 }
 /**
- * A stream of run.json typed as a loaded one, for the streams the loader joins no trace into: one
- * without an index, which v1 wrote with its actor's lists, and a refused one, kept as run.json
- * holds it. From v4 a refused stream's actor has none of the lists, and its `conversation` lacks
- * the `requests` ActorTrace declares; the loader's `refused` names each such stream.
+ * The joined stream as a loaded one, once its actor's conversation, if any, holds the requests
+ * list ActorTrace types as present. The writer writes the list with every conversation, in
+ * run.json before v4 and in the trace file from v4, so a stream without it was edited, and a reader
+ * that counts the requests would throw. Items a v1 run.json or a humanish.live-actor.v1 live actor
+ * holds inline are taken as they are.
  */
-const unjoined = (stream) => stream;
+function asLoaded(stream) {
+    const conversation = stream.actor?.conversation;
+    if (conversation !== undefined &&
+        !(isRecord(conversation) && Array.isArray(conversation.requests)))
+        throw new StreamTraceRefusedError(stream.id, "its actor records a conversation without the requests list");
+    return stream;
+}
 /** A live actor whose items run.json holds inline: humanish.live-actor.v1, or one with no schema. */
 const isInlineLiveActor = (live) => live.schema === LIVE_ACTOR_V1_SCHEMA || live.schema === undefined;
 /** A live file that could not be read, which a writer that moved on may have removed. */
@@ -345,7 +352,7 @@ async function readLiveTail(read, stream, index, after) {
  */
 async function readStreamTrace(read, stream, maxBytes, liveAfter) {
     const files = [];
-    let joined = unjoined(stream);
+    let joined = stream;
     if (stream.trace !== undefined) {
         assertIndex(stream);
         if (stream.trace.bytes > maxBytes)
@@ -359,7 +366,11 @@ async function readStreamTrace(read, stream, maxBytes, liveAfter) {
     const live = await readLiveItems(read, joined, maxBytes, liveAfter);
     if (live.file !== undefined)
         files.push(live.file);
-    return { stream: live.stream, files, ...(live.read === undefined ? {} : { live: live.read }) };
+    return {
+        stream: asLoaded(live.stream),
+        files,
+        ...(live.read === undefined ? {} : { live: live.read }),
+    };
 }
 /**
  * The stream as a v1 run.json held it: its actor with every item and every artifact entry. A
@@ -500,7 +511,9 @@ async function loadEveryStream(read, bundle, maxBytes, liveAfter) {
             if (!(error instanceof StreamTraceRefusedError))
                 throw error;
             refused.push(error);
-            streams.push(unjoined(stream));
+            // Kept as run.json holds it, typed as loaded: from v2 its actor has no items, and from v4
+            // none of the lists. The loader's `refused` names it, and displayedTraces shows it so.
+            streams.push(stream);
         }
     }
     return { bundle: { ...bundle, streams }, refused, files, live };
@@ -523,12 +536,12 @@ export function displayedTraces(loaded) {
         if (reason === undefined)
             return stream;
         const { liveActor: _live, trace: _index, actor, ...rest } = stream;
-        return unjoined({
+        return {
             ...rest,
             ...(actor === undefined ? {} : { actor: { ...withoutRequestLists(actor), items: [] } }),
             artifacts: stream.artifacts.filter((artifact) => !isScreenshot(artifact)),
             traceUnavailable: reason,
-        });
+        };
     });
     const events = loaded.bundle.streams
         .filter((stream) => reasons.has(stream.id))

package/dist/run/streams.d.ts

@@ -327,11 +327,26 @@ export type WithoutRequestLists<T> = Omit<T, "providerRequests" | "tokenUsage" |
     [K in "conversation" & keyof T]?: Omit<NonNullable<T[K]>, "requests"> | undefined;
 };
 /**
- * A stream as run.json holds it, in any version: its actor and live actor WithoutRequestLists.
- * loadStreamTraces joins the lists from the trace file.
+ * `T` WithoutRequestLists and with `items` optional: a v1 run.json holds the items inline, and from
+ * v2 (an actor) or v3 (a live actor) a file holds them.
+ */
+type StoredTrace<T extends {
+    items: unknown;
+}> = WithoutRequestLists<Omit<T, "items">> & Partial<Pick<T, "items">>;
+/**
+ * A stream as run.json holds it, in any version: its actor and live actor without the per-request
+ * lists, and with items only in a v1 run.json. loadStreamTraces joins both from the files.
  */
 export type StoredRunStream = Omit<RunStream, "actor" | "liveActor"> & {
+    actor?: StoredTrace<ActorTrace>;
+    liveActor?: StoredTrace<NonNullable<RunStream["liveActor"]>>;
+};
+/**
+ * A stream as a reader that shows the run has it (displayedTraces in src/run/stream-trace.ts):
+ * loaded, or with `traceUnavailable` when the loader refused its trace. A refused stream's actor
+ * keeps run.json's summary, which from v4 has none of the per-request lists, so the type has none.
+ */
+export type DisplayedRunStream = Omit<RunStream, "actor"> & {
     actor?: WithoutRequestLists<ActorTrace>;
-    liveActor?: WithoutRequestLists<NonNullable<RunStream["liveActor"]>>;
 };
 export {};

package/dist/run-study.d.ts

@@ -21,9 +21,9 @@ export declare function runStudyWith(config: StudyConfig, options: InternalRunSt
 /**
  * The package's study runner (`src/index.ts`): runStudyWith with the public options only. A
  * config that skipped parseStudy is checked first (libraryConfigRefusal): a humanish.lab.v2 config
- * or one with a humanish 0.110 field, no `actor`, or a `route` the config does not take. That, or a
- * field RunStudyOptions no longer has, is refused in the route's own result envelope before
- * anything runs.
+ * or one with a humanish 0.110 field, no `actor`, a `route` the config does not take, or an
+ * `actor.model` verify would flag. That, or a field RunStudyOptions no longer has, is refused in the
+ * route's own result envelope before anything runs.
  */
 export declare function runStudy(config: StudyConfig, options: RunStudyOptions): Promise<StudyOutcome>;
 /** A study planned once: the route's refusal, or the run of its plan. */