humanish 0.135.0 → 0.136.0

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.136.0: verify takes less than half the time on large runs (2026-10-14)
+
+humanish 0.136.0 makes `humanish verify` take less than half the time on large runs. It checks a
+run folder for links 32 entries at a time and inflates screenshots on Node's thread pool, 1 MiB of
+rows at a time, and still runs every check it ran before. On a run folder of 15,000 entries verify
+took 3.3 seconds where it took 7.7, and on a run with 3,000 real screenshots 4.2 seconds where it
+took 10.3. A computer-use participant that repeats a base64- or percent-encoded key from its
+instructions no longer makes the run `blocked`. `humanish analyze` names the participant and the
+event id when two run events share an id, and reports `ANALYSIS_SOURCE_INVALID` where it reported
+`ANALYSIS_UNAVAILABLE`. The bundle estimate counts participants' instructions and task goals with
+the mission, `init` prints three next steps in 24 lines, and reading a run refuses a conversation
+without its requests list.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.136.0)
+
 ## 0.135.0: Encoded keys in a study's own text stay out of the run (2026-10-14)
 
 humanish 0.135.0 keeps a base64- or percent-encoded key in a study's own text out of the copies of

package/dist/actors/computer-use/loop/session.js

@@ -1,3 +1,4 @@
+import { redactEncodedText } from "../../../evidence/encoded-text.js";
 import { TaskTracker } from "../../../study/tasks.js";
 import { StreakRecord } from "./streak.js";
 import { TraceRecorder } from "./trace.js";
@@ -124,9 +125,13 @@ export class LoopSession {
     }
     // Model-authored narration: literal-scrub known provisioned values, then pattern-redact.
     // A value the model transcribes (a DB password it read on screen) has no shape, so redactText
-    // alone cannot catch it; the run's scrubKnownValues, injected as scrubText, closes that.
+    // alone cannot catch it; the run's scrubKnownValues, injected as scrubText, closes that. The
+    // participant receives its instructions as written, so it can repeat a key the study wrote
+    // base64- or percent-encoded, which verify decodes; redactEncodedText removes that one too.
+    // The known values are scrubbed again last: a marker written before other text can spell one,
+    // as `[REDACTED_SECRET] and` spells `SECRET] and`.
     redactNarration(text) {
-        return this.settings.redaction.redactText(this.scrubText(text));
+        return this.scrubText(redactEncodedText(this.settings.redaction.redactText(this.scrubText(text))));
     }
     /** Hand a watcher the trace so far with the running usage, without waiting on it. */
     flush() {

package/dist/actors/scripted-browser/actor.js

@@ -124,7 +124,7 @@ export async function runScriptedBrowserSessionInPreparedRoot(options, preparedA
         browser = await launch({ browserCommand, timeoutMs: options.timeoutMs });
     }
     catch (error) {
-        const reason = `Scripted browser launch failed: ${compactBrowserError(error)}`;
+        const reason = `Scripted browser launch failed: ${compactBrowserError(error, scrub)}`;
         const capture = await persistScriptedFailureCapture({
             appUrl: options.appUrl,
             artifactRoot: preparedArtifactRoot,
@@ -196,7 +196,7 @@ async function runScriptedJourney(args) {
     const started = Date.now();
     const deadline = started + args.timeoutMs;
     const tracePath = tracePathForBrowserSurface(args.surface);
-    const httpProbe = await probeAppUrl(args.appUrl, Math.min(args.timeoutMs, 15_000));
+    const httpProbe = await probeAppUrl(args.appUrl, Math.min(args.timeoutMs, 15_000), args.scrub);
     let page = null;
     const steps = [];
     let executedSteps = 0;
@@ -230,7 +230,7 @@ async function runScriptedJourney(args) {
         await assertScriptedOutputRoot(args.artifactRoot);
         timedOut = error instanceof ScriptedJourneyTimeoutError;
         const now = new Date().toISOString();
-        const reason = compactBrowserError(error);
+        const reason = compactBrowserError(error, args.scrub);
         if (steps.length === 0) {
             steps.push(...buildBlockedBrowserPersonaSteps({
                 browserJourney: args.journey,

package/dist/actors/scripted-browser/steps.d.ts

@@ -53,10 +53,17 @@ export declare function buildBrowserTrace(args: {
     surface: BrowserSurface;
 }): Record<string, unknown>;
 export declare function sanitizeBrowserEvidenceUrl(value: string, urlPolicy?: ScriptedBrowserEvidenceUrlPolicy): string;
-export declare function probeAppUrl(appUrl: string, timeoutMs: number): Promise<{
+export declare function probeAppUrl(appUrl: string, timeoutMs: number, scrubKnown: (text: string) => string): Promise<{
     ok: boolean;
     reason: string;
     status?: number;
 }>;
 export declare function normalizeLocalAppUrl(value: string): string | null;
-export declare function compactBrowserError(error: unknown): string;
+/**
+ * A browser error as a step records it, cut to 240 characters. It can quote the step's selector or
+ * URL, which the scenario wrote and the browser received as written, so keys are redacted as
+ * written and in the encoded forms verify decodes. The run's known values are scrubbed between
+ * the two passes, so the encoded pass cannot cut one apart before its scrub reads it. The cut
+ * comes last, so it cannot split a value either pass would find.
+ */
+export declare function compactBrowserError(error: unknown, scrubKnown: (text: string) => string): string;

package/dist/actors/scripted-browser/steps.js

@@ -4,6 +4,7 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { redactEncodedText } from "../../evidence/encoded-text.js";
 import { assertScreenshotEvidence, stripPngMetadataChunks } from "../../evidence/image.js";
 import { digestText, redactToSecretLabel } from "../../evidence/redaction.js";
 import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputFile, prepareSelectedOutputDirectory, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, } from "../../run/contained-output.js";
@@ -94,7 +95,7 @@ export async function executeBrowserPersonaStep(args) {
     const screenshotPath = screenshotPathForBrowserStep(args.surface, args.step);
     await prepareContainedOutputFile(args.absoluteArtifactRoot, screenshotPath);
     const screenshotBytes = await captureScriptedPageScreenshot(args.page);
-    assertScreenshotEvidence(screenshotPath, screenshotBytes);
+    await assertScreenshotEvidence(screenshotPath, screenshotBytes);
     await writeContainedOutputFile(args.absoluteArtifactRoot, screenshotPath, screenshotBytes);
     const assertions = await evaluateBrowserStepExpectations({
         afterState,
@@ -233,7 +234,7 @@ export async function captureBlockedStepScreenshot(page, artifactRoot, surface,
     }
     try {
         const screenshotBytes = await captureScriptedPageScreenshot(page);
-        assertScreenshotEvidence(screenshotPath, screenshotBytes);
+        await assertScreenshotEvidence(screenshotPath, screenshotBytes);
         await writeContainedOutputFile(artifactRoot, screenshotPath, screenshotBytes);
         return { screenshotPath, written: true };
     }
@@ -333,7 +334,7 @@ export function sanitizeBrowserEvidenceUrl(value, urlPolicy = LOOPBACK_EVIDENCE_
         return evidenceOrigin;
     }
 }
-export async function probeAppUrl(appUrl, timeoutMs) {
+export async function probeAppUrl(appUrl, timeoutMs, scrubKnown) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -349,7 +350,7 @@ export async function probeAppUrl(appUrl, timeoutMs) {
     catch (error) {
         return {
             ok: false,
-            reason: compactBrowserError(error),
+            reason: compactBrowserError(error, scrubKnown),
         };
     }
     finally {
@@ -375,11 +376,18 @@ export function normalizeLocalAppUrl(value) {
         return null;
     }
 }
-export function compactBrowserError(error) {
-    if (error instanceof Error) {
-        return redactSensitiveText(error.message).replace(/\s+/g, " ").slice(0, 240);
-    }
-    return redactSensitiveText(String(error)).replace(/\s+/g, " ").slice(0, 240);
+/**
+ * A browser error as a step records it, cut to 240 characters. It can quote the step's selector or
+ * URL, which the scenario wrote and the browser received as written, so keys are redacted as
+ * written and in the encoded forms verify decodes. The run's known values are scrubbed between
+ * the two passes, so the encoded pass cannot cut one apart before its scrub reads it. The cut
+ * comes last, so it cannot split a value either pass would find.
+ */
+export function compactBrowserError(error, scrubKnown) {
+    const text = error instanceof Error ? error.message : String(error);
+    return redactEncodedText(scrubKnown(redactToSecretLabel(text)))
+        .replace(/\s+/g, " ")
+        .slice(0, 240);
 }
 function browserScreenshotBytes(value) {
     if (Buffer.isBuffer(value)) {
@@ -415,6 +423,3 @@ async function captureScriptedPageScreenshot(page) {
             .catch(() => undefined);
     }
 }
-function redactSensitiveText(text) {
-    return redactToSecretLabel(text);
-}

package/dist/analysis/evidence-sources.js

@@ -1,9 +1,10 @@
 import { receivingAnalysisContext } from "../comms/receiving-evidence.js";
-import { eventRecordIdOf, recordIdOf, streamParticipantIdOf } from "../run/participant-records.js";
+import { streamParticipantIdOf } from "../run/participant-records.js";
 import { cuaEndpointSource } from "../actors/goal-source.js";
 import { isRecord } from "../run/type-guards.js";
 import { ACTION_CAPTURE_VERSION, } from "./types.js";
 import { decodesToPlainRelativePath, isEvidencePath } from "../run/evidence-files.js";
+import { isRunEventOf } from "./source.js";
 // How a run bundle becomes analysis sources: each participant's recorded provenance and assignment,
 // the evidence entries its trace offers, and the order in which entries are admitted under the
 // count and byte budgets. captureEvidence selects from these, taking each participant's while its
@@ -97,8 +98,7 @@ export function participantSource(stream, captureVersion) {
         },
     };
 }
-const runEventsOf = (bundle, stream) => bundle.events.filter((entry) => entry.streamId === stream.id ||
-    (entry.streamId === undefined && eventRecordIdOf(entry) === recordIdOf(stream)));
+const runEventsOf = (bundle, stream) => bundle.events.filter((event) => isRunEventOf(stream, event));
 /**
  * How many entries sourceEntries gives of run.json's `stream` once its trace is loaded, counted
  * before the trace is read: the trace loader refuses a trace that does not hold the item count its
@@ -163,11 +163,8 @@ export function sourceEntries(bundle, stream, captureVersion) {
             failed: ["failed", "blocked", "timed_out"].includes(item.status ?? ""),
         });
     }
-    const runEventIds = new Set();
+    // parseAnalysisSource refuses a run.json in which two of a participant's run events share an id.
     for (const event of runEventsOf(bundle, stream)) {
-        if (runEventIds.has(event.id))
-            throw new Error("ANALYSIS_SOURCE_EVENT_DUPLICATE");
-        runEventIds.add(event.id);
         entries.push({
             eventId: event.id,
             kind: `run_event:${event.type}`,

package/dist/analysis/evidence.js

@@ -46,8 +46,8 @@ export async function captureEvidence(prepared, bundleBytes, requested = {}) {
     // Admission stops at a participant's evidence share. The shares come from run.json's counts, so
     // only the first share of each participant's entries in admission order is kept of its trace.
     const shares = evidenceShares(bundle, limits, captureVersion);
-    // A participant past limits.participants has its trace read and checked by the loader, and gives
-    // no entries, so nothing in its run events or items can refuse the participants that are kept.
+    // A participant past limits.participants has its trace read and checked like the others' and
+    // gives no entries.
     const sources = await readParticipantTraces(prepared, bundle, (stream, index) => index < limits.participants
         ? participantSources(bundle, bundle.streams[index], stream, captureVersion, {
             evidenceShare: shares[index],
@@ -229,7 +229,7 @@ async function selectCaptures(prepared, packings, sel, omissions) {
             const bytes = result.state === "read" ? result.bytes : null;
             sel.returnedImageBytes += bytes?.length ?? 0;
             packing.readBytes += bytes?.length ?? 0;
-            if (bytes === null || screenshotEvidenceError(source.capturePath, bytes) !== null) {
+            if (bytes === null || (await screenshotEvidenceError(source.capturePath, bytes)) !== null) {
                 omissions.add("Some captures were missing, unsafe, oversized, or invalid PNG evidence.");
                 continue;
             }
@@ -453,7 +453,7 @@ export async function validateAnalysisEvidence(prepared, artifact, bundleBytes)
             let hash = checkedCaptures.get(source.capturePath);
             if (hash === undefined) {
                 const bytes = await readBoundedFile(prepared, source.capturePath, EVIDENCE_LIMITS.imageBytes);
-                if (!bytes || screenshotEvidenceError(source.capturePath, bytes) !== null)
+                if (!bytes || (await screenshotEvidenceError(source.capturePath, bytes)) !== null)
                     throw new Error("ANALYSIS_CAPTURE_UNAVAILABLE");
                 checkedImageBytes += bytes.length;
                 if (checkedImageBytes > imageByteLimit)

package/dist/analysis/source.d.ts

@@ -1,6 +1,6 @@
-import { type StoredRunBundle } from "../run/bundle.js";
+import { type RunEvent, type StoredRunBundle } from "../run/bundle.js";
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
-import type { RunStream } from "../run/streams.js";
+import type { RunStream, StoredRunStream } from "../run/streams.js";
 /**
  * A refusal of the run's recorded source. Its message is the code, as every analysis error's is,
  * and `reason` says which file analysis did not read and why, for the person who asked.
@@ -11,10 +11,13 @@ export declare class AnalysisSourceRefusedError extends Error {
 }
 /** The refusal of a run.json of `size` bytes, more than the `max` analysis reads of it. */
 export declare function runFileTooLarge(size: number | bigint, max: number): AnalysisSourceRefusedError;
+/** Whether `event` is `stream`'s: it names the stream, or no stream and the stream's record. */
+export declare const isRunEventOf: (stream: StoredRunStream, event: RunEvent) => boolean;
 /**
  * run.json's bundle, when it is a run bundle of the prepared run that analysis reads: at most
- * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, and each
- * participant and event with the fields analysis reads.
+ * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, each
+ * participant and event with the fields analysis reads, and no two run events of one participant
+ * with one id.
  */
 export declare function parseAnalysisSource(prepared: PreparedRunArtifactPaths, bytes: Buffer): StoredRunBundle;
 /**

package/dist/analysis/source.js

@@ -2,6 +2,7 @@
 // and the refusals it gives for either.
 import { isCommsReceivingEvidence } from "../comms/receiving-evidence.js";
 import { isReadRunBundleSchema } from "../run/bundle.js";
+import { eventRecordIdOf, recordIdOf } from "../run/participant-records.js";
 import { runIdOf } from "../run/paths.js";
 import { reduceRunTraces, StreamTraceRefusedError, StreamTraceTooLargeError, } from "../run/stream-trace.js";
 import { isRecord } from "../run/type-guards.js";
@@ -24,12 +25,16 @@ const runFileInvalid = (reason) => new AnalysisSourceRefusedError("ANALYSIS_SOUR
 const traceInvalid = (streamId, reason) => new AnalysisSourceRefusedError("ANALYSIS_SOURCE_INVALID", `Analysis did not read participant ${streamId}'s trace: ${reason}`);
 /** The refusal of a run.json of `size` bytes, more than the `max` analysis reads of it. */
 export function runFileTooLarge(size, max) {
-    return new AnalysisSourceRefusedError("ANALYSIS_SOURCE_TOO_LARGE", `Analysis did not read run.json: it holds ${bytes(size)}, more than the ${limit(max)} analysis reads of it. run.json grows with each participant and the study's mission; split the participants across studies to keep it under the limit.`);
+    return new AnalysisSourceRefusedError("ANALYSIS_SOURCE_TOO_LARGE", `Analysis did not read run.json: it holds ${bytes(size)}, more than the ${limit(max)} analysis reads of it. run.json grows with each participant, its instruction, the mission and the task goals; split the participants across studies to keep it under the limit.`);
 }
+/** Whether `event` is `stream`'s: it names the stream, or no stream and the stream's record. */
+export const isRunEventOf = (stream, event) => event.streamId === stream.id ||
+    (event.streamId === undefined && eventRecordIdOf(event) === recordIdOf(stream));
 /**
  * run.json's bundle, when it is a run bundle of the prepared run that analysis reads: at most
- * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, and each
- * participant and event with the fields analysis reads.
+ * EVIDENCE_LIMITS.sourceBytes, at most EVIDENCE_LIMITS.participants participants, each
+ * participant and event with the fields analysis reads, and no two run events of one participant
+ * with one id.
  */
 export function parseAnalysisSource(prepared, bytes) {
     if (bytes.length > EVIDENCE_LIMITS.sourceBytes)
@@ -67,7 +72,20 @@ export function parseAnalysisSource(prepared, bytes) {
             typeof event.type !== "string")
             throw runFileInvalid(`event ${index + 1} needs an id, a type and a message.`);
     }
-    return value;
+    const bundle = value;
+    for (const stream of bundle.streams) {
+        // The place each id was first seen, since an analysis cites a participant's run event by its id.
+        const firstPlace = new Map();
+        for (const [index, event] of bundle.events.entries()) {
+            if (!isRunEventOf(stream, event))
+                continue;
+            const first = firstPlace.get(event.id);
+            if (first !== undefined)
+                throw runFileInvalid(`events ${first + 1} and ${index + 1} are participant ${stream.id}'s and share the id ${JSON.stringify(event.id)}, and analysis cites each of a participant's run events by its id. Give one of them another id in run.json; if run.json was not edited, please report this as a bug.`);
+            firstPlace.set(event.id, index);
+        }
+    }
+    return bundle;
 }
 /**
  * What `keep` takes from each stream of run.json's bundle with the stream's trace loaded, in stream

package/dist/cli/commands/setup.js

@@ -395,12 +395,14 @@ function formatInitHuman(result) {
     const lines = [title, `cwd: ${result.cwd}`];
     if (result.ok && result.mode === "applied") {
         // Name each file init wrote, so the person or agent who ran it can review exactly those
-        // files; directories and preserved files are counts. JSON always carries every change.
+        // files; files it left alone are a count. Neither includes the empty runtime directories under
+        // the ignored `.humanish/`: they give the reader nothing to review, leaving them out keeps a
+        // first setup with three next steps to 24 lines, and a second run then counts as unchanged
+        // the files the first one named. JSON always carries every change.
         const files = (action) => result.changes.filter((change) => change.action === action && change.target !== "runtime");
         const created = files("create");
         const updated = files("update");
-        const preserved = result.changes.filter((change) => change.action === "skip").length;
-        const directories = result.changes.filter((change) => change.action === "mkdir").length;
+        const preserved = files("skip").length;
         lines.push("");
         if (created.length > 0)
             lines.push("created:", ...created.map((change) => `  ${change.path}`));
@@ -408,13 +410,8 @@ function formatInitHuman(result) {
             lines.push("updated:", ...updated.map((change) => `  ${change.path} (${change.reason})`));
         if (created.length === 0 && updated.length === 0)
             lines.push("no files changed");
-        if (preserved > 0 || directories > 0)
-            lines.push([
-                ...(preserved > 0 ? [`${plural(preserved, "existing path")} unchanged`] : []),
-                ...(directories > 0
-                    ? [`${plural(directories, "ignored directory", "ignored directories")} prepared`]
-                    : []),
-            ].join(", "));
+        if (preserved > 0)
+            lines.push(`${plural(preserved, "existing path")} unchanged`);
     }
     else {
         lines.push("", "changes:", ...result.changes.map(formatInitChange));

package/dist/evidence/image.d.ts

@@ -20,5 +20,5 @@ export declare function pngDecodeRefusal(bytes: Buffer): string | null;
  * were downscaled, and any other chunk is a place to carry bytes no one reviews.
  */
 export declare function isRedactedFrameShape(bytes: Buffer): boolean;
-export declare function screenshotEvidenceError(relativePath: string, bytes: Buffer): string | null;
-export declare function assertScreenshotEvidence(relativePath: string, bytes: Buffer): void;
+export declare function screenshotEvidenceError(relativePath: string, bytes: Buffer): Promise<string | null>;
+export declare function assertScreenshotEvidence(relativePath: string, bytes: Buffer): Promise<void>;

package/dist/evidence/image.js

@@ -1,4 +1,4 @@
-import { crc32, inflateSync } from "node:zlib";
+import { crc32, createInflate } from "node:zlib";
 import { PNG } from "pngjs";
 const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 const PNG_IHDR_LENGTH = 13;
@@ -128,7 +128,7 @@ export function isRedactedFrameShape(bytes) {
         last.end === bytes.length &&
         bytes.readUInt32BE(16) <= SCREENSHOT_MAX_WIDTH_CAP);
 }
-export function screenshotEvidenceError(relativePath, bytes) {
+export async function screenshotEvidenceError(relativePath, bytes) {
     const extension = relativePath.toLowerCase().split(".").pop() ?? "";
     if (extension !== "png") {
         return `unsupported screenshot extension .${extension || "unknown"}; only decoded PNG evidence is supported`;
@@ -146,7 +146,7 @@ export function screenshotEvidenceError(relativePath, bytes) {
     if (chunks?.some((chunk) => chunk.type === "IEND" && chunk.end - chunk.start !== 12)) {
         return "PNG IEND chunk must be empty";
     }
-    return chunks === null || !pngStructureHolds(bytes, chunks)
+    return chunks === null || !(await pngStructureHolds(bytes, chunks))
         ? "could not decode PNG evidence"
         : null;
 }
@@ -164,14 +164,14 @@ const PNG_MIN_CHUNK_BYTES = { gAMA: 4 };
 /**
  * Whether a PNG that passed pngDecodeRefusal decodes, read from its structure: the file ends at an
  * empty IEND, every chunk's CRC matches, IHDR comes once with fields PNG defines, the image data is
- * one run of IDAT chunks, and it inflates, with zlib's native code, to exactly the
- * bytes its rows need with nothing after the stream, each row starting with a filter type from 0
- * to 4. For an image without a palette that is all a decode establishes, at about an eighth of
- * the time of pngjs, which unfilters every pixel in JavaScript; a run holds a screenshot for each
- * turn. A palette image is also decoded, since each pixel must index a palette that comes before
- * the image data; in any other image a palette chunk is only a suggestion, wherever it is.
+ * one run of IDAT chunks, and it inflates (inflatesToRows) to exactly the bytes its rows need with
+ * nothing after the stream, each row starting with a filter type from 0 to 4. For an image without
+ * a palette that is all a decode establishes, at about an eighth of the time of pngjs, which
+ * unfilters every pixel in JavaScript; a run holds a screenshot for each turn. A palette image is
+ * also decoded, since each pixel must index a palette that comes before the image data; in any
+ * other image a palette chunk is only a suggestion, wherever it is.
  */
-function pngStructureHolds(bytes, chunks) {
+async function pngStructureHolds(bytes, chunks) {
     const last = chunks.at(-1);
     if (last?.type !== "IEND" || last.end !== bytes.length)
         return false;
@@ -200,29 +200,44 @@ function pngStructureHolds(bytes, chunks) {
         return false;
     const rowBytes = 1 + Math.ceil(rowBits / 8);
     const data = Buffer.concat(idats.map((chunk) => bytes.subarray(chunk.start + 8, chunk.end - 4)));
-    let rows;
-    try {
-        // A stream that would inflate past the rows the image needs stops there, so a small file
-        // cannot claim gigabytes.
-        const options = {
-            maxOutputLength: rowBytes * height,
-            info: true,
-        };
-        const inflated = inflateSync(data, options);
-        if (inflated.engine.bytesWritten !== data.length)
-            return false;
-        rows = inflated.buffer;
-    }
-    catch {
-        return false;
-    }
-    if (rows.length !== rowBytes * height)
+    if (!(await inflatesToRows(data, rowBytes, height)))
         return false;
-    for (let row = 0; row < rows.length; row += rowBytes)
-        if (rows[row] > 4)
-            return false;
     return colorType !== 3 || pngDecodes(bytes);
 }
+// The most inflated bytes one check holds at once. Checks overlap on the thread pool, so rows held
+// whole add up across them. A process running 8 checks of 5000x5000 RGBA frames peaked at 832 MB
+// resident with each frame's rows held whole and at 202 MB checked 1 MiB at a time.
+const INFLATE_CHUNK_BYTES = 1024 * 1024;
+/**
+ * Whether `data` inflates to exactly `rows` rows of `rowBytes` bytes, each starting with a filter
+ * type from 0 to 4, with nothing after the stream. zlib inflates on libuv's thread pool, so checks
+ * of several frames overlap. A stream that would inflate past the rows stops there, so a small
+ * file cannot claim gigabytes.
+ */
+function inflatesToRows(data, rowBytes, rows) {
+    const total = rowBytes * rows;
+    return new Promise((resolve) => {
+        const inflate = createInflate({
+            chunkSize: Math.max(64, Math.min(total, INFLATE_CHUNK_BYTES)),
+        });
+        let seen = 0;
+        inflate.on("data", (chunk) => {
+            let filtersHold = true;
+            // The first row that starts in this chunk, then each row after it.
+            for (let at = (rowBytes - (seen % rowBytes)) % rowBytes; at < chunk.length; at += rowBytes)
+                if (chunk[at] > 4)
+                    filtersHold = false;
+            seen += chunk.length;
+            if (!filtersHold || seen > total) {
+                inflate.destroy();
+                resolve(false);
+            }
+        });
+        inflate.on("error", () => resolve(false));
+        inflate.on("end", () => resolve(seen === total && inflate.bytesWritten === data.length));
+        inflate.end(data);
+    });
+}
 function pngDecodes(bytes) {
     try {
         PNG.sync.read(bytes, { checkCRC: true });
@@ -232,8 +247,8 @@ function pngDecodes(bytes) {
         return false;
     }
 }
-export function assertScreenshotEvidence(relativePath, bytes) {
-    const error = screenshotEvidenceError(relativePath, bytes);
+export async function assertScreenshotEvidence(relativePath, bytes) {
+    const error = await screenshotEvidenceError(relativePath, bytes);
     if (error) {
         throw new Error(`Invalid screenshot evidence ${relativePath}: ${error}`);
     }

package/dist/observer/data.d.ts

@@ -1,7 +1,8 @@
+import type { ActorTrace } from "../actors/contract.js";
 import { type ActorEnding } from "../actors/stop-cause.js";
-import type { RunBundle, RunCostSummary, RunEvent, RunSimulation } from "../run/bundle.js";
+import type { DisplayedRunBundle, RunBundle, RunCostSummary, RunEvent, RunSimulation } from "../run/bundle.js";
 import { type RunDisplay } from "../run/display.js";
-import type { RunStream, RunStreamKind, StoredRunStream } from "../run/streams.js";
+import type { RunStream, RunStreamKind, StoredRunStream, WithoutRequestLists } from "../run/streams.js";
 /**
  * The Observer's data. From v2 observer-data.json leaves out each participant's items, and from v3
  * each participant's per-request lists (REQUEST_LISTS in src/run/stream-trace.ts), which no part
@@ -97,6 +98,9 @@ export interface ObserverData {
     };
 }
 export interface ObserverStream extends StoredRunStream {
+    /** The loaded actor, with its items and without its per-request lists, as is the live actor. */
+    actor?: WithoutRequestLists<ActorTrace>;
+    liveActor?: WithoutRequestLists<NonNullable<RunStream["liveActor"]>>;
     /** Only the attached server may grant provider-origin access for a live desktop iframe. */
     embed?: NonNullable<RunStream["embed"]> & {
         runtimeDesktop?: true;
@@ -127,7 +131,7 @@ interface ObserverLaneGroup {
  * bundle with no outcome in run.json: a run in progress, interrupted, or recorded before run.json
  * carried its outcome.
  */
-export declare function buildObserverData(bundle: RunBundle, generatedAt?: string, statusRecord?: unknown): ObserverData;
+export declare function buildObserverData(bundle: DisplayedRunBundle, generatedAt?: string, statusRecord?: unknown): ObserverData;
 /**
  * A saved Observer projection as this version reads it, as v3 and unchecked as before. An
  * observer-data.json written before v2 holds every participant's items, and its per-request lists,

package/dist/observer/render.js

@@ -11,7 +11,7 @@ import { projectShareCheckedAnalysis } from "../analysis/sharing.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { physicalCwdOf, runIdOf, bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveLatestRunDirectory, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { writeContainedOutputFile } from "../run/contained-output.js";
-import { loadRunBundlePrepared, readRunJsonIfExists, runJsonValue } from "../run/locate.js";
+import { loadDisplayedRunBundle, readRunJsonIfExists, runJsonValue } from "../run/locate.js";
 import { readRunNotes } from "../run/note-files.js";
 import { RUN_STATUS_FILE } from "../run/status.js";
 import { verifyRunPrepared } from "../verify/verify.js";
@@ -91,9 +91,7 @@ export async function renderObserver(cwdInput, runInput, options = {}) {
             : "HUMANISH_INVALID_RUN_BUNDLE", verified.error?.message ?? "Run bundle failed verification.");
     }
     // Verify passes a trace past the read limit, so its participant shows without its items.
-    const loaded = await loadRunBundlePrepared(selectedPhysicalCwd, preparedRunPaths, {
-        display: true,
-    });
+    const loaded = await loadDisplayedRunBundle(selectedPhysicalCwd, preparedRunPaths);
     await validatePreparedRunArtifactPaths(preparedRunPaths);
     if (!loaded)
         return runNotFound(cwd, runInput);

package/dist/routes/computer-use/participant-execution.js

@@ -26,7 +26,7 @@ export function makeParticipantWriteScreenshot(artifactRoot, spec, screenshots)
         const rel = path.posix.join(relPrefix, name);
         // Evidence holds image data only, whatever the executor's frames carried.
         const frame = stripPngMetadataChunks(bytes);
-        assertScreenshotEvidence(rel, frame);
+        await assertScreenshotEvidence(rel, frame);
         await writeContainedOutputFile(artifactRoot, path.join(...dirParts, name), frame);
         screenshots.push(rel);
         return rel;

package/dist/run/bundle.d.ts

@@ -4,7 +4,7 @@ import type { ExecutionOutcome } from "./judge.js";
 import type { SharedWorldEvidence } from "./shared-world-evidence.js";
 import { type RunStudyProvenance } from "./study-provenance.js";
 import type { RunInterruptSignal } from "./status.js";
-import type { RunSimulationStatus, RunStream, RunStreamKind, StoredRunStream } from "./streams.js";
+import type { DisplayedRunStream, RunSimulationStatus, RunStream, RunStreamKind, StoredRunStream } from "./streams.js";
 /**
  * The run bundle version this release writes: each stream's trace, and each running participant's
  * items so far, are files run.json indexes, and each participant's per-request lists are only in
@@ -395,6 +395,10 @@ export interface RunBundle {
 export type StoredRunBundle = Omit<RunBundle, "streams"> & {
     streams: StoredRunStream[];
 };
+/** A loaded bundle as a reader that shows the run has it (displayedTraces): DisplayedRunStreams. */
+export type DisplayedRunBundle = Omit<RunBundle, "streams"> & {
+    streams: DisplayedRunStream[];
+};
 /**
  * How a run ended. `finished`: Run.finish published the final bundle with the route result's `ok`
  * and its execution outcome (`judgeExecution` in src/run/judge.ts). `interrupted`: the CLI's signal

package/dist/run/locate.d.ts

@@ -1,7 +1,7 @@
 import { type PreparedRunArtifactPaths } from "./paths.js";
 import { type ContainedRefusal, type PreparedSelectedOutputDirectory } from "./contained-output.js";
 import type { RunPointer } from "./results.js";
-import { type RunBundle } from "./bundle.js";
+import { type DisplayedRunBundle, type RunBundle } from "./bundle.js";
 import { type BoundedFileResult } from "./evidence-files.js";
 /** The run input that resolves through latest.json rather than naming a run directory. */
 export declare const LATEST_RUN_ALIAS = "latest";
@@ -55,15 +55,17 @@ export declare function loadRunBundle(cwdInput: string, runInput: string): Promi
     bundlePath: string;
     runDir: string;
 } | null>;
-/**
- * loadRunBundle for a caller that already holds prepared paths. Revalidates them first. With
- * `display`, a participant whose trace the loader refuses, such as one past the read limit, is
- * kept as displayedTraces shows it, for a page that shows the run.
- */
-export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths, options?: {
-    display?: boolean;
-}): Promise<{
-    bundle: RunBundle;
+/** A run's bundle, run.json's path relative to the working directory, and the run folder. */
+type LoadedRun<T> = {
+    bundle: T;
     bundlePath: string;
     runDir: string;
-} | null>;
+};
+/** loadRunBundle for a caller that already holds prepared paths. Revalidates them first. */
+export declare function loadRunBundlePrepared(cwdInput: string, runPaths: PreparedRunArtifactPaths): Promise<LoadedRun<RunBundle> | null>;
+/**
+ * loadRunBundlePrepared for a page that shows the run: a participant whose trace the loader
+ * refuses, such as one past the read limit, is kept as displayedTraces shows it.
+ */
+export declare function loadDisplayedRunBundle(cwdInput: string, runPaths: PreparedRunArtifactPaths): Promise<LoadedRun<DisplayedRunBundle> | null>;
+export {};