humanish 0.139.1 → 0.141.0

package/dist/analysis/job.js

@@ -48,6 +48,8 @@ const reasons = [
     "AUTOMATIC_ANALYSIS_ACTOR_CANCELLED",
     "AUTOMATIC_ANALYSIS_NO_PARTICIPANT_EVIDENCE",
     "AUTOMATIC_ANALYSIS_CLEANUP_UNCONFIRMED",
+    // Only a read sets it, for a queued or running job whose owner stopped refreshing it.
+    "AUTOMATIC_ANALYSIS_STOPPED",
 ];
 const id = z.string().regex(ANALYSIS_ID_PATTERN);
 const date = z.iso.datetime();
@@ -173,9 +175,11 @@ export async function readAutomaticAnalysisPrepared(prepared, now = Date.now())
             ...(record.admission === undefined ? {} : { admission: record.admission }),
         };
         const updated = Date.parse(record.updatedAt);
-        if (updated > now || (pending(record.state) && now - updated > AUTOMATIC_ANALYSIS_STALE_MS)) {
+        if (updated > now)
             return { ...view, state: "unknown", reason: "AUTOMATIC_ANALYSIS_OUTCOME_UNKNOWN" };
-        }
+        // A job its owner stopped refreshing: the process most likely ended during the analysis.
+        if (pending(record.state) && now - updated > AUTOMATIC_ANALYSIS_STALE_MS)
+            return { ...view, state: "unknown", reason: "AUTOMATIC_ANALYSIS_STOPPED" };
         if (!(await terminalResultMatches(prepared, record)))
             return { ...view, state: "unknown", reason: "AUTOMATIC_ANALYSIS_OUTCOME_UNKNOWN" };
         return view;

package/dist/analysis/recording-ended.d.ts

@@ -0,0 +1,16 @@
+import { type RunStatusRecord } from "../run/status.js";
+/** What the gate reads: the run's status record, when it has one, and its streams. */
+export interface RecordingFacts {
+    runId: string;
+    status: RunStatusRecord | undefined;
+    /** How many of the bundle's streams are still running or still hold live items. */
+    runningStreams: number;
+    streams: number;
+}
+/**
+ * Throws the refusal for a recording that has not ended. A `finished` record, an `interrupted`
+ * one, and a stale `running` one whose process is gone from this host have ended; analysis then
+ * also needs every stream ended. A fresh `running` record is a live run, and a stale one whose pid
+ * is still in use cannot be told apart from a live run, so both are refused.
+ */
+export declare function assertRecordingEnded(facts: RecordingFacts, nowMs?: number, processRunning?: (pid: number) => boolean): void;

package/dist/analysis/recording-ended.js

@@ -0,0 +1,29 @@
+// Whether a run's recording has ended, so analysis can read it: the completion gate's reading of
+// status.json and the bundle's streams. A refusal says what the run is doing and the command that
+// moves it on, since "wait" helps only a run that is still alive.
+import { cli } from "../cli/invocation.js";
+import { classifyRunStatus, runOwnerGone } from "../run/status.js";
+import { studyProvenanceOf } from "../run/study-provenance.js";
+import { AnalysisSourceRefusedError } from "./source.js";
+/**
+ * Throws the refusal for a recording that has not ended. A `finished` record, an `interrupted`
+ * one, and a stale `running` one whose process is gone from this host have ended; analysis then
+ * also needs every stream ended. A fresh `running` record is a live run, and a stale one whose pid
+ * is still in use cannot be told apart from a live run, so both are refused.
+ */
+export function assertRecordingEnded(facts, nowMs = Date.now(), processRunning) {
+    const { runId, status } = facts;
+    const runs = `\`${cli("runs")}\``;
+    if (status?.state === "running") {
+        if (classifyRunStatus(status, nowMs) === "running")
+            throw new AnalysisSourceRefusedError("ANALYSIS_RUN_ACTIVE", `Participants are still running in this run, so its recording has not ended. Automatic analysis starts when they finish; ${runs} shows when the run is analyzing.`);
+        if (!runOwnerGone(status, nowMs, processRunning))
+            throw new AnalysisSourceRefusedError("ANALYSIS_RUN_UNCONFIRMED", `This run's process stopped updating status.json at ${status.updatedAt}, but pid ${status.pid} is still in use on this machine, so humanish cannot tell whether the run is still writing. If the run is gone, \`${cli(`reclaim --run ${runId}`)}\` stops its sandboxes and marks it interrupted; then analyze it again.`);
+    }
+    if (facts.runningStreams === 0)
+        return;
+    if (status?.state === "finished")
+        throw new AnalysisSourceRefusedError("ANALYSIS_RUN_ACTIVE", `${facts.runningStreams} of ${facts.streams} participant streams in this run have not ended. ${runs} shows the run's state.`);
+    const study = status === undefined ? undefined : studyProvenanceOf(status)?.id;
+    throw new AnalysisSourceRefusedError("ANALYSIS_RUN_INCOMPLETE", `This run ended while ${facts.runningStreams} of ${facts.streams} participant streams were still running, so its recording is incomplete and is not analyzed. Run the study again with \`${cli(`run ${study ?? "<study>"}`)}\`.`);
+}

package/dist/analysis/service.d.ts

@@ -58,9 +58,7 @@ export declare function resolveAnalysisRun(cwd: string, run: string, expectedRun
 export declare function dryRunBundleRefusal(cwd: string, run: string, dryRun: boolean, expectedRun?: PreparedRunArtifactPaths): Promise<AnalyzeResult | null>;
 /** Re-render the run's Observer after an analysis write. False when it could not be refreshed. */
 export declare function refreshObserver(cwd: string, runId: string, prepared: PreparedRunArtifactPaths): Promise<boolean>;
-/** One analysis or correction writer per run. Never steal a lock based on an untrusted PID. */
-export declare function withAnalysisLock<T>(prepared: PreparedRunArtifactPaths, action: () => Promise<T>): Promise<T>;
-/** The completion gate: the run verifies, is live and finished, and has participants. */
+/** The completion gate: the run verifies, is live, its recording ended, and it has participants. */
 export declare function readCompletedAnalysisSource(cwd: string, prepared: PreparedRunArtifactPaths): Promise<Buffer>;
 export declare function analyzeRun(cwdInput: string, run: string, options: AnalyzeOptions, deps?: AnalyzeDeps): Promise<AnalyzeResult>;
 export declare function showAnalysis(cwd: string, run: string, id?: string): Promise<LoadedAnalysis>;

package/dist/analysis/service.js

@@ -1,7 +1,7 @@
 import { defaultCodexCliVersion, describeCodexCliAdmission, } from "../actors/codex/codex-admission.js";
 import { validCodexAnalysisConfig } from "./codex-config.js";
 import { randomUUID } from "node:crypto";
-import { lstat, mkdir, realpath, rmdir } from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import path from "node:path";
 import { renderObserver } from "../observer/render.js";
 import { containsSensitive } from "../evidence/redaction.js";
@@ -11,6 +11,8 @@ import { verifyRunPrepared } from "../verify/verify.js";
 import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
 import { physicalCwdOf, runIdOf, resolvePhysicalCwd, validatePreparedRunRootIdentity, } from "../run/paths.js";
 import { isRunStatusRecord, RUN_STATUS_FILE } from "../run/status.js";
+import { assertRecordingEnded } from "./recording-ended.js";
+import { withAnalysisLock } from "./analysis-lock.js";
 import { captureEvidence, EVIDENCE_LIMITS } from "./evidence.js";
 import { AnalysisSourceRefusedError, runFileTooLarge, throwAsAnalysisRefusal } from "./source.js";
 import { pathMissing, readBoundedFile, readBoundedFileResult } from "../run/evidence-files.js";
@@ -46,12 +48,12 @@ export async function resolveAnalysisRun(cwd, run, expectedRun) {
 const messages = {
     ANALYSIS_RUN_NOT_FOUND: "The selected run is unavailable or its storage is unsafe.",
     ANALYSIS_VERIFY_FAILED: "The run must pass verification before analysis.",
-    ANALYSIS_RUN_ACTIVE: "Analysis requires a completed recording. Wait for the study to finish.",
+    ANALYSIS_RUN_ACTIVE: "This run's status.json is missing, unreadable or names another run, so humanish cannot tell whether its recording has ended. `humanish verify` checks the run's files.",
     ANALYSIS_NO_PARTICIPANTS: "This run contains no participant evidence to analyze.",
     ANALYSIS_REQUIRES_LIVE_RUN: "A dry run has no participant behavior to analyze. Select a completed live run.",
     ANALYSIS_SOURCE_UNAVAILABLE: "The source recording is missing or unsafe.",
     ANALYSIS_SOURCE_CHANGED: "The source recording changed during analysis. The result cannot be published against different evidence.",
-    ANALYSIS_BUSY: "Another analysis holds this run's .analysis-lock directory. If it was interrupted, confirm it has stopped before removing that empty directory.",
+    ANALYSIS_BUSY: "Another analysis holds this run's .analysis-lock directory, and its process is still running or humanish cannot check it (another host, or a lock written by humanish 0.139.1 or earlier). Wait for it to finish; if no humanish process is running for this run, remove that directory.",
     ANALYSIS_HISTORY_UNAVAILABLE: "Analysis history is unavailable or full. No request was sent. Inspect this run's analysis and analysis-attempts storage before retrying.",
     ANALYSIS_CONFIG_INVALID: "OpenAI analysis needs a supported model, positive USD admission limit and 256–32768 output tokens. Codex account analysis uses its qualified model and null dollar/output-token caps. Both require timeout 1–600000 ms.",
     ANALYSIS_QUESTION_UNSAFE: "The reviewer question matched a sensitive-text pattern. Remove sensitive details before retrying.",
@@ -109,43 +111,7 @@ export async function refreshObserver(cwd, runId, prepared) {
         return false;
     }
 }
-/** One analysis or correction writer per run. Never steal a lock based on an untrusted PID. */
-export async function withAnalysisLock(prepared, action) {
-    await validatePreparedRunRootIdentity(prepared);
-    const target = path.join(prepared.physicalRunRoot, ".analysis-lock");
-    try {
-        await mkdir(target, { mode: 0o700 });
-    }
-    catch (error) {
-        if (error.code === "EEXIST")
-            throw new Error("ANALYSIS_BUSY");
-        throw new Error("ANALYSIS_UNAVAILABLE");
-    }
-    const identity = await lstat(target, { bigint: true });
-    try {
-        await validatePreparedRunRootIdentity(prepared);
-        if (!identity.isDirectory() || identity.isSymbolicLink())
-            throw new Error("ANALYSIS_UNAVAILABLE");
-        return await action();
-    }
-    finally {
-        // Only remove our empty, unchanged directory. No recursive deletion and no replacement authority.
-        try {
-            await validatePreparedRunRootIdentity(prepared);
-            const current = await lstat(target, { bigint: true });
-            if (current.isDirectory() &&
-                !current.isSymbolicLink() &&
-                current.dev === identity.dev &&
-                current.ino === identity.ino &&
-                current.birthtimeNs === identity.birthtimeNs)
-                await rmdir(target);
-        }
-        catch {
-            /* Leave ambiguous storage in place for explicit operator inspection. */
-        }
-    }
-}
-/** The completion gate: the run verifies, is live and finished, and has participants. */
+/** The completion gate: the run verifies, is live, its recording ended, and it has participants. */
 export async function readCompletedAnalysisSource(cwd, prepared) {
     const read = await readBoundedFileResult(prepared, RUN_BUNDLE_FILE, EVIDENCE_LIMITS.sourceBytes);
     if (read.state === "limit")
@@ -170,18 +136,19 @@ export async function readCompletedAnalysisSource(cwd, prepared) {
         if (!missing)
             throw new Error("ANALYSIS_RUN_ACTIVE");
     }
+    let status;
     if (statusBytes) {
-        const status = JSON.parse(statusBytes.toString("utf8"));
-        // An old heartbeat is unknown, not proof that a process stopped writing evidence.
-        if (!isRunStatusRecord(status) ||
-            status.runId !== loaded.bundle.runId ||
-            status.state !== "finished") {
+        const record = JSON.parse(statusBytes.toString("utf8"));
+        if (!isRunStatusRecord(record) || record.runId !== loaded.bundle.runId)
             throw new Error("ANALYSIS_RUN_ACTIVE");
-        }
-    }
-    if (loaded.bundle.streams.some((stream) => !TERMINAL_SIMULATION_STATUSES.has(stream.status) || stream.liveActor !== undefined)) {
-        throw new Error("ANALYSIS_RUN_ACTIVE");
+        status = record;
     }
+    assertRecordingEnded({
+        runId: loaded.bundle.runId,
+        status,
+        runningStreams: loaded.bundle.streams.filter((stream) => !TERMINAL_SIMULATION_STATUSES.has(stream.status) || stream.liveActor !== undefined).length,
+        streams: loaded.bundle.streams.length,
+    });
     return bytes;
 }
 /** The refusal code for a configuration analyzeRun cannot run, before any run file is read. */
@@ -384,7 +351,13 @@ export async function analyzeRun(cwdInput, run, options, deps = {}) {
         if (deps.expectedRun !== undefined)
             cwd = physicalCwdOf(prepared);
         const execute = () => executeAnalysis({ cwd, run, prepared, config, options, deps, dryRun });
-        return dryRun ? await execute() : await withAnalysisLock(prepared, execute);
+        if (dryRun)
+            return await execute();
+        const tookOver = [];
+        const result = await withAnalysisLock(prepared, execute, (warning) => tookOver.push(warning));
+        return tookOver.length === 0
+            ? result
+            : { ...result, warnings: [...tookOver, ...result.warnings] };
     }
     catch (error) {
         if (error instanceof AnalysisSourceRefusedError)

package/dist/analysis/source.d.ts

@@ -7,7 +7,7 @@ import type { RunStream, StoredRunStream } from "../run/streams.js";
  */
 export declare class AnalysisSourceRefusedError extends Error {
     readonly reason: string;
-    constructor(code: "ANALYSIS_SOURCE_TOO_LARGE" | "ANALYSIS_SOURCE_INVALID", reason: string);
+    constructor(code: "ANALYSIS_SOURCE_TOO_LARGE" | "ANALYSIS_SOURCE_INVALID" | "ANALYSIS_RUN_ACTIVE" | "ANALYSIS_RUN_INCOMPLETE" | "ANALYSIS_RUN_UNCONFIRMED", reason: string);
 }
 /** The refusal of a run.json of `size` bytes, more than the `max` analysis reads of it. */
 export declare function runFileTooLarge(size: number | bigint, max: number): AnalysisSourceRefusedError;

package/dist/browser-control/protocol.d.ts

@@ -287,6 +287,10 @@ declare const observationSchema: z.ZodObject<{
         text: z.ZodString;
         durationMs: z.ZodNumber;
     }, z.core.$strict>>>;
+    externalHandoffs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        scheme: z.ZodString;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 type WireObservation = z.infer<typeof observationSchema>;
 declare const requestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -503,6 +507,10 @@ declare const replySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             text: z.ZodString;
             durationMs: z.ZodNumber;
         }, z.core.$strict>>>;
+        externalHandoffs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            scheme: z.ZodString;
+            recipients: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
     recording: z.ZodOptional<z.ZodObject<{
         mimeType: z.ZodLiteral<"video/mp4">;

package/dist/browser-control/protocol.js

@@ -1,6 +1,7 @@
 import { PNG } from "pngjs";
 import { z } from "zod";
 import { CUA_SPEECH_LIMITS } from "../actors/computer-use/speech.js";
+import { EXTERNAL_HANDOFF_LIMITS } from "../actors/computer-use/external-handoff.js";
 import { ComputerUseExecutorError, CUA_REJECTION_REASONS, isComputerUseExecutorError, } from "../actors/computer-use/executor-error.js";
 import { CUA_DIAGNOSTIC_CATEGORIES, CUA_DIAGNOSTIC_STEPS, } from "../actors/computer-use/executor-diagnostic.js";
 import { desktopRecordingMetadataSchema } from "../evidence/desktop-recording-types.js";
@@ -152,6 +153,17 @@ const heardSpeechListSchema = z
     .min(1)
     .max(BROWSER_CONTROL_LIMITS.heardSpeech)
     .refine((rows) => new Set(rows.map((row) => row.id)).size === rows.length);
+// The guest sends a handoff as externalHandoffOf made it: a scheme and a mailto link's recipients.
+const externalHandoffListSchema = z
+    .array(z.strictObject({
+    scheme: z.string().regex(/^[a-z][a-z0-9+.-]{0,31}$/),
+    recipients: z
+        .array(z.string().min(3).max(EXTERNAL_HANDOFF_LIMITS.addressLength))
+        .max(EXTERNAL_HANDOFF_LIMITS.recipients)
+        .optional(),
+}))
+    .min(1)
+    .max(EXTERNAL_HANDOFF_LIMITS.perObservation);
 const observationSchema = z.strictObject({
     png: z
         .string()
@@ -165,6 +177,7 @@ const observationSchema = z.strictObject({
     text: text.optional(),
     scrollY: coordinate.optional(),
     heardSpeech: heardSpeechListSchema.optional(),
+    externalHandoffs: externalHandoffListSchema.optional(),
 });
 const common = {
     version: z.literal(BROWSER_CONTROL_VERSION),
@@ -344,6 +357,9 @@ export function encodeBrowserControlObservation(observation) {
         ...(observation.text !== undefined ? { text: observation.text } : {}),
         ...(observation.scrollY !== undefined ? { scrollY: observation.scrollY } : {}),
         ...(observation.heardSpeech !== undefined ? { heardSpeech: observation.heardSpeech } : {}),
+        ...(observation.externalHandoffs !== undefined
+            ? { externalHandoffs: observation.externalHandoffs }
+            : {}),
     });
     if (!parsed.success)
         throw new ComputerUseExecutorError("invalid_response", "outcome_uncertain");
@@ -366,6 +382,11 @@ export function decodeBrowserControlObservation(value) {
         ...(state.text !== undefined ? { text: state.text } : {}),
         ...(state.scrollY !== undefined ? { scrollY: state.scrollY } : {}),
         ...(state.heardSpeech !== undefined ? { heardSpeech: state.heardSpeech } : {}),
+        ...(state.externalHandoffs !== undefined
+            ? {
+                externalHandoffs: state.externalHandoffs.map(({ scheme, recipients }) => recipients === undefined ? { scheme } : { scheme, recipients }),
+            }
+            : {}),
     };
 }
 export function safeBrowserControlFailure(error, dispatched) {

package/dist/cli/commands/analysis-signals.d.ts

@@ -1,8 +1,14 @@
 import type { RunStudyOptions } from "../../run-study.js";
+import { type HostClock } from "../../run/host-suspension.js";
 import type { CliIo } from "../io.js";
 /**
- * Post-run analysis cancellation for the CLI: while analysis runs, SIGINT, SIGTERM and SIGHUP abort
- * it. The listeners exist only during analysis; before it, the run's own handlers
- * (run-signals.ts) hold the signals and hand them over here.
+ * The CLI's run events. When the run starts, one stderr line names it and the command that
+ * follows it. While analysis runs, SIGINT, SIGTERM and SIGHUP abort it; the listeners exist only
+ * during analysis, since before it the run's own handlers (run-signals.ts) hold the signals and
+ * hand them over here. A human also gets a line when analysis starts and one with its elapsed
+ * time every 20 s; `--json` gets only the first line, on stderr, so stdout stays one result.
  */
-export declare function cliAnalysisOptions(io: Pick<CliIo, "writeErr">): Pick<RunStudyOptions, "onEvent" | "analysisSignal">;
+export declare function cliRunEventOptions(io: Pick<CliIo, "writeErr">, options?: {
+    json?: boolean;
+    clock?: HostClock;
+}): Pick<RunStudyOptions, "onEvent" | "analysisSignal">;

package/dist/cli/commands/analysis-signals.js

@@ -1,25 +1,47 @@
+import { ANALYSIS_USUALLY_TAKES } from "../../analysis/analysis-limits.js";
+import { systemHostClock } from "../../run/host-suspension.js";
+import { formatDuration } from "../../run/projection.js";
+import { cli } from "../invocation.js";
 import { handOverRunSignals } from "./run-signals.js";
+/** How often a human sees how long analysis has run: often enough to look alive, rarely enough
+ *  to read as one line per glance. */
+const ANALYSIS_PROGRESS_MS = 20_000;
 /**
- * Post-run analysis cancellation for the CLI: while analysis runs, SIGINT, SIGTERM and SIGHUP abort
- * it. The listeners exist only during analysis; before it, the run's own handlers
- * (run-signals.ts) hold the signals and hand them over here.
+ * The CLI's run events. When the run starts, one stderr line names it and the command that
+ * follows it. While analysis runs, SIGINT, SIGTERM and SIGHUP abort it; the listeners exist only
+ * during analysis, since before it the run's own handlers (run-signals.ts) hold the signals and
+ * hand them over here. A human also gets a line when analysis starts and one with its elapsed
+ * time every 20 s; `--json` gets only the first line, on stderr, so stdout stays one result.
  */
-export function cliAnalysisOptions(io) {
+export function cliRunEventOptions(io, options = {}) {
+    const clock = options.clock ?? systemHostClock;
     const controller = new AbortController();
     const cancel = () => {
         controller.abort();
     };
     const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+    let stopProgress;
     return {
         analysisSignal: controller.signal,
         onEvent: (event) => {
-            if (event.type === "analysis-started") {
-                io.writeErr("Participants finished; preparing analysis…\n");
+            if (event.type === "run-started") {
+                io.writeErr(`Run ${event.runId} started. Follow it with ${cli(`observe --run ${event.runId}`)}; ${cli("runs")} lists its state.\n`);
+            }
+            else if (event.type === "analysis-started") {
+                io.writeErr(`Participants finished. Writing findings; this usually takes ${ANALYSIS_USUALLY_TAKES}.\n`);
+                if (options.json !== true) {
+                    const startedMs = clock.now();
+                    stopProgress = clock.every(ANALYSIS_PROGRESS_MS, () => {
+                        io.writeErr(`Still writing findings: ${formatDuration(clock.now() - startedMs)} elapsed.\n`);
+                    });
+                }
                 handOverRunSignals();
                 for (const signal of signals)
                     process.on(signal, cancel);
             }
             else if (event.type === "analysis-finished") {
+                stopProgress?.();
+                stopProgress = undefined;
                 for (const signal of signals)
                     process.off(signal, cancel);
             }

package/dist/cli/commands/runs.js

@@ -6,7 +6,7 @@ import { DEFAULT_EXPORT_MAX_BYTES, exportRun, formatExportHuman } from "../../fe
 import { listRuns, readReview } from "../../run/stored-runs.js";
 import { verifyRun } from "../../verify/verify.js";
 import { reclaimPreflightSandboxes, reclaimRunSandboxes, } from "../../run/reclaim.js";
-import { runDisplay } from "../../run/display.js";
+import { analysisPhaseLabel, runDisplay } from "../../run/display.js";
 import { addRunOptions, handleRun } from "./run-command.js";
 import { applyEnvFileOption, CWD_OPTION_DESCRIPTION, DOTENV_OPTION_DESCRIPTION, dotenvPathOf, envFileAliasOption, JSON_OPTION_DESCRIPTION, parsePositiveInteger, RUN_OPTION_DESCRIPTION, writeResult, humanError, } from "../io.js";
 import { plural } from "../../run/text.js";
@@ -251,6 +251,8 @@ function formatReclaimHuman(result, cwd, preflight) {
     for (const outcome of result.outcomes) {
         lines.push(`  sandbox ${outcome.sandboxIdDigest} (${outcome.laneId}, from ${outcome.source}): ${outcome.state}${outcome.detail ? `: ${outcome.detail}` : ""}`);
     }
+    if (result.markedInterrupted === true)
+        lines.push("Its status.json had stopped updating while it still said running, so the run is now recorded as interrupted.");
     for (const warning of result.warnings)
         lines.push(`  warning: ${warning}`);
     if (result.error === undefined && result.state !== "clean")
@@ -378,6 +380,10 @@ function formatRunsHuman(result) {
     }
     return ([
         `latest: ${result.latest ?? "none"}`,
-        ...result.runs.map((run) => `- ${run.runId} ${run.mode ?? "unknown"} ${run.display?.label ?? "unreadable"} ${run.createdAt ?? "unknown"} ${run.path}`),
+        ...result.runs.map((run) => {
+            const analysis = analysisPhaseLabel(run.analysis);
+            const label = `${run.display?.label ?? "unreadable"}${analysis === undefined ? "" : `, ${analysis}`}`;
+            return `- ${run.runId} ${run.mode ?? "unknown"} ${label} ${run.createdAt ?? "unknown"} ${run.path}`;
+        }),
     ].join("\n") + "\n");
 }

package/dist/cli/commands/study-route-computer-use.js

@@ -5,11 +5,11 @@ import { resolveStudyDryRun } from "../../study/plan.js";
 import { serveObserver } from "../../observer/render.js";
 import { startExposedObserver, validateExposure } from "../../observer/exposure.js";
 import { ServeTunnelError } from "../../observer/tunnel.js";
-import { cliAnalysisOptions } from "./analysis-signals.js";
+import { cliRunEventOptions } from "./analysis-signals.js";
 import { onRunShutdown } from "./run-signals.js";
 import { parseStudyCount, parseParticipantIds, parseObserverPort, wantsJson, writeResult, } from "../io.js";
 import { exposureRequestFromOptions, followDecision, followObserver, planObserver, showObserver, staticObserverOpen, withObserverServer, } from "../observer-follow.js";
-import { writeRunFindings } from "../findings.js";
+import { writeRunResult } from "../run-findings.js";
 import { formatCuaStudyHuman } from "./study-format.js";
 import { resolveRouteShouldOpen } from "./study-route-open.js";
 import { refusedResult } from "../../run/study-result.js";
@@ -127,7 +127,7 @@ function prepareCuaWatch(args, settings) {
 function cuaRunOptions(args, settings, prepared, live) {
     const { finishedPlan } = prepared;
     return {
-        ...cliAnalysisOptions(args.io),
+        ...cliRunEventOptions(args.io, { json: wantsJson(args.command) }),
         cwd: args.options.cwd,
         // A followed watch opens the served Observer (or prints the phone target under --expose), so
         // its static render never opens. A non-follow watch opens what its plan says, once. Run mode
@@ -236,9 +236,8 @@ async function reportCuaRun(args, prepared, result, live) {
             ],
         };
     }
-    writeResult(args.command, args.io, output, (value) => formatCuaStudyHuman(value, args.config.subject));
+    await writeRunResult(args.command, args.io, args.options.cwd, output, (value) => formatCuaStudyHuman(value, args.config.subject));
     args.io.setExitCode(result.ok && automaticAnalysisSucceeded(result) ? 0 : 2);
-    await writeRunFindings(args.command, args.io, args.options.cwd, result);
     if (server && (result.observer?.ok || attachedObserver)) {
         const followResult = output.observer?.ok
             ? output.observer

package/dist/cli/commands/study-route-scripted.js

@@ -1,8 +1,8 @@
 import { automaticAnalysisSucceeded } from "../../analysis/automatic-completion.js";
 import { Command } from "commander";
-import { cliAnalysisOptions } from "./analysis-signals.js";
-import { wantsJson, writeResult } from "../io.js";
-import { writeRunFindings } from "../findings.js";
+import { cliRunEventOptions } from "./analysis-signals.js";
+import { wantsJson } from "../io.js";
+import { writeRunResult } from "../run-findings.js";
 import { showObserver } from "../observer-follow.js";
 import { formatScriptedStudyHuman } from "./study-format.js";
 import { observerOpen, resolveRouteShouldOpen, watchFinishedPlan } from "./study-route-open.js";
@@ -23,7 +23,7 @@ export function scriptedRouteRun(args) {
         return undefined;
     return {
         options: {
-            ...cliAnalysisOptions(args.io),
+            ...cliRunEventOptions(args.io, { json: wantsJson(args.command) }),
             cwd: args.options.cwd,
             open: observerOpen(args.mode, finishedPlan, shouldOpen),
             ...(args.options.dryRun === undefined ? {} : { dryRun: args.options.dryRun }),
@@ -34,9 +34,8 @@ export function scriptedRouteRun(args) {
                 throw new Error(`Expected the scripted route, got ${outcome.route}.`);
             }
             const result = outcome.result;
-            writeResult(args.command, args.io, result, (value) => formatScriptedStudyHuman(value, args.config.subject));
+            await writeRunResult(args.command, args.io, args.options.cwd, result, (value) => formatScriptedStudyHuman(value, args.config.subject));
             args.io.setExitCode(result.ok && automaticAnalysisSucceeded(result) ? 0 : 2);
-            await writeRunFindings(args.command, args.io, args.options.cwd, result);
             // Watch mode serves the Observer the route rendered through its finished run.
             if (finishedPlan !== undefined && result.ok && result.observer !== undefined) {
                 await showObserver({

package/dist/cli/commands/study-route-shared-world.js

@@ -3,10 +3,10 @@ import { Command } from "commander";
 import { resolveStudyDryRun } from "../../study/plan.js";
 import { serveObserver } from "../../observer/render.js";
 import { redactText } from "../../evidence/redaction.js";
-import { cliAnalysisOptions } from "./analysis-signals.js";
+import { cliRunEventOptions } from "./analysis-signals.js";
 import { parseObserverPort, wantsJson, writeResult, } from "../io.js";
 import { followDecision, followObserver, showObserver, staticObserverOpen, withObserverServer, } from "../observer-follow.js";
-import { writeRunFindings } from "../findings.js";
+import { writeRunResult } from "../run-findings.js";
 import { formatConcurrentSharedWorldStudyHuman } from "./study-format.js";
 import { resolveRouteShouldOpen, watchFinishedPlan } from "./study-route-open.js";
 import { refusedResult } from "../../run/study-result.js";
@@ -65,7 +65,7 @@ export function sharedWorldRouteRun(args) {
     let observerFailure;
     return {
         options: {
-            ...cliAnalysisOptions(args.io),
+            ...cliRunEventOptions(args.io, { json: wantsJson(args.command) }),
             cwd: args.options.cwd,
             open: wantsFollow
                 ? false
@@ -120,9 +120,8 @@ export function sharedWorldRouteRun(args) {
                     ],
                 };
             }
-            writeResult(args.command, args.io, output, formatConcurrentSharedWorldStudyHuman);
+            await writeRunResult(args.command, args.io, args.options.cwd, output, formatConcurrentSharedWorldStudyHuman);
             args.io.setExitCode(result.ok && automaticAnalysisSucceeded(result) ? 0 : 2);
-            await writeRunFindings(args.command, args.io, args.options.cwd, result);
             if (server && output.observer?.ok) {
                 await followObserver(args.io, output.observer, server);
             }

package/dist/cli/commands/study-route-terminal.js

@@ -1,8 +1,8 @@
 import { automaticAnalysisSucceeded } from "../../analysis/automatic-completion.js";
 import { Command } from "commander";
-import { cliAnalysisOptions } from "./analysis-signals.js";
-import { wantsJson, writeResult } from "../io.js";
-import { writeRunFindings } from "../findings.js";
+import { cliRunEventOptions } from "./analysis-signals.js";
+import { wantsJson } from "../io.js";
+import { writeRunResult } from "../run-findings.js";
 import { showObserver } from "../observer-follow.js";
 import { formatTerminalStudyHuman } from "./study-format.js";
 import { observerOpen, resolveRouteShouldOpen, watchFinishedPlan } from "./study-route-open.js";
@@ -23,7 +23,7 @@ export function terminalRouteRun(args) {
         return undefined;
     return {
         options: {
-            ...cliAnalysisOptions(args.io),
+            ...cliRunEventOptions(args.io, { json: wantsJson(args.command) }),
             cwd: args.options.cwd,
             open: observerOpen(args.mode, finishedPlan, shouldOpen),
             ...(args.options.dryRun === undefined ? {} : { dryRun: args.options.dryRun }),
@@ -34,9 +34,8 @@ export function terminalRouteRun(args) {
                 throw new Error(`Expected the terminal route, got ${outcome.route}.`);
             }
             const result = outcome.result;
-            writeResult(args.command, args.io, result, formatTerminalStudyHuman);
+            await writeRunResult(args.command, args.io, args.options.cwd, result, formatTerminalStudyHuman);
             args.io.setExitCode(result.ok && automaticAnalysisSucceeded(result) ? 0 : 2);
-            await writeRunFindings(args.command, args.io, args.options.cwd, result);
             if (finishedPlan !== undefined && result.ok && result.observer !== undefined) {
                 await showObserver({
                     command: args.command,

package/dist/cli/commands/study-run.js

@@ -138,7 +138,7 @@ export async function runStudyCommand(args) {
                 // Surface it so the invoker (who may not be the manifest author) knows executable code ran.
                 args.io.writeErr(`warning: review scorer ${scorer.provenance.ref} (${scorer.provenance.source}) is code that humanish loaded and ran in this process. Review it as you would any code you run.\n`);
             }
-            const analysisBudget = automaticAnalysisBudget(config.review?.analysis, route, computerUseParticipantCount(config));
+            const analysisBudget = automaticAnalysisBudget(config.review?.analysis, route, computerUseParticipantCount(config), config.actor);
             if (analysisBudget && resolveStudyDryRun(config, args.options.dryRun, true) === false) {
                 args.io.writeErr(`${formatAutomaticAnalysisBudget(analysisBudget)}\n`);
             }

package/dist/cli/doctor.d.ts

@@ -53,6 +53,8 @@ export declare function doctor(cwdInput: string, options?: {
     keyDeps?: KeyResolutionDeps;
     /** The hosted Codex participant's operator handshake; tests replace it. */
     codexParticipantReadiness?: StudySetupCheckArgs["codexParticipantReadiness"];
+    /** The Codex account analyst's setup check; tests replace it. */
+    codexAnalysisReadiness?: StudySetupCheckArgs["codexAnalysisReadiness"];
     /** What `--dotenv` loaded, so a key row names the file that supplied it. */
     dotenv?: DotenvLoad;
 }): Promise<DoctorResult>;

package/dist/cli/doctor.js

@@ -89,6 +89,9 @@ export async function doctor(cwdInput, options = {}) {
             ...(options.codexParticipantReadiness === undefined
                 ? {}
                 : { codexParticipantReadiness: options.codexParticipantReadiness }),
+            ...(options.codexAnalysisReadiness === undefined
+                ? {}
+                : { codexAnalysisReadiness: options.codexAnalysisReadiness }),
         })
         : undefined;
     // Without --study, each key row names the studies that need it instead of failing.