humanish 0.144.0 → 0.145.0

package/CHANGELOG.md

@@ -8,6 +8,17 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.145.0: A remote runner's keys stay in E2B's proxy (2026-10-22)
+
+humanish 0.145.0 keeps the OpenAI, Gemini and E2B keys out of a remote E2B runner's environment.
+E2B's egress proxy adds each key to the runner's requests on its fixed host, and the runner holds
+placeholders; code in the runner can still read the keys back through the E2B API, and a Modal
+runner still receives them as environment variables. Study analysis with `gpt-6-luna` sends low
+text verbosity, which made it about four times faster on the benchmark recordings, and an
+observation of what a participant said may now also cite the capture they spoke about.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.145.0)
+
 ## 0.144.0: Hosted studies run remotely by default (2026-10-22)
 
 humanish 0.144.0 runs a hosted computer-use study remotely by default. A study on

package/dist/analysis/models.d.ts

@@ -1,6 +1,8 @@
 import type { ReasoningEffort } from "../actors/reasoning-effort.js";
 import type { AnalysisApiVendor } from "./provider.js";
 import type { AnalysisConfig } from "./types.js";
+/** The `text.verbosity` an OpenAI analysis with `model` asks for, or undefined for the default. */
+export declare const openaiTextVerbosity: (model: string) => "low" | undefined;
 export declare const SUPPORTED_ANALYSIS_MODELS: readonly string[];
 export declare const GEMINI_ANALYSIS_MODELS: readonly string[];
 /** Whether the API analyst `provider` (omitted is OpenAI) analyzes with `model`. */

package/dist/analysis/models.js

@@ -14,6 +14,21 @@ const OPENAI_MODELS = {
     "gpt-5.6-terra": ["none", "low", "medium", "high", "xhigh", "max"],
     "gpt-5.6-luna": ["none", "low", "medium", "high", "xhigh", "max"],
 };
+/**
+ * The `text.verbosity` the OpenAI wire sends for a model; a model not listed gets the API default,
+ * `medium`. The Responses API takes `low`, `medium` or `high` beside a json_schema `text.format`
+ * (developers.openai.com/api/reference/resources/responses/methods/create, read 2026-10-22). On
+ * the benchmark recordings, gpt-6-luna at low verbosity decoded about three times faster and its
+ * analyses passed the evidence checks more often, with the same findings: see
+ * docs/evidence/benchmark/2026-10-22-luna-verbosity.md.
+ */
+const OPENAI_TEXT_VERBOSITY = {
+    "gpt-6-luna": "low",
+};
+/** The `text.verbosity` an OpenAI analysis with `model` asks for, or undefined for the default. */
+export const openaiTextVerbosity = (model) => Object.hasOwn(OPENAI_TEXT_VERBOSITY, model)
+    ? OPENAI_TEXT_VERBOSITY[model]
+    : undefined;
 /**
  * Gemini models that completed a live analysis, with the `thinkingLevel` values the thinking guide
  * lists for each (ai.google.dev/gemini-api/docs/generate-content/thinking, read 2026-10-21):

package/dist/analysis/openai-wire.d.ts

@@ -2,5 +2,5 @@ import type { AnalysisProviderResult, AnalysisWire } from "./provider.js";
 /** Text and usage wire shapes reuse the captured closing-report contract; refusal fails closed. */
 export declare function parseAnalysisResponse(raw: unknown): AnalysisProviderResult;
 /** One stateless request: no stored response, no tools, the analysis's reasoning effort, strict
- * schema. */
+ * schema, and the model's text verbosity from models.ts. */
 export declare const openaiWire: AnalysisWire;

package/dist/analysis/openai-wire.js

@@ -2,6 +2,7 @@
 // a response becomes an AnalysisProviderResult. provider.ts owns the transport around it.
 import { OPENAI_RESPONSES_URL } from "../actors/openai-endpoint.js";
 import { isRecord } from "../run/type-guards.js";
+import { openaiTextVerbosity } from "./models.js";
 const record = (value) => (isRecord(value) ? value : {});
 const count = (value) => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
 function usageOf(raw) {
@@ -68,35 +69,44 @@ export function parseAnalysisResponse(raw) {
     }
 }
 /** One stateless request: no stored response, no tools, the analysis's reasoning effort, strict
- * schema. */
+ * schema, and the model's text verbosity from models.ts. */
 export const openaiWire = {
     url: () => OPENAI_RESPONSES_URL,
     headers: (apiKey) => ({ Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" }),
-    body: (request) => ({
-        model: request.model,
-        instructions: request.instructions,
-        input: [
-            {
-                role: "user",
-                content: [
-                    { type: "input_text", text: request.evidence },
-                    ...request.images.flatMap((image) => [
-                        { type: "input_text", text: JSON.stringify({ captureEvidenceId: image.evidenceId }) },
-                        { type: "input_image", image_url: image.dataUrl, detail: "high" },
-                    ]),
-                ],
+    body: (request) => {
+        const verbosity = openaiTextVerbosity(request.model);
+        return {
+            model: request.model,
+            instructions: request.instructions,
+            input: [
+                {
+                    role: "user",
+                    content: [
+                        { type: "input_text", text: request.evidence },
+                        ...request.images.flatMap((image) => [
+                            { type: "input_text", text: JSON.stringify({ captureEvidenceId: image.evidenceId }) },
+                            { type: "input_image", image_url: image.dataUrl, detail: "high" },
+                        ]),
+                    ],
+                },
+            ],
+            store: false,
+            tools: [],
+            tool_choice: "none",
+            truncation: "disabled",
+            service_tier: "default",
+            reasoning: { effort: request.reasoningEffort },
+            max_output_tokens: request.maxOutputTokens,
+            text: {
+                format: {
+                    type: "json_schema",
+                    name: "study_analysis",
+                    strict: true,
+                    schema: request.schema,
+                },
+                ...(verbosity === undefined ? {} : { verbosity }),
             },
-        ],
-        store: false,
-        tools: [],
-        tool_choice: "none",
-        truncation: "disabled",
-        service_tier: "default",
-        reasoning: { effort: request.reasoningEffort },
-        max_output_tokens: request.maxOutputTokens,
-        text: {
-            format: { type: "json_schema", name: "study_analysis", strict: true, schema: request.schema },
-        },
-    }),
+        };
+    },
     parse: parseAnalysisResponse,
 };

package/dist/analysis/validation.js

@@ -369,7 +369,7 @@ export function checkAnalysisResult(input, value) {
             !refs.some((ref) => ref &&
                 ["ui_action", "command", "tool_call", "file_change", "approval"].includes(ref.kind)))
             errors.add("ANALYSIS_ACTION_SOURCE_INVALID");
-        if (observation.basis === "participant_statement" && refs.some((ref) => !ref?.quoteEligible))
+        if (observation.basis === "participant_statement" && !refs.some((ref) => ref?.quoteEligible))
             errors.add("ANALYSIS_STATEMENT_SOURCE_INVALID");
         return new Set(refs.flatMap((ref) => (ref ? [ref.streamId] : [])));
     };

package/dist/cli/commands/study-remote.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from "commander";
-import { type RemoteOutcome } from "../../remote/launch.js";
+import { type RemoteOutcome, type RunnerKeys } from "../../remote/launch.js";
 import { type RemotePlan } from "../../remote/plan.js";
 import type { RunResult } from "../../run/results.js";
 import type { StudyConfig } from "../../study/types.js";
@@ -40,6 +40,8 @@ export declare function runRemoteStudy(args: {
     studyPath: string;
     remote: RemotePlan;
 }): Promise<void>;
+/** The line that says, before the runner exists, where each of this machine's keys goes. */
+export declare function runnerKeysLine(provider: RemotePlan["provider"], keys: Pick<RunnerKeys, "held" | "sent">): string;
 /** The command's result and exit code for a remote run that ended, stopped or detached. */
 export declare function reportRemoteOutcome(command: Command, io: CliIo, cwd: string, outcome: RemoteOutcome, forwarded?: NonNullable<RunResult["remote"]>): void;
 export {};

package/dist/cli/commands/study-remote.js

@@ -1,7 +1,7 @@
 // `--remote` on run and watch: plan here, refuse what cannot run remotely, then launch and follow
 // the run in a runner sandbox (src/remote/launch.ts). The result and exit code are the run's own.
 import path from "node:path";
-import { forwardedEnv, launchRemoteRun, runsFromPackage, } from "../../remote/launch.js";
+import { launchRemoteRun, runnerKeys, runsFromPackage, } from "../../remote/launch.js";
 import { planRemoteRun } from "../../remote/plan.js";
 import { INSIDE_RUNNER_ENV } from "../../remote/runner.js";
 import { planStudy, resolveStudyDryRun } from "../../study/plan.js";
@@ -99,11 +99,12 @@ export async function runRemoteStudy(args) {
         refuseRemote(args.command, io, cwd, "--port must be an integer between 0 and 65535.");
         return;
     }
+    const keys = runnerKeys(args.remote, process.env);
     const forwarded = {
         provider: args.remote.provider,
-        keys: Object.keys(forwardedEnv(args.remote, process.env)).sort(),
+        keys: [...keys.held, ...keys.sent].sort(),
     };
-    io.writeErr(`The runner receives ${forwarded.keys.join(", ") || "no keys"} from this machine, in your own ${forwarded.provider === "modal" ? "Modal" : "E2B"} account. Run with --local to keep the study on this machine.\n`);
+    io.writeErr(`${runnerKeysLine(args.remote.provider, keys)}\n`);
     let outcome;
     try {
         outcome = await launchRemoteRun({
@@ -121,6 +122,20 @@ export async function runRemoteStudy(args) {
     }
     reportRemoteOutcome(args.command, io, cwd, outcome, forwarded);
 }
+/** The line that says, before the runner exists, where each of this machine's keys goes. */
+export function runnerKeysLine(provider, keys) {
+    const list = (names) => names.join(", ");
+    const local = "Run with --local to keep the study on this machine.";
+    if (provider === "modal")
+        return `The runner runs in your own Modal account and receives ${list(keys.sent) || "no keys"} as environment variables, since Modal has no egress proxy that could hold them. ${local}`;
+    const held = keys.held.length === 0
+        ? ""
+        : ` E2B's egress proxy holds ${list(keys.held)} and adds them to the runner's requests, so the runner's environment holds placeholders.`;
+    const sent = keys.sent.length === 0
+        ? ""
+        : ` The runner receives ${list(keys.sent)} as environment variables.`;
+    return `The runner runs in your own E2B account.${held}${sent} ${local}`;
+}
 /** The run options a remote run does not carry to the runner yet. */
 function localOnlyFlags(options) {
     return [

package/dist/keys/key-resolution.js

@@ -25,7 +25,7 @@ import { parse as parseToml } from "smol-toml";
 import { loadEnvFile } from "./env-file.js";
 import { cli } from "../cli/invocation.js";
 import { humanishConfigFile } from "../cli/user-config.js";
-import { OPENAI_EGRESS_PLACEHOLDER } from "../routes/terminal/runtime-auth.js";
+import { EGRESS_PLACEHOLDER } from "../substrates/e2b/egress-keys.js";
 /**
  * The provider keys, in the order `humanish keys set` names their vendors. Implicit discovery fills
  * only these names and the user store holds only these. Everything else in an overlay or store file
@@ -355,7 +355,7 @@ export async function probeKeySources(names, args) {
     // A terminal study's sandbox sets CODEX_API_KEY to an inert placeholder so Codex starts; the key
     // itself stays in the host-side egress proxy. The placeholder is no key, so it counts as unset and
     // discovery may still find a real one.
-    const placeholder = (name) => args.env[name]?.trim() === OPENAI_EGRESS_PLACEHOLDER;
+    const placeholder = (name) => args.env[name]?.trim() === EGRESS_PLACEHOLDER;
     const scratch = { ...args.env };
     for (const name of names)
         if (placeholder(name))

package/dist/remote/launch.d.ts

@@ -1,4 +1,5 @@
 import { type PreparedRunArtifactPaths } from "../run/paths.js";
+import type { E2BNetworkOptions } from "../substrates/e2b/sdk.js";
 import type { RemotePlan } from "./plan.js";
 import { type Runner } from "./runner.js";
 /** What following a remote run needs from its caller: the project, its env and a progress line. */
@@ -59,10 +60,27 @@ export interface Signals {
  * running; the runner ends it at its deadline.
  */
 export declare function watchSignals(): Signals;
+/** What the runner gets from this machine's env, and how each key reaches it. */
+export interface RunnerKeys {
+    /** The run command's env: each forwarded name, with a placeholder for each key E2B holds. */
+    env: Record<string, string>;
+    /**
+     * The runner's network: its URLs answer only with its traffic token, and on E2B its header
+     * transforms carry the held keys. It holds key values: never log or persist it.
+     */
+    network: E2BNetworkOptions;
+    /** Names whose values stay in E2B's egress proxy; the runner sees a placeholder. */
+    held: string[];
+    /** Names whose values enter the runner as environment variables. */
+    sent: string[];
+}
 /**
- * The names and values the runner's run receives: each of the plan's names that is set here, and of
- * names the run reads only the first of, only the first one set.
+ * The keys the runner's run receives: each of the plan's names that is set here, and of names the
+ * run reads only the first of, only the first one set. On E2B, each key that travels as a header
+ * to a fixed host stays in an E2B header transform, and the run gets a placeholder and the system
+ * CA bundle that holds E2B's proxy CA, which Node does not read by default. Modal has no such
+ * transform, so a Modal runner receives every key as an environment variable.
  */
-export declare function forwardedEnv(remote: Pick<RemotePlan, "envNames" | "alternatives">, env: Readonly<Record<string, string | undefined>>): Record<string, string>;
+export declare function runnerKeys(remote: Pick<RemotePlan, "provider" | "envNames" | "alternatives">, env: Readonly<Record<string, string | undefined>>): RunnerKeys;
 /** Whether this humanish runs from a built package, which a runner can install. */
 export declare function runsFromPackage(): boolean;

package/dist/remote/launch.js

@@ -15,6 +15,7 @@ import { pointLatestRunAt } from "../run/run.js";
 import { appendSandboxOwner, SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { loadE2BBaseModule } from "../substrates/e2b/base-module.js";
 import { e2bConnection } from "../substrates/e2b/connection.js";
+import { E2B_SYSTEM_CA_BUNDLE, holdKeysInEgress } from "../substrates/e2b/egress-keys.js";
 import { acquireE2BShellSandbox } from "../substrates/e2b/sandbox.js";
 import { loadModalShellModule } from "../substrates/modal/sandbox.js";
 import { serveObserverProxy } from "./observer-proxy.js";
@@ -60,7 +61,8 @@ export async function launchRemoteRun(launch) {
             return { runId, exitCode: signals.exitCode, error: "stopped before the runner was created" };
         const where = remote.provider === "modal" ? "a Modal sandbox" : "an E2B sandbox";
         say(`Running this study on ${where} as run ${runId}; creating the runner.`);
-        const runner = runnerOf((await acquireRunner(launch, paths)).sandbox);
+        const keys = runnerKeys(remote, launch.env);
+        const runner = runnerOf((await acquireRunner(launch, paths, keys.network)).sandbox);
         if (signals.requested !== undefined)
             return await endRun(launch, runId, {
                 exitCode: signals.exitCode,
@@ -95,7 +97,7 @@ export async function launchRemoteRun(launch) {
             study: launch.study,
             runId,
             ownerKey,
-            env: forwardedEnv(remote, launch.env),
+            env: keys.env,
         });
         return await followRemoteRun({ launch, runner, paths, runId, signals, proxyUrl: proxy.url });
     }
@@ -112,7 +114,7 @@ export async function launchRemoteRun(launch) {
             await rm(tarballDir, { recursive: true, force: true });
     }
 }
-async function acquireRunner(launch, paths) {
+async function acquireRunner(launch, paths, network) {
     const { provider, runnerMs } = launch.remote;
     const module = provider === "modal" ? await loadModalShellModule(launch.env) : await loadE2BBaseModule();
     // A Modal module takes its connection from launch.env and ignores these two.
@@ -125,7 +127,7 @@ async function acquireRunner(launch, paths) {
             ...account,
             timeoutMs: runnerMs,
             metadata: { participantId: "runner" },
-            network: { allowPublicTraffic: false },
+            network,
         },
         receipt: { root: paths, participantId: "runner" },
     });
@@ -350,13 +352,30 @@ export function watchSignals() {
     };
 }
 /**
- * The names and values the runner's run receives: each of the plan's names that is set here, and of
- * names the run reads only the first of, only the first one set.
+ * The keys the runner's run receives: each of the plan's names that is set here, and of names the
+ * run reads only the first of, only the first one set. On E2B, each key that travels as a header
+ * to a fixed host stays in an E2B header transform, and the run gets a placeholder and the system
+ * CA bundle that holds E2B's proxy CA, which Node does not read by default. Modal has no such
+ * transform, so a Modal runner receives every key as an environment variable.
  */
-export function forwardedEnv(remote, env) {
+export function runnerKeys(remote, env) {
     const set = (name) => (env[name]?.trim() ?? "") !== "";
     const unread = new Set(remote.alternatives.flatMap((names) => names.filter(set).slice(1)));
-    return Object.fromEntries(remote.envNames.flatMap((name) => (set(name) && !unread.has(name) ? [[name, env[name]]] : [])));
+    const forwarded = Object.fromEntries(remote.envNames.flatMap((name) => (set(name) && !unread.has(name) ? [[name, env[name]]] : [])));
+    const routing = { allowPublicTraffic: false };
+    if (remote.provider === "modal")
+        return { env: forwarded, network: routing, held: [], sent: Object.keys(forwarded).sort() };
+    const held = holdKeysInEgress(forwarded, { domain: forwarded.E2B_DOMAIN, existing: routing });
+    return {
+        env: held.held.length === 0
+            ? held.env
+            : { ...held.env, NODE_EXTRA_CA_CERTS: E2B_SYSTEM_CA_BUNDLE },
+        network: held.network,
+        held: held.held,
+        sent: Object.keys(forwarded)
+            .filter((name) => !held.held.includes(name))
+            .sort(),
+    };
 }
 /** Whether this humanish runs from a built package, which a runner can install. */
 export function runsFromPackage() {

package/dist/routes/terminal/credentials.js

@@ -1,4 +1,5 @@
-import { DEFAULT_RUNTIME_AUTH, E2B_SYSTEM_CA_BUNDLE, OPENAI_EGRESS_PLACEHOLDER, } from "./runtime-auth.js";
+import { DEFAULT_RUNTIME_AUTH } from "./runtime-auth.js";
+import { E2B_SYSTEM_CA_BUNDLE, EGRESS_PLACEHOLDER } from "../../substrates/e2b/egress-keys.js";
 import { TERMINAL_PRODUCT_STUDY_PROVIDER_METADATA } from "./types.js";
 /**
  * Where the study's runtime auth puts the key, as a sentence for the missing-key refusal. Typed
@@ -71,7 +72,7 @@ export function buildRuntimeAuth(args) {
     const envs = mode === "openai-egress"
         ? // Codex documents this verified-TLS trust channel. The stock image's default OpenSSL CA
             // file can be absent even though E2B has installed its proxy CA in the system bundle.
-            { CODEX_API_KEY: OPENAI_EGRESS_PLACEHOLDER, CODEX_CA_CERTIFICATE: E2B_SYSTEM_CA_BUNDLE }
+            { CODEX_API_KEY: EGRESS_PLACEHOLDER, CODEX_CA_CERTIFICATE: E2B_SYSTEM_CA_BUNDLE }
         : keyName === "OPENAI_API_KEY"
             ? { CODEX_API_KEY: keyValue, OPENAI_API_KEY: keyValue }
             : { [keyName]: keyValue };

package/dist/routes/terminal/live-sandbox.js

@@ -15,7 +15,7 @@ import { loadModalShellModule } from "../../substrates/modal/sandbox.js";
 import { e2bAccount } from "../../substrates/e2b/connection.js";
 import { E2BDesktopStartupError, loadE2BDesktopModule, } from "../../substrates/e2b/sdk.js";
 import { shellQuote } from "../../substrates/shell.js";
-import { buildOpenAiEgressNetwork } from "./runtime-auth.js";
+import { holdKeysInEgress } from "../../substrates/e2b/egress-keys.js";
 import { TERMINAL_RUNTIME_VERSION_TIMEOUT_MS, buildRuntimeExecPrefix, buildRuntimeVersionCommand, parseTerminalRuntimeVersion, } from "./runtime.js";
 import { runWithWallClock, teardownSandbox } from "./sandbox.js";
 import { DEFAULT_REQUEST_TIMEOUT_MS, PRODUCT_SETUP_TIMEOUT_MS, SANDBOX_WORKDIR, UPLOAD_MAX_BYTES, } from "./types.js";
@@ -73,7 +73,7 @@ export class LiveTerminalSandbox {
             ? undefined
             : { allowOut: [...egressAllow], denyOut: ["0.0.0.0/0"] };
         const network = runtimeEnv.mode === "openai-egress"
-            ? buildOpenAiEgressNetwork(runtimeEnv.keyValue, routing)
+            ? holdKeysInEgress({ OPENAI_API_KEY: runtimeEnv.keyValue }, { existing: routing }).network
             : routing;
         const options = {
             apiKey: e2bApiKey,

package/dist/routes/terminal/runtime-auth.d.ts

@@ -1,18 +1,6 @@
 import type { StudyRuntimeAuth } from "../../study/types.js";
-import type { E2BNetworkOptions } from "../../substrates/e2b/sdk.js";
 /**
  * The runtime auth a study gets when it declares none. A shell agent can read its own command env,
  * so the raw key stays in the host-side E2B request unless a study declares openai-env.
  */
 export declare const DEFAULT_RUNTIME_AUTH: StudyRuntimeAuth;
-/** E2B envd installs the sandbox-specific proxy CA into this system bundle before routing. */
-export declare const E2B_SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-/** An inert nonsecret value satisfies Codex exec's auth prerequisite. E2B replaces the header. */
-export declare const OPENAI_EGRESS_PLACEHOLDER = "humanish-egress-auth-placeholder";
-/**
- * Keep the runtime key in the host-side E2B request, outside sandbox env/files. The installed
- * E2B SDK declares that transform headers override existing request headers. This adds no routing
- * restrictions: every sandbox process can still spend via the provider proxy. Never log the
- * returned options. An adopter's existing exact-host rule must not be silently overwritten.
- */
-export declare function buildOpenAiEgressNetwork(keyValue: string, existing?: E2BNetworkOptions): E2BNetworkOptions;

package/dist/routes/terminal/runtime-auth.js

@@ -3,26 +3,3 @@
  * so the raw key stays in the host-side E2B request unless a study declares openai-env.
  */
 export const DEFAULT_RUNTIME_AUTH = "openai-egress";
-const OPENAI_EGRESS_HOST = "api.openai.com";
-/** E2B envd installs the sandbox-specific proxy CA into this system bundle before routing. */
-export const E2B_SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-/** An inert nonsecret value satisfies Codex exec's auth prerequisite. E2B replaces the header. */
-export const OPENAI_EGRESS_PLACEHOLDER = "humanish-egress-auth-placeholder";
-/**
- * Keep the runtime key in the host-side E2B request, outside sandbox env/files. The installed
- * E2B SDK declares that transform headers override existing request headers. This adds no routing
- * restrictions: every sandbox process can still spend via the provider proxy. Never log the
- * returned options. An adopter's existing exact-host rule must not be silently overwritten.
- */
-export function buildOpenAiEgressNetwork(keyValue, existing) {
-    if (Object.keys(existing?.rules ?? {}).some((host) => host.toLowerCase().replace(/\.$/, "") === OPENAI_EGRESS_HOST)) {
-        throw new Error("openai-egress conflicts with an existing api.openai.com network rule; refusing to overwrite it.");
-    }
-    return {
-        ...existing,
-        rules: {
-            ...existing?.rules,
-            [OPENAI_EGRESS_HOST]: [{ transform: { headers: { Authorization: `Bearer ${keyValue}` } } }],
-        },
-    };
-}

package/dist/substrates/e2b/egress-keys.d.ts

@@ -0,0 +1,22 @@
+import type { E2BNetworkOptions } from "./sdk.js";
+/** An inert nonsecret value that satisfies a client's "key is set" check. E2B replaces the header. */
+export declare const EGRESS_PLACEHOLDER = "humanish-egress-auth-placeholder";
+/** E2B envd installs the sandbox-specific proxy CA into this system bundle before routing. */
+export declare const E2B_SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+/**
+ * Hold every key in `keys` that travels as a header to a fixed host in an E2B header transform on
+ * `existing`, and give the env a placeholder for it. Other names pass through unchanged. The
+ * installed E2B SDK declares that transform headers override the request's own. The returned
+ * network carries the key values: never log or persist it. E2B's sandbox info endpoint returns
+ * the transforms as given, so a process that can call the E2B API for this sandbox can read them.
+ * An existing rule for a held key's host is refused, never overwritten.
+ */
+export declare function holdKeysInEgress(keys: Readonly<Record<string, string>>, options?: {
+    /** The account's E2B_DOMAIN; the E2B API host is `api.<domain>`. */
+    domain?: string | undefined;
+    existing?: E2BNetworkOptions | undefined;
+}): {
+    network: E2BNetworkOptions;
+    env: Record<string, string>;
+    held: string[];
+};

package/dist/substrates/e2b/egress-keys.js

@@ -0,0 +1,59 @@
+/** An inert nonsecret value that satisfies a client's "key is set" check. E2B replaces the header. */
+export const EGRESS_PLACEHOLDER = "humanish-egress-auth-placeholder";
+/** E2B envd installs the sandbox-specific proxy CA into this system bundle before routing. */
+export const E2B_SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+const GEMINI = {
+    host: "generativelanguage.googleapis.com",
+    header: "x-goog-api-key",
+    value: (key) => key,
+};
+/**
+ * Where each key name humanish sends as a header goes. Every host is fixed in the code that calls
+ * it: src/actors/openai-endpoint.ts, src/analysis/gemini-wire.ts, and the E2B SDK's
+ * `https://api.<E2B_DOMAIN>` with its `X-API-KEY` header.
+ */
+function headerKey(name, domain) {
+    if (name === "OPENAI_API_KEY")
+        return { host: "api.openai.com", header: "Authorization", value: (key) => `Bearer ${key}` };
+    if (name === "GEMINI_API_KEY" || name === "GOOGLE_API_KEY")
+        return GEMINI;
+    if (name === "E2B_API_KEY")
+        return { host: `api.${domain}`, header: "X-API-Key", value: (key) => key };
+    return undefined;
+}
+const sameHost = (a, b) => a.toLowerCase().replace(/\.$/, "") === b.toLowerCase().replace(/\.$/, "");
+/**
+ * Hold every key in `keys` that travels as a header to a fixed host in an E2B header transform on
+ * `existing`, and give the env a placeholder for it. Other names pass through unchanged. The
+ * installed E2B SDK declares that transform headers override the request's own. The returned
+ * network carries the key values: never log or persist it. E2B's sandbox info endpoint returns
+ * the transforms as given, so a process that can call the E2B API for this sandbox can read them.
+ * An existing rule for a held key's host is refused, never overwritten.
+ */
+export function holdKeysInEgress(keys, options = {}) {
+    const { existing } = options;
+    const domain = options.domain?.trim() || "e2b.app";
+    const rules = {};
+    const env = {};
+    const held = [];
+    for (const [name, value] of Object.entries(keys)) {
+        const placed = headerKey(name, domain);
+        if (placed === undefined) {
+            env[name] = value;
+            continue;
+        }
+        const taken = [...Object.keys(existing?.rules ?? {}), ...Object.keys(rules)].some((host) => sameHost(host, placed.host));
+        if (taken)
+            throw new Error(`${name} would be held in a header transform on ${placed.host}, which already has a network rule; refusing to overwrite it.`);
+        rules[placed.host] = [{ transform: { headers: { [placed.header]: placed.value(value) } } }];
+        env[name] = EGRESS_PLACEHOLDER;
+        held.push(name);
+    }
+    if (held.length === 0)
+        return { network: { ...existing }, env, held };
+    return {
+        network: { ...existing, rules: { ...existing?.rules, ...rules } },
+        env,
+        held: held.sort(),
+    };
+}

package/docs/contracts/study-analysis.md

@@ -461,6 +461,19 @@ that screen is a strong design finding. Validation is unchanged. A design findin
 least one cited capture, so an impression plus the capture of its screen makes a design finding,
 and an impression alone supports only a finding about what the participant said.
 
+## Participant statement citations
+
+An observation with basis `participant_statement` must cite at least one quote-eligible entry
+(`analysis_validation_failed_statement_source_invalid` otherwise). It may also cite captures or
+actions, as an `action` observation may cite more than its one required action. The prompt still
+asks for statements that cite only quote-eligible entries; validation accepts an analyst that adds
+the capture the participant spoke about. Validation does not check that the observation's wording
+matches the quote. Entries of kind `reasoning` are quote-eligible, so a claim drawn from a
+participant's private reasoning also passes as a statement. Before this rule, any non-quote
+citation failed the whole analysis, which caused nearly all `gpt-6-luna` rejections on the
+2026-10-22 benchmark recordings
+([participant statements that cite captures](https://github.com/danielgwilson/humanish/blob/main/docs/evidence/benchmark/2026-10-22-statement-rule.md)).
+
 ## Durable records
 
 The `humanish.observer-data.v3` schema is unchanged by analysis. A companion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.144.0",
+  "version": "0.145.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",

package/skills/humanish/SKILL.md

@@ -560,7 +560,8 @@ SIGTERM stops the run: humanish marks it interrupted and stops its sandboxes.
   If its terminal closes, the command exits 129 with `HUMANISH_REMOTE_DETACHED` and the run goes
   on; `observe --run <id>` copies it back. `--local` keeps one run on this machine,
   `execution.remote: false` every run of a study. The JSON result's `remote.keys` names the keys
-  the runner received.
+  the run used. On E2B the OpenAI, Gemini and E2B keys stay in E2B's egress proxy and the runner
+  holds placeholders; a Modal runner receives them as environment variables.
 - Start a study that can outlive your shell call in tmux, for example
   `tmux new -d -s study 'npx humanish run <study> --json --no-open > run-result.json 2> run.log'`.
   `--detach` only skips the Observer server at the end; it does not move the run to the background.