humanish 0.145.0 → 0.147.0

package/dist/run/pricing.js

@@ -54,6 +54,26 @@ function geminiRate(inPer1M, cachedPer1M, outPer1M, change = {}) {
         source: "ai.google.dev/gemini-api/docs/pricing (paid tier, standard)",
     };
 }
+// Fast mode: OpenAI's `service_tier: "fast"` (formerly priority processing), billed per token at
+// its own rates with the cached-input discount and the long-context tier. gpt-5.6-sol's fast rates
+// are twice every standard rate ("For GPT-5.6 Sol, Fast mode costs twice the corresponding Standard
+// rate", developers.openai.com/api/docs/guides/fast-mode, read 2026-10-24); the 6-series rates are
+// the Fast tab of developers.openai.com/api/docs/pricing?latest-pricing=fast, read 2026-10-24.
+const FAST_MODE_GUIDE = "developers.openai.com/api/docs/guides/fast-mode (gpt-5.6-sol, 2x standard)";
+const FAST_MODE_SHEET = "developers.openai.com/api/docs/pricing?latest-pricing=fast (fast tier)";
+/** A rate with Fast mode rates per 1M tokens: input, cached input, cache write and output. */
+function withFast(rate, inPer1M, cachedPer1M, writePer1M, outPer1M, source) {
+    return {
+        ...rate,
+        fast: {
+            inputUsdPerToken: inPer1M * 1e-6,
+            cachedInputUsdPerToken: cachedPer1M * 1e-6,
+            cacheWriteUsdPerToken: writePer1M * 1e-6,
+            outputUsdPerToken: outPer1M * 1e-6,
+            source,
+        },
+    };
+}
 // gpt-5.6-sol promotional rates (live sheet 2026-09-03: $4 / $0.40 cached / $5 write / $20 out,
 // "available at least through November 21, 2026"). Re-verify against the sheet after Nov 21.
 const GPT56_SOL_PROMO_AS_OF = "2026-09-03";
@@ -84,10 +104,10 @@ export const MODEL_RATES = {
     // the longContext block prices the >272K re-tier when per-request turns are recorded).
     // sol = flagship (the shipped CUA default), terra = cost-balanced, luna = high-volume,
     // cyber = the Daybreak frontier tier.
-    "gpt-5.6-sol": rateWithLongContextTier(4, 0.4, 5, 20, GPT56_SOL_PROMO_AS_OF),
+    "gpt-5.6-sol": withFast(rateWithLongContextTier(4, 0.4, 5, 20, GPT56_SOL_PROMO_AS_OF), 8, 0.8, 10, 40, FAST_MODE_GUIDE),
     // "gpt-5.6" is OpenAI's own alias for gpt-5.6-sol (models index); priced identically so a
     // study configured with the alias never reads as unpriced.
-    "gpt-5.6": rateWithLongContextTier(4, 0.4, 5, 20, GPT56_SOL_PROMO_AS_OF),
+    "gpt-5.6": withFast(rateWithLongContextTier(4, 0.4, 5, 20, GPT56_SOL_PROMO_AS_OF), 8, 0.8, 10, 40, FAST_MODE_GUIDE),
     "gpt-5.6-terra": rateWithLongContextTier(2, 0.2, 2.5, 12),
     "gpt-5.6-luna": rateWithLongContextTier(0.2, 0.02, 0.25, 1.2),
     "gpt-5.6-cyber": rateWithLongContextTier(12.5, 1.25, 15.625, 75),
@@ -100,11 +120,11 @@ export const MODEL_RATES = {
     // as the 5.6 family on the sheet: writes at 1.25x, >272K re-tiers at 2x input-side / 1.5x
     // output ($20 / $2 / $25 / $75 long-context columns). These rates cover explicit study
     // model choices and the study-analysis default; the computer-use default is separate.
-    "gpt-6-astra": rateWithLongContextTier(10, 1, 12.5, 50, GPT6_ASTRA_AS_OF, GPT6_ASTRA_SOURCE),
+    "gpt-6-astra": withFast(rateWithLongContextTier(10, 1, 12.5, 50, GPT6_ASTRA_AS_OF, GPT6_ASTRA_SOURCE), 20, 2, 25, 100, FAST_MODE_SHEET),
     // gpt-6.1-sol and gpt-6-luna: the same write and long-context mechanics on the sheet and each
     // model page. 6.1 Sol bills cache reads at 5% of input ($0.10), where the others bill 10%.
-    "gpt-6.1-sol": rateWithLongContextTier(2, 0.1, 2.5, 10, GPT6_SOL_LUNA_AS_OF, GPT6_SOL_LUNA_SOURCE),
-    "gpt-6-luna": rateWithLongContextTier(0.1, 0.01, 0.125, 0.5, GPT6_SOL_LUNA_AS_OF, GPT6_SOL_LUNA_SOURCE),
+    "gpt-6.1-sol": withFast(rateWithLongContextTier(2, 0.1, 2.5, 10, GPT6_SOL_LUNA_AS_OF, GPT6_SOL_LUNA_SOURCE), 4, 0.2, 5, 20, FAST_MODE_SHEET),
+    "gpt-6-luna": withFast(rateWithLongContextTier(0.1, 0.01, 0.125, 0.5, GPT6_SOL_LUNA_AS_OF, GPT6_SOL_LUNA_SOURCE), 0.2, 0.02, 0.25, 1, FAST_MODE_SHEET),
     // Gemini analysis models, paid standard tier. Thinking tokens bill as output. No long-context
     // tier is published for them. Cached input is the implicit context-cache rate. On the free tier
     // these requests bill nothing, so the estimate is the paid-tier cost.
@@ -283,24 +303,41 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
     // price every token at the full rate while the session totals sit ignored, overstating spend
     // 3.5-5x and tripping caps early. Inconsistent evidence falls back to the totals path, which
     // honors the declared splits on the base tier.
-    const tiered = rate.longContext !== undefined &&
+    const tiered = (rate.longContext !== undefined || turns.some((turn) => isFastServiceTier(turn.serviceTier))) &&
         turns.length > 0 &&
         sumOf("input") === inTok &&
         sumOf("output") === outTok &&
         sumOf("cachedInput") === (tokenUsage.cachedInput ?? 0) &&
         sumOf("cacheWriteInput") === (tokenUsage.cacheWriteInput ?? 0);
+    // A request served in Fast mode bills at the fast rates. Totals that the ledger does not
+    // decompose price at the fast rate when any request was served fast: the over-estimate direction.
+    const fastTotals = !tiered && turns.some((turn) => isFastServiceTier(turn.serviceTier));
+    // A request served fast on a model with no Fast mode rate has no rate in this table.
+    if (rate.fast === undefined && turns.some((turn) => isFastServiceTier(turn.serviceTier))) {
+        return {
+            schema: ACTOR_ESTIMATED_COST_SCHEMA,
+            estimatedCostUsd: null,
+            reason: "no_rate_for_model",
+            ratesAsOf: null,
+            ...(modelId ? { modelId } : {}),
+        };
+    }
     let inputUsd = 0;
     let outputUsd = 0;
     let cachedTotal = 0;
     let writeTotal = 0;
     let longContextTurns = 0;
+    let fastTurns = 0;
     // Price one request's usage at one tier. Cached input is billed at a fraction of the full rate,
     // and on a session that threads provider state it is the majority of input, and pricing it at the
     // full rate overstates real spend by up to ~10x. Cache writes bill at their own rate (1.25x on
     // OpenAI 5.6+) as the total rate for those tokens; a sheet without a write rate prices writes as
     // plain input (pre-5.6: writes are free-of-extra-fee, i.e. plain input). An unreported piece
     // stays absent: no reported split means no discount and no surcharge assumed.
-    const priceRequest = (usage, tierable) => {
+    const priceRequest = (usage, tierable, fast) => {
+        const sheet = fast && rate.fast !== undefined ? { ...rate, ...rate.fast } : rate;
+        if (fast)
+            fastTurns += 1;
         const reqIn = usage.input ?? 0;
         const reqOut = usage.output ?? 0;
         // Tiering applies only to a real per-request record: session totals crossing the threshold
@@ -310,7 +347,7 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
         const outMul = long ? rate.longContext.outputMultiplier : 1;
         if (long)
             longContextTurns += 1;
-        const cached = rate.cachedInputUsdPerToken === undefined
+        const cached = sheet.cachedInputUsdPerToken === undefined
             ? 0
             : Math.min(reqIn, Math.max(0, usage.cachedInput ?? 0));
         const writes = Math.min(reqIn - cached, Math.max(0, usage.cacheWriteInput ?? 0));
@@ -318,14 +355,14 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
         cachedTotal += cached;
         writeTotal += writes;
         inputUsd +=
-            full * rate.inputUsdPerToken * inMul +
-                cached * (rate.cachedInputUsdPerToken ?? 0) * inMul +
-                writes * (rate.cacheWriteUsdPerToken ?? rate.inputUsdPerToken) * inMul;
-        outputUsd += reqOut * rate.outputUsdPerToken * outMul;
+            full * sheet.inputUsdPerToken * inMul +
+                cached * (sheet.cachedInputUsdPerToken ?? 0) * inMul +
+                writes * (sheet.cacheWriteUsdPerToken ?? sheet.inputUsdPerToken) * inMul;
+        outputUsd += reqOut * sheet.outputUsdPerToken * outMul;
     };
     if (tiered) {
         for (const turn of turns)
-            priceRequest(turn, true);
+            priceRequest(turn, true, isFastServiceTier(turn.serviceTier));
     }
     else {
         priceRequest({
@@ -335,7 +372,7 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
             ...(tokenUsage.cacheWriteInput === undefined
                 ? {}
                 : { cacheWriteInput: tokenUsage.cacheWriteInput }),
-        }, false);
+        }, false, fastTotals);
     }
     inputUsd = round6(inputUsd);
     outputUsd = round6(outputUsd);
@@ -343,7 +380,7 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
         schema: ACTOR_ESTIMATED_COST_SCHEMA,
         estimatedCostUsd: round6(inputUsd + outputUsd),
         ratesAsOf: rate.asOf,
-        source: rate.source,
+        source: fastTurns > 0 && rate.fast?.source !== undefined ? rate.fast.source : rate.source,
         ...(modelId ? { modelId } : {}),
         ...(rate.placeholder ? { placeholder: true } : {}),
         breakdown: {
@@ -354,9 +391,15 @@ export function estimateActorCost(tokenUsage, modelId, rates = MODEL_RATES, at =
             ...(cachedTotal > 0 ? { cachedInputTokens: cachedTotal } : {}),
             ...(writeTotal > 0 ? { cacheWriteInputTokens: writeTotal } : {}),
             ...(longContextTurns > 0 ? { longContextTurns } : {}),
+            ...(fastTurns > 0 ? { fastTurns } : {}),
         },
     };
 }
+/** Whether a provider-reported tier bills at Fast mode rates. GPT-5.6 reports `priority` for a
+ *  request that asked for `fast`. */
+function isFastServiceTier(tier) {
+    return tier === "fast" || tier === "priority";
+}
 /**
  * Estimate the E2B desktop-minute cost from a host-side create->teardown span (minutes). The rate
  * is injectable. Returns a declared-absent estimate (null + "no_duration") when no duration was

package/dist/study/config.js

@@ -39,7 +39,7 @@ import { invalid, optionalStr, str } from "./parse/values.js";
 import { isComputerUseComposition, routeOf } from "./routing.js";
 import { declaredParticipantIds } from "./plan-participants.js";
 import { ID_PATTERN, STUDY_SCHEMA, } from "./types.js";
-import { automaticAnalysisRouteReason, desktopMediaValidationReason, networkCaptureValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, smtpValidationReason, taskProtocolValidationReason, waitLimitValidationReason, } from "./validation.js";
+import { automaticAnalysisRouteReason, desktopMediaValidationReason, networkCaptureValidationReason, outputTokenLimitValidationReason, serviceTierValidationReason, receivingEmailValidationReason, smtpValidationReason, taskProtocolValidationReason, waitLimitValidationReason, } from "./validation.js";
 import { forwardDeclaredWarnings, inertFieldLabels, inertFieldPaths } from "./warnings.js";
 import { plural } from "../run/text.js";
 /**
@@ -234,6 +234,9 @@ function checkStudyConfig(config) {
     const outputLimitReason = outputTokenLimitValidationReason(config);
     if (outputLimitReason)
         return invalid(outputLimitReason);
+    const serviceTierReason = serviceTierValidationReason(config);
+    if (serviceTierReason)
+        return invalid(serviceTierReason);
     const waitLimitReason = waitLimitValidationReason(config);
     if (waitLimitReason)
         return invalid(waitLimitReason);

package/dist/study/keys.d.ts

@@ -126,6 +126,7 @@ export declare const ACTOR: {
     };
     localAgent: true;
     reasoningEffort: true;
+    serviceTier: true;
     stopWhen: {
         any: {
             id: true;

package/dist/study/keys.js

@@ -106,6 +106,7 @@ export const ACTOR = {
     clock: { timeZone: true },
     localAgent: true,
     reasoningEffort: true,
+    serviceTier: true,
     stopWhen: STOP_WHEN,
     dwell: DWELL,
     tasks: { id: true, goal: true, success: STOP_WHEN },

package/dist/study/parse/actors.js

@@ -112,6 +112,11 @@ export function parseActorFields(entry, path) {
         }
         actor.reasoningEffort = entry.reasoningEffort;
     }
+    if (entry.serviceTier !== undefined) {
+        if (entry.serviceTier !== "fast")
+            return invalid(`${path}.serviceTier must be "fast" (OpenAI Fast mode), or left out for the standard tier.`);
+        actor.serviceTier = entry.serviceTier;
+    }
     const stopWhenResult = parseStopWhen(entry.stopWhen, `${path}.stopWhen`);
     if (!stopWhenResult.ok)
         return stopWhenResult;

package/dist/study/plan-participants.d.ts

@@ -37,6 +37,8 @@ export interface DesktopParticipant extends Participant {
         readonly dwell?: DwellWindow;
         readonly reasoningEffort?: ReasoningEffort;
         readonly maxOutputTokens?: number;
+        /** actor.serviceTier: OpenAI Fast mode on every request. */
+        readonly serviceTier?: "fast";
         /** actor.maxWaitMs: the longest one wait or one turn of only waits lasts. */
         readonly maxWaitMs?: number;
         /**

package/dist/study/plan-participants.js

@@ -13,6 +13,7 @@ function desktopParticipant(config, entry, index, kind, focus) {
     const dwell = entry?.dwell ?? actor?.dwell;
     const reasoningEffort = entry?.reasoningEffort ?? actor?.reasoningEffort;
     const maxOutputTokens = actor?.maxOutputTokens;
+    const serviceTier = actor?.serviceTier;
     const maxWaitMs = actor?.maxWaitMs;
     const idleWaitMs = entry?.idleWaitMs ?? actor?.idleWaitMs;
     const timeZone = entry?.clock?.timeZone ?? actor?.clock?.timeZone;
@@ -35,6 +36,7 @@ function desktopParticipant(config, entry, index, kind, focus) {
             ...(dwell === undefined ? {} : { dwell }),
             ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
             ...(maxOutputTokens === undefined ? {} : { maxOutputTokens }),
+            ...(serviceTier === undefined ? {} : { serviceTier }),
             ...(maxWaitMs === undefined ? {} : { maxWaitMs }),
             ...(idleWaitMs === undefined ? {} : { idleWaitMs }),
             ...(timeZone === undefined ? {} : { timeZone }),

package/dist/study/types.d.ts

@@ -453,6 +453,13 @@ export interface StudyActor {
      * docs/principles/actor-fidelity.md.
      */
     reasoningEffort?: ReasoningEffort;
+    /**
+     * `fast` sends every participant request in OpenAI Fast mode (`service_tier: "fast"`), which
+     * bills at its own per-token rates. Absent sends no tier. `openai-computer-use` only, and only for
+     * a model whose Fast mode rate src/run/pricing.ts carries, so the spend estimate and caps price it.
+     * Each request's trace usage records the tier that served it.
+     */
+    serviceTier?: "fast";
     /**
      * Deterministic completion guard used as the default for CUA participants. A `participants` entry's stopWhen
      * overrides this value.

package/dist/study/validation.d.ts

@@ -44,6 +44,11 @@ export declare function taskProtocolValidationReason(config: StudyConfig, suppor
 export declare function cloneTargetValidationReason(config: StudyConfig): string | null;
 /** Refuse a claimed output bound when the route cannot pass it to the first-party provider. */
 export declare function outputTokenLimitValidationReason(config: StudyConfig): string | null;
+/**
+ * Refuse a Fast mode request humanish cannot send or price: the first-party OpenAI computer-use
+ * route sends it, and the spend estimate needs the model's Fast mode rate.
+ */
+export declare function serviceTierValidationReason(config: StudyConfig): string | null;
 /**
  * Refuse a wait field out of range, or an idle wait longer than the longest wait: the actor's, and
  * each participant's own idleWaitMs under actor.maxWaitMs. On a route whose participants take no

package/dist/study/validation.js

@@ -1,4 +1,6 @@
 import { isMaxOutputTokens } from "../actors/output-token-limit.js";
+import { DEFAULT_OPENAI_CU_MODEL } from "../actors/computer-use/openai-provider.js";
+import { MODEL_RATES, participantRate } from "../run/pricing.js";
 import { MAX_RECEIVING_INBOXES } from "../comms/receiving-types.js";
 import { waitFieldsReason } from "../actors/computer-use/wait.js";
 import { PARTICIPANT_ID_MAX_CHARS, PARTICIPANT_ID_PATTERN } from "./parse/actors.js";
@@ -288,6 +290,27 @@ export function outputTokenLimitValidationReason(config) {
     }
     return null;
 }
+/**
+ * Refuse a Fast mode request humanish cannot send or price: the first-party OpenAI computer-use
+ * route sends it, and the spend estimate needs the model's Fast mode rate.
+ */
+export function serviceTierValidationReason(config) {
+    const actor = config.actor;
+    if (actor?.serviceTier === undefined)
+        return null;
+    if (actor.type !== "openai-computer-use" ||
+        !isComputerUseComposition(config) ||
+        config.subject.source === "local-app")
+        return "actor.serviceTier is supported only by first-party OpenAI computer-use routes; terminal, local-agent, scripted and custom in-process routes do not send it.";
+    const model = actor.model ?? DEFAULT_OPENAI_CU_MODEL;
+    if (participantRate(model)?.fast === undefined) {
+        const priced = Object.keys(MODEL_RATES)
+            .filter((id) => participantRate(id)?.fast !== undefined)
+            .sort();
+        return `actor.serviceTier: fast needs a Fast mode rate for model "${model}", and humanish has none, so it could not price the run. Models with a Fast mode rate: ${priced.join(", ")}. Use one of them, or remove serviceTier.`;
+    }
+    return null;
+}
 /**
  * Refuse a wait field out of range, or an idle wait longer than the longest wait: the actor's, and
  * each participant's own idleWaitMs under actor.maxWaitMs. On a route whose participants take no

package/dist/substrates/e2b/cdp-probe.d.ts

@@ -30,8 +30,11 @@ export interface ChromeCdpProbeArgs {
      * pausing it; it applies `emulation` (how a participant keeps the overrides for its whole life,
      * with a reload on each page) and `network` capture, either or both. "fidelity": read
      * back what the page reports about itself (UA, DPR, viewport, touch), the proof for the bundle.
+     * "load": poll the page until it has loaded and painted, or until `deadlineMs`.
      */
-    mode: "state" | "geometry" | "port" | "emulate" | "hold" | "fidelity";
+    mode: "state" | "geometry" | "port" | "emulate" | "hold" | "fidelity" | "load";
+    /** For "load": how long to poll before reporting the page as not loaded. */
+    deadlineMs?: number;
     /** For "emulate" and "hold": what to apply. */
     emulation?: ChromeMobileEmulationRequest;
     /** For "hold": capture each held page's requests to a sandbox file. */
@@ -41,6 +44,16 @@ export interface ChromeCdpProbeArgs {
 export interface ChromeMobileEmulationRequest extends MobileEmulationRequest {
     platform?: string;
 }
+/**
+ * What the "load" mode saw. `loaded` is true once the page reports document.readyState complete,
+ * is visible and has a first contentful paint. `seen` describes the last read in words that name
+ * no URL.
+ */
+export interface ChromePageLoad {
+    loaded: boolean;
+    waitedMs: number;
+    seen: string;
+}
 /** What the page reports after emulation: the proof, never copied from the request. */
 interface ChromeFidelityRead {
     userAgent: string;
@@ -80,6 +93,8 @@ export interface ChromeCdpProbeResult {
     } | {
         unavailable: string;
     };
+    /** "load": whether the page loaded and painted before the deadline, and what the last read saw. */
+    load?: ChromePageLoad;
     /**
      * Seconds since the epoch on the sandbox clock when the probe printed, on every answer including
      * an unavailable one. It is the clock CDP `wallTime` uses, so a turn mark compares with request

package/dist/substrates/e2b/cdp-probe.js

@@ -213,6 +213,10 @@ GEOMETRY_EXPRESSION = (
     "({ browserWindow: { x: window.screenX, y: window.screenY, width: window.outerWidth, height: window.outerHeight }, "
     "viewport: { width: window.innerWidth, height: window.innerHeight, deviceScaleFactor: window.devicePixelRatio } })"
 )
+LOAD_EXPRESSION = (
+    "({ readyState: document.readyState, visible: document.visibilityState === 'visible', "
+    "painted: performance.getEntriesByType('paint').some(function (entry) { return entry.name === 'first-contentful-paint'; }) })"
+)
 FIDELITY_EXPRESSION = (
     "({ userAgent: navigator.userAgent, devicePixelRatio: window.devicePixelRatio, "
     "innerWidth: window.innerWidth, innerHeight: window.innerHeight, "
@@ -405,6 +409,50 @@ def follow_targets(ws, launch_id, request, log):
         if params.get("waitingForDebugger"):
             ws.send("Runtime.runIfWaitingForDebugger", {}, new_session)
 
+def page_ws_url(port, page):
+    # Chrome omits webSocketDebuggerUrl from /json while another DevTools client is attached to the
+    # page, or for a moment after one detaches; the page socket URL is still /devtools/page/<id>.
+    return page.get("webSocketDebuggerUrl") or (
+        "ws://127.0.0.1:%d/devtools/page/%s" % (port, page.get("id")) if page.get("id") else None
+    )
+
+def wait_for_load(port, args):
+    """Poll the page until document.readyState is complete, the page is visible and Chrome has
+    recorded its first contentful paint: the page has loaded and something of it is drawn. Stops at
+    deadlineMs and reports what the last read saw."""
+    started = time.monotonic()
+    deadline_ms = int(args.get("deadlineMs") or 0)
+    seen = "no http page yet"
+    page = None
+    loaded = False
+    while True:
+        try:
+            page = select_page(list_pages(port), args)
+            seen = "no http page yet" if page is None else seen
+        except Exception as error:
+            page, seen = None, "the DevTools endpoint did not answer (%s)" % type(error).__name__
+        ws_url = page_ws_url(port, page) if page is not None else None
+        state = evaluate(ws_url, LOAD_EXPRESSION) if ws_url else None
+        if isinstance(state, dict):
+            ready = str(state.get("readyState") or "unknown")
+            seen = "document.readyState %s, %s, %s" % (
+                ready,
+                "visible" if state.get("visible") else "hidden",
+                "first contentful paint recorded" if state.get("painted") else "no first contentful paint yet",
+            )
+            loaded = ready == "complete" and bool(state.get("visible")) and bool(state.get("painted"))
+            if loaded:
+                break
+        elif ws_url:
+            seen = "the page did not answer Runtime.evaluate"
+        if (time.monotonic() - started) * 1000 >= deadline_ms:
+            break
+        time.sleep(0.25)
+    answer = {"load": {"loaded": loaded, "waitedMs": int((time.monotonic() - started) * 1000), "seen": seen}}
+    if page is not None:
+        answer["targetId"] = str(page.get("id") or "")
+    emit(answer)
+
 def emit(answer):
     """Print one answer line stamped with this sandbox's clock. CDP wallTime uses the same clock, so
     a turn mark taken from it compares with request times without host skew, and the reading needs
@@ -419,6 +467,9 @@ def main():
     if mode == "port":
         emit({"cdpPort": port})
         return
+    if mode == "load":
+        wait_for_load(port, args)
+        return
     try:
         pages = list_pages(port)
     except Exception as error:
@@ -441,11 +492,7 @@ def main():
     if page is None:
         emit({"unavailable": "no http page among %d CDP targets on 127.0.0.1:%d" % (len(pages), port)})
         return
-    # Chrome omits webSocketDebuggerUrl from /json while another DevTools client is attached to the
-    # page, or for a moment after one detaches; the page socket URL is still /devtools/page/<id>.
-    ws_url = page.get("webSocketDebuggerUrl") or (
-        "ws://127.0.0.1:%d/devtools/page/%s" % (port, page.get("id")) if page.get("id") else None
-    )
+    ws_url = page_ws_url(port, page)
     if mode == "emulate":
         applied, failure = emulate(ws_url, args.get("emulation") or {}) if ws_url else (None, "the page has no socket")
         if failure is not None:
@@ -502,6 +549,8 @@ export function chromeCdpProbeCommand(args) {
         payload.emulation = args.emulation;
     if (args.network !== undefined)
         payload.network = args.network;
+    if (args.deadlineMs !== undefined)
+        payload.deadlineMs = args.deadlineMs;
     return `python3 -c ${shellQuote(CHROME_CDP_PROBE_PY)} ${shellQuote(JSON.stringify(payload))}`;
 }
 /**
@@ -529,6 +578,7 @@ export function parseChromeCdpProbeOutput(stdout) {
     const numberOr = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
     const now = numberOr(record.now);
     const network = networkOf(record.network);
+    const load = loadOf(record.load);
     if (typeof record.unavailable === "string") {
         return {
             unavailable: record.unavailable,
@@ -602,9 +652,21 @@ export function parseChromeCdpProbeOutput(stdout) {
         ...(browserWindow === undefined ? {} : { browserWindow }),
         ...(viewport === undefined ? {} : { viewport }),
         ...(network === undefined ? {} : { network }),
+        ...(load === undefined ? {} : { load }),
         ...(now === undefined ? {} : { now }),
     };
 }
+function loadOf(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const source = value;
+    if (typeof source.loaded !== "boolean" ||
+        typeof source.waitedMs !== "number" ||
+        !Number.isFinite(source.waitedMs) ||
+        typeof source.seen !== "string")
+        return undefined;
+    return { loaded: source.loaded, waitedMs: source.waitedMs, seen: source.seen };
+}
 function networkOf(value) {
     if (!value || typeof value !== "object")
         return undefined;

package/dist/substrates/e2b/desktop-browser.js

@@ -7,8 +7,10 @@ import { runDetachedStep } from "../detached.js";
 import { shellQuote } from "../shell.js";
 import { externalLinkHandlerSetup } from "./desktop-handoff.js";
 import { e2bShell } from "./shell.js";
-// Settle after opening the browser or the terminal, before the first screenshot: long enough for
-// a cold browser and page load to paint (2 s captured a blank desktop; the render needs 6-9 s).
+// The wait before the first screenshot. After a terminal opens, or a browser without a DevTools
+// read, it is a fixed sleep: long enough for a cold browser and page load to paint (2 s captured a
+// blank desktop; the render needs 6-9 s). A Chromium participant waits for its page to load and
+// paint (waitForChromePageLoad) and gives up after this long.
 export const DESKTOP_SETTLE_MS = 8_000;
 /** The DevTools port every Chromium participant launches with; see `chrome_debug_flags` below. */
 export const CHROME_DEVTOOLS_PORT = 9222;

package/dist/substrates/e2b/desktop-cdp.d.ts

@@ -1,5 +1,5 @@
 import type { ChromeNetworkCaptureRequest } from "./cdp-network-capture.js";
-import { type ChromeCdpProbeResult, type ChromeMobileEmulationRequest } from "./cdp-probe.js";
+import { type ChromeCdpProbeResult, type ChromeMobileEmulationRequest, type ChromePageLoad } from "./cdp-probe.js";
 import type { RunDesktopGeometry } from "../../run/streams.js";
 import type { E2BDesktopSandbox } from "./sdk.js";
 /**
@@ -85,6 +85,13 @@ export declare function applyMobileEmulation(desktop: E2BDesktopSandbox, request
     /** The holder's capture status, when `network` was passed and the holder said. */
     network?: ChromeCdpProbeResult["network"];
 }>;
+/**
+ * Wait until the participant's launch page has loaded and painted, read over DevTools in the
+ * sandbox, for at most `deadlineMs`. Resolves with what the wait saw, or undefined when it could
+ * not run (no python3, a failed command, output that is not the probe's), so the caller can fall
+ * back to a fixed wait.
+ */
+export declare function waitForChromePageLoad(desktop: E2BDesktopSandbox, requestTimeoutMs: number, endpoint: ChromeCdpEndpoint, deadlineMs: number): Promise<ChromePageLoad | undefined>;
 /**
  * Start a holder that records the launch page's requests, and every later tab's, to
  * `network.eventsPath`, for a participant without mobile emulation; applyMobileEmulation passes
@@ -94,7 +101,7 @@ export declare function applyMobileEmulation(desktop: E2BDesktopSandbox, request
 export declare function startNetworkCapture(desktop: E2BDesktopSandbox, requestTimeoutMs: number, endpoint: ChromeCdpEndpoint, network: ChromeNetworkCaptureRequest): Promise<string>;
 /**
  * What the capture holder announced: when capture started on the launch page, on the sandbox
- * clock, or why it did not. Reads the holder's log up to 6 times, half a second apart by
+ * clock, or why it did not. Reads the holder's log up to 22 times, half a second apart by
  * `desktop.wait`, and reports a holder that printed nothing as unavailable.
  */
 export declare function readNetworkCaptureStart(desktop: E2BDesktopSandbox, requestTimeoutMs: number, holderName: string): Promise<NonNullable<ChromeCdpProbeResult["network"]>>;

package/dist/substrates/e2b/desktop-cdp.js

@@ -213,10 +213,32 @@ export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint,
         ...capture,
     };
 }
+/**
+ * Wait until the participant's launch page has loaded and painted, read over DevTools in the
+ * sandbox, for at most `deadlineMs`. Resolves with what the wait saw, or undefined when it could
+ * not run (no python3, a failed command, output that is not the probe's), so the caller can fall
+ * back to a fixed wait.
+ */
+export async function waitForChromePageLoad(desktop, requestTimeoutMs, endpoint, deadlineMs) {
+    const result = await e2bShell(desktop)
+        .run(chromeCdpProbeCommand({ ...endpoint, prefer: "pinned", mode: "load", deadlineMs }), {
+        requestTimeoutMs,
+        // One poll can take 3.5 s past the deadline: a 2 s listing and a 1.5 s evaluate.
+        timeoutMs: deadlineMs + 10_000,
+    })
+        .catch(() => undefined);
+    if (result === undefined || result.exitCode !== 0)
+        return undefined;
+    return parseChromeCdpProbeOutput(result.stdout).load;
+}
 /** The holder stops writing its events file at 32 MiB, so a read stops there too. */
 const NETWORK_EVENTS_MAX_BYTES = 32 * 1024 * 1024;
-/** How many times the capture holder's log is read for its announce, and how far apart. */
-const NETWORK_ANNOUNCE_READS = 6;
+/**
+ * How many times the capture holder's log is read for its announce, and how far apart. The reads
+ * start after the page wait, which can end within a second of the holder's start, so they cover
+ * the 11 s a holder had when a fixed 8 s settle came before 3 s of reads.
+ */
+const NETWORK_ANNOUNCE_READS = 22;
 const NETWORK_ANNOUNCE_EVERY_MS = 500;
 /**
  * Start a holder that records the launch page's requests, and every later tab's, to
@@ -235,7 +257,7 @@ export async function startNetworkCapture(desktop, requestTimeoutMs, endpoint, n
 }
 /**
  * What the capture holder announced: when capture started on the launch page, on the sandbox
- * clock, or why it did not. Reads the holder's log up to 6 times, half a second apart by
+ * clock, or why it did not. Reads the holder's log up to 22 times, half a second apart by
  * `desktop.wait`, and reports a holder that printed nothing as unavailable.
  */
 export async function readNetworkCaptureStart(desktop, requestTimeoutMs, holderName) {
@@ -253,7 +275,7 @@ export async function readNetworkCaptureStart(desktop, requestTimeoutMs, holderN
         });
     }
     return {
-        unavailable: `the in-sandbox holder printed nothing within ${(NETWORK_ANNOUNCE_READS * NETWORK_ANNOUNCE_EVERY_MS) / 1000} s of the desktop settling`,
+        unavailable: `the in-sandbox holder printed nothing within ${(NETWORK_ANNOUNCE_READS * NETWORK_ANNOUNCE_EVERY_MS) / 1000} s of the page wait`,
     };
 }
 /**

package/dist/verify/artifacts.js

@@ -192,7 +192,8 @@ export function streamScreenshotPaths(bundle) {
     return paths;
 }
 function isHarnessScreenshotPath(normalized) {
-    return normalized.startsWith("screenshots/") && normalized.toLowerCase().endsWith(".png");
+    const lower = normalized.toLowerCase();
+    return (normalized.startsWith("screenshots/") && (lower.endsWith(".png") || lower.endsWith(".webp")));
 }
 function isRunRootEvidenceReference(value) {
     return (typeof value === "string" &&

package/docs/contracts/run-bundle.md

@@ -1092,11 +1092,23 @@ an unclaimed frame on a raw, silent or live-only trace, and `ocr_scrubbed`, whic
 the trace contract reserves but no writer produces. An aggregate raw declaration
 wins over every frame claim.
 
-A screenshot is a non-interlaced PNG whose first chunk is a 13-byte IHDR, whose
-IEND is empty, and which holds image data only. A chunk outside IHDR, PLTE, IDAT,
-IEND, tRNS, cHRM, gAMA, sBIT, sRGB, pHYs and bKGD (text chunks, ICC profiles,
-Exif, timestamps, private chunks) fails verification. The harness writers drop
-those chunks before writing a frame.
+A screenshot is a PNG or, at a path ending `.webp`, a lossless WebP. A PNG
+screenshot is non-interlaced, its first chunk is a 13-byte IHDR, its IEND is
+empty, and it holds image data only. A chunk outside IHDR, PLTE, IDAT, IEND,
+tRNS, cHRM, gAMA, sBIT, sRGB, pHYs and bKGD (text chunks, ICC profiles, Exif,
+timestamps, private chunks) fails verification. The harness writers drop those
+chunks before writing a frame. A WebP screenshot is the simple lossless form: a
+RIFF container holding one VP8L chunk that ends the file, with version 0 and
+dimensions under the PNG pixel cap. The extended form (VP8X), which carries Exif,
+XMP, ICC profiles and animation, fails verification. Verify reads a WebP's
+structure without decoding its pixels, so a WebP frame is always full-fidelity
+evidence: only a PNG in the redactor's shape counts as blurred. Earlier humanish
+versions do not accept WebP screenshots. A computer-use participant writes each
+frame as PNG during its session. When the session ends, its trace references
+the lossless WebP of each frame encoded by then in place of its PNG, and the run
+removes those PNGs once its final bundle is written. A study that blurs its
+screenshots keeps PNG frames, and an interrupted run can hold both files of a
+frame, with run.json's live trace naming the PNG.
 
 The public-safety scan classifies a run file by its bytes, not its name. It scans
 a file for secret and path patterns only when the bytes are strict UTF-8 with no
@@ -1175,7 +1187,8 @@ Its `derivation.json` uses schema `humanish.redacted-derivation.v1` and records:
   rows, sorted by path using JavaScript string order;
 - `files[]`: source-relative `path`, `sourceSha256`, action (`copied`, `updated`,
   `blurred`, or `omitted`), and `outputSha256` for retained files or a reason for
-  omission;
+  omission; `outputPath` when the copy holds the file at another path, as it does a
+  WebP frame;
 - `generated[]`: paths and SHA256s of rebuilt Observer projections.
 
 The receipt describes the transformation; it does not attest that a participant's
@@ -1195,11 +1208,16 @@ An id that appears only in free text, in a run with no receipts, is not known to
 export. `sandbox-receipts.ndjson` is omitted, and the source keeps its raw ids,
 which reclaim reads.
 
-PNG files that actor traces reference as stream screenshots are re-encoded as
-blurred thumbnails. A PNG that nothing in `run.json` cites is omitted and
-inventoried. Export refuses a run whose feedback candidates, adapter artifacts or
-stream artifact entries cite a PNG that is not a stream screenshot, since verify
-cannot read that image and dropping it would change the evidence.
+PNG and WebP files that actor traces reference as stream screenshots are
+re-encoded as blurred PNG thumbnails. A WebP frame's thumbnail is written at the
+same path ending `.png`, and the copy's actor traces, stream artifacts, feedback
+evidence and adapter artifacts name that path. Export refuses a run that already
+holds a file at that path, and a run whose other copied text names the WebP frame,
+since the copy could not resolve that reference. An image that nothing in
+`run.json` cites is omitted and inventoried. Export refuses a run whose feedback
+candidates, adapter artifacts or stream artifact entries cite an image that is not
+a stream screenshot, since verify cannot read that image and dropping it would
+change the evidence.
 Known actor screenshot declarations describe export-time blur while retaining the
 original redaction notes. Observer is rebuilt; old feedback outputs, local process
 status and the operational sandbox journal are omitted and inventoried. A derivative