humanish 0.15.0 → 0.15.2

package/dist/run.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { lstat, readdir, readFile, realpath, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
@@ -8,17 +8,19 @@ import { parse as parseYaml } from "yaml";
 // (moved there so the actor registry can reuse it without a run.ts import cycle). This file
 // keeps the `run --app-url` orchestration; behavior is byte-identical.
 import { browserSurfaces, builtinBrowserPersonaJourney, captureBrowserSurface, normalizeLocalAppUrl, parseBrowserPersonaJourneyFromScenario, resolveBrowserCommand } from "./scripted-browser-actor.js";
-import { CODEX_APP_SERVER_TRACE_SCHEMA } from "./codex-app-server.js";
+import { CODEX_APP_SERVER_TRACE_SCHEMA, runCodexAppServerSessionInPreparedRoot } from "./codex-app-server.js";
 import { getActor } from "./actor-registry.js";
 import { artifactReferenceIfWritten, hasWrittenScreenshot } from "./artifact-reference.js";
 import { ACTOR_TRACE_SCHEMA } from "./actor-contract.js";
 import { captureGitState, GIT_STATE_SCHEMA } from "./core/git-state.js";
+import { inspectVerifiedGitWorkspace } from "./core/git-workspace.js";
 import { mapWithConcurrency } from "./concurrency.js";
 import { screenshotEvidenceError } from "./image-evidence.js";
 import { buildObserverData } from "./observer-data.js";
 import { parseResolvedPersona, personaToDirectives, renderPersonaPromptSection } from "./persona.js";
 import { containsSensitive, digestText, redactText, redactToSecretLabel, tailText } from "./redaction.js";
-import { loadE2BDesktopModule } from "./e2b-desktop-launch.js";
+import { bindExistingRunArtifactPaths, RUNS_RELATIVE_ROOT, isSafeRunIdSegment, prepareRunArtifactPaths, resolveExistingRunDirectory, resolveLatestRunDirectory, resolveRunsRoot, validatePreparedRunArtifactPaths } from "./run-paths.js";
+import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, bindExistingManagedHumanishOutputDirectory, prepareContainedOutputDirectory, prepareContainedOutputDirectoryRoot, prepareContainedOutputFile, prepareSelectedOutputDirectory, readContainedRegularFile, writeContainedOutputFile, writePreparedRunLatestPointer } from "./selected-output-paths.js";
 export const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v1";
 export const SHARED_WORLD_SCHEMA = "humanish.shared-world.v1";
 export const REVIEW_SCHEMA = "humanish.review.v1";
@@ -29,8 +31,17 @@ export const CLEANUP_SCHEMA = "humanish.cleanup-result.v1";
 export const PUBLIC_TARGET_CWD = "[target-cwd]";
 const SAFE_GIT_NOTES = new Set([
     "Git command could not be started.",
+    "Git HEAD capture timed out.",
+    "Git HEAD command could not be started.",
+    "Git metadata could not be inspected safely.",
     "Git status command could not be captured.",
     "Git status command could not be started.",
+    "Git status could not be captured.",
+    "Git status capture timed out.",
+    "Git metadata failed containment validation.",
+    "Git ref-state capture timed out.",
+    "Git ref-state command could not be started.",
+    "Git work-tree detection timed out.",
     "Git work tree had changes; only counts were captured, not branch names, remotes, paths, or file names.",
     "Git work tree was clean; branch names, remotes, paths, and file names were not captured.",
     "No git work tree was detected.",
@@ -102,6 +113,7 @@ export async function runDryRun(options) {
             }
         };
     }
+    const projectRoot = await prepareSelectedOutputDirectory(path.dirname(cwd), cwd);
     if (options.appUrl !== undefined) {
         if (options.dryRun) {
             return {
@@ -127,18 +139,18 @@ export async function runDryRun(options) {
                 }
             };
         }
-        return runBrowserAppProof({ ...options, appUrl: options.appUrl, cwd, simCount });
+        return runBrowserAppProof({ ...options, appUrl: options.appUrl, cwd, projectRoot, simCount });
     }
     if (!options.dryRun) {
         const actor = resolveRequestedLocalCodexActor(options.actor);
         if (actor === "codex-tui") {
-            return runLocalCodexTui({ ...options, actor, cwd, simCount });
+            return runLocalCodexTui({ ...options, actor, cwd, projectRoot, simCount });
         }
         if (actor === "codex-exec") {
-            return runLocalCodexExec({ ...options, actor, cwd, simCount });
+            return runLocalCodexExec({ ...options, actor, cwd, projectRoot, simCount });
         }
         if (actor === "codex-app-server") {
-            return runLocalCodexAppServer({ ...options, actor, cwd, simCount });
+            return runLocalCodexAppServer({ ...options, actor, cwd, projectRoot, simCount });
         }
         return {
             schema: "humanish.run-result.v1",
@@ -154,12 +166,13 @@ export async function runDryRun(options) {
     const now = new Date();
     const createdAt = now.toISOString();
     const runId = options.runId ?? `dryrun-${createdAt.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
-    const artifactRoot = path.join(".humanish", "runs", runId);
-    const absoluteArtifactRoot = path.join(cwd, artifactRoot);
-    const packageName = await readPackageName(cwd);
-    const humanishSource = await directoryExists(path.join(cwd, "humanish")) ? "present" : "missing";
+    const packageName = await readPackageName(projectRoot);
+    const humanishSource = await implicitProjectDirectoryExists(projectRoot, "humanish") ? "present" : "missing";
     const source = await buildRunSource({ cwd, capturedAt: createdAt, humanishSource, packageName });
-    const selection = await loadDryRunSelection(cwd, humanishSource);
+    const selection = await loadDryRunSelection(projectRoot, humanishSource);
+    await assertPreparedSelectedOutputDirectory(projectRoot);
+    const runPaths = await prepareRunArtifactPaths(cwd, runId);
+    const artifactRoot = runPaths.relativeRunRoot;
     if (humanishSource === "missing") {
         warnings.push("Committed humanish/ source was not found; using built-in synthetic dry-run defaults.");
     }
@@ -220,14 +233,13 @@ export async function runDryRun(options) {
         review: createReviewSummary(),
         feedbackCandidates: []
     };
-    await mkdir(absoluteArtifactRoot, { recursive: true });
-    await writeRunBundleArtifacts(absoluteArtifactRoot, bundle);
-    await writeJson(path.join(cwd, ".humanish", "runs", "latest.json"), {
+    await writeRunBundleArtifacts(runPaths, bundle);
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId,
         path: artifactRoot,
         updatedAt: createdAt
-    });
+    }, null, 2)}\n`, "utf8");
     return {
         schema: "humanish.run-result.v1",
         ok: true,
@@ -238,7 +250,7 @@ export async function runDryRun(options) {
         artifactRoot,
         bundlePath: path.join(artifactRoot, "run.json"),
         reviewPath: path.join(artifactRoot, "review.md"),
-        latestPath: path.join(".humanish", "runs", "latest.json"),
+        latestPath: runPaths.relativeLatestPointer,
         warnings
     };
 }
@@ -273,12 +285,13 @@ async function runBrowserAppProof(options) {
     const now = new Date();
     const createdAt = now.toISOString();
     const runId = options.runId ?? `browser-${createdAt.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
-    const artifactRoot = path.join(".humanish", "runs", runId);
-    const absoluteArtifactRoot = path.join(options.cwd, artifactRoot);
-    const packageName = await readPackageName(options.cwd);
-    const humanishSource = await directoryExists(path.join(options.cwd, "humanish")) ? "present" : "missing";
+    const packageName = await readPackageName(options.projectRoot);
+    const humanishSource = await implicitProjectDirectoryExists(options.projectRoot, "humanish") ? "present" : "missing";
     const source = await buildRunSource({ cwd: options.cwd, capturedAt: createdAt, humanishSource, packageName });
-    const selection = await loadDryRunSelection(options.cwd, humanishSource);
+    const selection = await loadDryRunSelection(options.projectRoot, humanishSource);
+    await assertPreparedSelectedOutputDirectory(options.projectRoot);
+    const runPaths = await prepareRunArtifactPaths(options.cwd, runId);
+    const artifactRoot = runPaths.relativeRunRoot;
     if (selection.browserJourneyFailure) {
         return {
             schema: "humanish.run-result.v1",
@@ -299,17 +312,18 @@ async function runBrowserAppProof(options) {
         warnings.push("No executable browser scenario manifest was found; using built-in browser persona two-step journey.");
     }
     warnings.push(...selection.warnings);
-    await mkdir(path.join(absoluteArtifactRoot, "screenshots"), { recursive: true });
-    await mkdir(path.join(absoluteArtifactRoot, "traces"), { recursive: true });
+    await prepareContainedOutputDirectory(runPaths, "screenshots");
+    await prepareContainedOutputDirectory(runPaths, "traces");
     const surfaces = browserSurfaces.slice(0, options.simCount);
     const captures = await Promise.all(surfaces.map((surface) => captureBrowserSurface({
-        absoluteArtifactRoot,
+        absoluteArtifactRoot: runPaths,
         appUrl,
         browserCommand,
         browserJourney,
         surface,
         timeoutMs: options.timeoutMs ?? BROWSER_APP_DEFAULT_TIMEOUT_MS
     })));
+    await validatePreparedRunArtifactPaths(runPaths);
     const completedAt = new Date().toISOString();
     const events = buildBrowserAppEvents({ appUrl, captures, createdAt });
     const allPassed = captures.every((capture) => capture.ok);
@@ -445,13 +459,13 @@ async function runBrowserAppProof(options) {
         review,
         feedbackCandidates: []
     };
-    await writeRunBundleArtifacts(absoluteArtifactRoot, bundle);
-    await writeJson(path.join(options.cwd, ".humanish", "runs", "latest.json"), {
+    await writeRunBundleArtifacts(runPaths, bundle);
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId,
         path: artifactRoot,
         updatedAt: completedAt
-    });
+    }, null, 2)}\n`, "utf8");
     return {
         schema: "humanish.run-result.v1",
         ok: allPassed,
@@ -462,7 +476,7 @@ async function runBrowserAppProof(options) {
         artifactRoot,
         bundlePath: path.join(artifactRoot, "run.json"),
         reviewPath: path.join(artifactRoot, "review.md"),
-        latestPath: path.join(".humanish", "runs", "latest.json"),
+        latestPath: runPaths.relativeLatestPointer,
         warnings,
         ...(allPassed
             ? {}
@@ -577,15 +591,28 @@ async function runLocalCodexTui(options) {
     const now = new Date();
     const createdAt = now.toISOString();
     const runId = options.runId ?? `codex-tui-${createdAt.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
-    const artifactRoot = path.join(".humanish", "runs", runId);
-    const absoluteArtifactRoot = path.join(options.cwd, artifactRoot);
-    const transcriptPath = path.join(absoluteArtifactRoot, "transcripts", "codex-tui-sanitized.txt");
-    const actorTracePath = path.join(absoluteArtifactRoot, "actor.json");
-    const eventsPath = path.join(absoluteArtifactRoot, "events.ndjson");
-    const packageName = await readPackageName(options.cwd);
-    const humanishSource = await directoryExists(path.join(options.cwd, "humanish")) ? "present" : "missing";
-    const source = await buildRunSource({ cwd: options.cwd, capturedAt: createdAt, humanishSource, packageName });
-    const selection = await loadDryRunSelection(options.cwd, humanishSource);
+    const usesDefaultCodexCommand = options.actorCommand === undefined && process.env.HUMANISH_CODEX_ACTOR_COMMAND === undefined;
+    const trustPreflight = usesDefaultCodexCommand ? await checkCodexWorkspaceTrust(options.cwd) : { ok: true };
+    const packageName = await readPackageName(options.projectRoot);
+    const humanishSource = await implicitProjectDirectoryExists(options.projectRoot, "humanish") ? "present" : "missing";
+    const source = !trustPreflight.ok && trustPreflight.unsafeMetadata
+        ? {
+            packageName,
+            humanishSource,
+            git: {
+                schema: GIT_STATE_SCHEMA,
+                status: "unavailable",
+                capturedAt: createdAt,
+                head: { shortSha: null, refState: "unknown" },
+                changes: { staged: 0, unstaged: 0, untracked: 0, total: 0 },
+                note: "Git metadata failed containment validation."
+            }
+        }
+        : await buildRunSource({ cwd: options.cwd, capturedAt: createdAt, humanishSource, packageName });
+    const selection = await loadDryRunSelection(options.projectRoot, humanishSource);
+    await assertPreparedSelectedOutputDirectory(options.projectRoot);
+    const runPaths = await prepareRunArtifactPaths(options.cwd, runId);
+    const artifactRoot = runPaths.relativeRunRoot;
     if (humanishSource === "missing") {
         warnings.push("Committed humanish/ source was not found; using built-in synthetic local actor defaults.");
     }
@@ -594,7 +621,6 @@ async function runLocalCodexTui(options) {
     const prompt = buildLocalCodexTuiPrompt(selection, verdictNonce);
     const promptDigest = digestText(prompt);
     const command = resolveLocalCodexTuiCommand(options.cwd, prompt, options.actorCommand);
-    const usesDefaultCodexCommand = options.actorCommand === undefined && process.env.HUMANISH_CODEX_ACTOR_COMMAND === undefined;
     const simId = "sim-01";
     const streamId = "sim-01-codex-tui";
     const events = [];
@@ -608,11 +634,9 @@ async function runLocalCodexTui(options) {
             simId,
             streamId
         });
-        await writeFile(eventsPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+        await writeContainedOutputFile(runPaths, "events.ndjson", `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
     };
-    await mkdir(path.dirname(transcriptPath), { recursive: true });
     let actor;
-    const trustPreflight = usesDefaultCodexCommand ? await checkCodexWorkspaceTrust(options.cwd) : { ok: true };
     if (!trustPreflight.ok) {
         actor = {
             durationMs: 0,
@@ -719,19 +743,20 @@ async function runLocalCodexTui(options) {
             review: createLocalActorRunningReviewSummary("Codex TUI"),
             feedbackCandidates: []
         };
-        await writeRunBundleArtifacts(absoluteArtifactRoot, runningBundle);
-        await writeJson(path.join(options.cwd, ".humanish", "runs", "latest.json"), {
+        await writeRunBundleArtifacts(runPaths, runningBundle);
+        await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
             schema: "humanish.latest-run.v1",
             runId,
             path: artifactRoot,
             updatedAt: runningAt
-        });
+        }, null, 2)}\n`, "utf8");
         actor = await executeLocalActorCommand(command, {
             cwd: options.cwd,
             timeoutMs,
             verdictNonce
         });
     }
+    await validatePreparedRunArtifactPaths(runPaths);
     const completedAt = new Date().toISOString();
     const redactedTranscript = redactSensitiveText(actor.transcript);
     const tail = tailText(redactedTranscript, 6_000);
@@ -741,8 +766,8 @@ async function runLocalCodexTui(options) {
     // block the reason embeds the absolute workspace path; the live CLI reason can
     // still show the real path, but the public-safe bundle must not.
     const verdictReason = redactSensitiveText(actor.reason);
-    await writeFile(transcriptPath, redactedTranscript.length > 0 ? redactedTranscript : "No transcript output captured.\n", "utf8");
-    await writeJson(actorTracePath, {
+    await writeContainedOutputFile(runPaths, "transcripts/codex-tui-sanitized.txt", redactedTranscript.length > 0 ? redactedTranscript : "No transcript output captured.\n", "utf8");
+    await writeContainedOutputFile(runPaths, "actor.json", `${JSON.stringify({
         schema: "humanish.local-codex-tui-actor.v1",
         actor: "codex-tui",
         commandName: command.name,
@@ -758,7 +783,7 @@ async function runLocalCodexTui(options) {
         transcriptBytes: actor.transcriptBytes,
         transcriptPath: "transcripts/codex-tui-sanitized.txt",
         redaction: "passed"
-    });
+    }, null, 2)}\n`, "utf8");
     await appendEvent("actor.observation", `Captured ${actor.transcriptBytes} output byte${actor.transcriptBytes === 1 ? "" : "s"}; sanitized transcript tail recorded with redaction=passed.`);
     await appendEvent("actor.artifact", "Wrote sanitized Codex TUI transcript and actor trace artifacts under the ignored run directory.");
     await appendEvent("actor.verdict", `Local Codex TUI actor verdict ${status}: ${verdictReason}`, status === "passed" ? "info" : status === "timed_out" ? "warn" : "error");
@@ -862,13 +887,13 @@ async function runLocalCodexTui(options) {
         review: createLocalActorReviewSummary("Codex TUI", status, verdictReason),
         feedbackCandidates: []
     };
-    await writeRunBundleArtifacts(absoluteArtifactRoot, bundle);
-    await writeJson(path.join(options.cwd, ".humanish", "runs", "latest.json"), {
+    await writeRunBundleArtifacts(runPaths, bundle);
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId,
         path: artifactRoot,
         updatedAt: completedAt
-    });
+    }, null, 2)}\n`, "utf8");
     return {
         schema: "humanish.run-result.v1",
         ok: status === "passed",
@@ -879,7 +904,7 @@ async function runLocalCodexTui(options) {
         artifactRoot,
         bundlePath: path.join(artifactRoot, "run.json"),
         reviewPath: path.join(artifactRoot, "review.md"),
-        latestPath: path.join(".humanish", "runs", "latest.json"),
+        latestPath: runPaths.relativeLatestPointer,
         warnings,
         ...(status === "passed"
             ? {}
@@ -996,13 +1021,13 @@ async function runLocalCodexExec(options) {
     const now = new Date();
     const createdAt = now.toISOString();
     const runId = options.runId ?? `codex-exec-${createdAt.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
-    const artifactRoot = path.join(".humanish", "runs", runId);
-    const absoluteArtifactRoot = path.join(options.cwd, artifactRoot);
-    const eventsPath = path.join(absoluteArtifactRoot, "events.ndjson");
-    const packageName = await readPackageName(options.cwd);
-    const humanishSource = await directoryExists(path.join(options.cwd, "humanish")) ? "present" : "missing";
+    const packageName = await readPackageName(options.projectRoot);
+    const humanishSource = await implicitProjectDirectoryExists(options.projectRoot, "humanish") ? "present" : "missing";
     const source = await buildRunSource({ cwd: options.cwd, capturedAt: createdAt, humanishSource, packageName });
-    const selection = await loadDryRunSelection(options.cwd, humanishSource);
+    const selection = await loadDryRunSelection(options.projectRoot, humanishSource);
+    await assertPreparedSelectedOutputDirectory(options.projectRoot);
+    const runPaths = await prepareRunArtifactPaths(options.cwd, runId);
+    const artifactRoot = runPaths.relativeRunRoot;
     if (humanishSource === "missing") {
         warnings.push("Committed humanish/ source was not found; using built-in synthetic local actor defaults.");
     }
@@ -1020,15 +1045,12 @@ async function runLocalCodexExec(options) {
             ...(streamId === undefined ? {} : { streamId })
         });
     };
-    await mkdir(path.join(absoluteArtifactRoot, "transcripts"), { recursive: true });
-    await mkdir(path.join(absoluteArtifactRoot, "actors"), { recursive: true });
-    await mkdir(path.join(absoluteArtifactRoot, "observer"), { recursive: true });
-    await writeJson(path.join(options.cwd, ".humanish", "runs", "latest.json"), {
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId,
         path: artifactRoot,
         updatedAt: createdAt
-    });
+    }, null, 2)}\n`, "utf8");
     const lanes = Array.from({ length: options.simCount }, (_, index) => {
         const focus = localCodexExecFocus(index);
         const simId = `sim-${String(index + 1).padStart(2, "0")}`;
@@ -1047,7 +1069,7 @@ async function runLocalCodexExec(options) {
     for (const lane of lanes) {
         pushEvent("actor.running", "Published local Codex exec running snapshot for Observer polling.", "info", lane.simId, lane.streamId);
     }
-    await writeFile(eventsPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
     const baseLifecycle = [
         {
             at: createdAt,
@@ -1099,7 +1121,7 @@ async function runLocalCodexExec(options) {
         events,
         review: createLocalActorRunningReviewSummary(options.simCount === 1 ? "Codex exec" : "Codex exec fanout")
     });
-    await writeRunBundleArtifacts(absoluteArtifactRoot, runningBundle);
+    await writeRunBundleArtifacts(runPaths, runningBundle);
     const laneResults = await mapWithConcurrency(lanes, maxConcurrency, async (lane) => {
         const actor = await executeLocalActorCommand(lane.command, {
             cwd: options.cwd,
@@ -1112,30 +1134,12 @@ async function runLocalCodexExec(options) {
             ? "transcripts/codex-exec-sanitized.jsonl"
             : `transcripts/${lane.streamId}-sanitized.jsonl`;
         const tracePath = options.simCount === 1 ? "actor.json" : `actors/${lane.streamId}.json`;
-        await writeFile(path.join(absoluteArtifactRoot, transcriptPath), redactedTranscript.length > 0 ? redactedTranscript : "No transcript output captured.\n", "utf8");
-        await writeJson(path.join(absoluteArtifactRoot, tracePath), {
-            schema: "humanish.local-codex-exec-actor.v1",
-            actor: "codex-exec",
-            commandName: lane.command.name,
-            focusId: lane.focus.id,
-            promptDigest: lane.promptDigest,
-            verdictNonce,
-            startedAt: createdAt,
-            completedAt: new Date().toISOString(),
-            durationMs: actor.durationMs,
-            exitCode: actor.exitCode,
-            signal: actor.signal,
-            status: actor.status,
-            timeoutMs,
-            transcriptBytes: actor.transcriptBytes,
-            transcriptPath,
-            redaction: "passed"
-        });
         return {
             actor,
             command: lane.command,
             focus: lane.focus,
             promptDigest: lane.promptDigest,
+            redactedTranscript,
             simId: lane.simId,
             streamId: lane.streamId,
             tail,
@@ -1144,6 +1148,28 @@ async function runLocalCodexExec(options) {
         };
     });
     const completedAt = new Date().toISOString();
+    await validatePreparedRunArtifactPaths(runPaths);
+    for (const result of laneResults) {
+        await writeContainedOutputFile(runPaths, result.transcriptPath, result.redactedTranscript.length > 0 ? result.redactedTranscript : "No transcript output captured.\n", "utf8");
+        await writeContainedOutputFile(runPaths, result.tracePath, `${JSON.stringify({
+            schema: "humanish.local-codex-exec-actor.v1",
+            actor: "codex-exec",
+            commandName: result.command.name,
+            focusId: result.focus.id,
+            promptDigest: result.promptDigest,
+            verdictNonce,
+            startedAt: createdAt,
+            completedAt,
+            durationMs: result.actor.durationMs,
+            exitCode: result.actor.exitCode,
+            signal: result.actor.signal,
+            status: result.actor.status,
+            timeoutMs,
+            transcriptBytes: result.actor.transcriptBytes,
+            transcriptPath: result.transcriptPath,
+            redaction: "passed"
+        }, null, 2)}\n`, "utf8");
+    }
     const laneStatuses = laneResults.map((result) => result.actor.status);
     const status = aggregateActorStatus(laneStatuses);
     const verdictReason = options.simCount === 1
@@ -1157,7 +1183,7 @@ async function runLocalCodexExec(options) {
             ? `Actor timed out after ${timeoutMs}ms; last safe observation retained.`
             : `Actor exited with code ${result.actor.exitCode ?? "null"}${result.actor.signal ? ` and signal ${result.actor.signal}` : ""}.`, result.actor.status === "passed" ? "info" : "warn", result.simId, result.streamId);
     }
-    await writeFile(eventsPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
     const bundle = buildLocalCodexExecBundle({
         runId,
         simCount: options.simCount,
@@ -1200,7 +1226,13 @@ async function runLocalCodexExec(options) {
         events,
         review: createLocalActorReviewSummary(options.simCount === 1 ? "Codex exec" : "Codex exec fanout", status, verdictReason)
     });
-    await writeRunBundleArtifacts(absoluteArtifactRoot, bundle);
+    await writeRunBundleArtifacts(runPaths, bundle);
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
+        schema: "humanish.latest-run.v1",
+        runId,
+        path: artifactRoot,
+        updatedAt: completedAt
+    }, null, 2)}\n`, "utf8");
     return {
         schema: "humanish.run-result.v1",
         ok: status === "passed",
@@ -1211,7 +1243,7 @@ async function runLocalCodexExec(options) {
         artifactRoot,
         bundlePath: path.join(artifactRoot, "run.json"),
         reviewPath: path.join(artifactRoot, "review.md"),
-        latestPath: path.join(".humanish", "runs", "latest.json"),
+        latestPath: runPaths.relativeLatestPointer,
         warnings,
         ...(status === "passed"
             ? {}
@@ -1342,13 +1374,13 @@ async function runLocalCodexAppServer(options) {
     const now = new Date();
     const createdAt = now.toISOString();
     const runId = options.runId ?? `codex-app-server-${createdAt.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
-    const artifactRoot = path.join(".humanish", "runs", runId);
-    const absoluteArtifactRoot = path.join(options.cwd, artifactRoot);
-    const eventsPath = path.join(absoluteArtifactRoot, "events.ndjson");
-    const packageName = await readPackageName(options.cwd);
-    const humanishSource = await directoryExists(path.join(options.cwd, "humanish")) ? "present" : "missing";
+    const packageName = await readPackageName(options.projectRoot);
+    const humanishSource = await implicitProjectDirectoryExists(options.projectRoot, "humanish") ? "present" : "missing";
     const source = await buildRunSource({ cwd: options.cwd, capturedAt: createdAt, humanishSource, packageName });
-    const selection = await loadDryRunSelection(options.cwd, humanishSource);
+    const selection = await loadDryRunSelection(options.projectRoot, humanishSource);
+    await assertPreparedSelectedOutputDirectory(options.projectRoot);
+    const runPaths = await prepareRunArtifactPaths(options.cwd, runId);
+    const artifactRoot = runPaths.relativeRunRoot;
     if (humanishSource === "missing") {
         warnings.push("Committed humanish/ source was not found; using built-in synthetic Codex app-server actor defaults.");
     }
@@ -1365,14 +1397,12 @@ async function runLocalCodexAppServer(options) {
             ...(streamId === undefined ? {} : { streamId })
         });
     };
-    await mkdir(path.join(absoluteArtifactRoot, "observer"), { recursive: true });
-    await mkdir(path.join(absoluteArtifactRoot, "actors"), { recursive: true });
-    await writeJson(path.join(options.cwd, ".humanish", "runs", "latest.json"), {
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
         schema: "humanish.latest-run.v1",
         runId,
         path: artifactRoot,
         updatedAt: createdAt
-    });
+    }, null, 2)}\n`, "utf8");
     const lanes = Array.from({ length: options.simCount }, (_, index) => {
         const focus = localCodexExecFocus(index);
         const simId = `sim-${String(index + 1).padStart(2, "0")}`;
@@ -1397,7 +1427,7 @@ async function runLocalCodexAppServer(options) {
     for (const lane of lanes) {
         pushEvent("codex-app-server.running", "Published Codex app-server running snapshot for Observer polling.", "info", lane.simId, lane.streamId);
     }
-    await writeFile(eventsPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
     const baseLifecycle = [
         {
             at: createdAt,
@@ -1450,13 +1480,15 @@ async function runLocalCodexAppServer(options) {
         events,
         review: createLocalActorRunningReviewSummary("Codex app-server")
     });
-    await writeRunBundleArtifacts(absoluteArtifactRoot, runningBundle);
+    await writeRunBundleArtifacts(runPaths, runningBundle);
     const laneResults = await mapWithConcurrency(lanes, options.simCount, async (lane) => {
-        const laneRunRoot = lane.prefix ? path.join(absoluteArtifactRoot, lane.prefix) : absoluteArtifactRoot;
-        const result = await getActor("codex-app-server").runSession({
+        const laneRunRoot = lane.prefix
+            ? await prepareContainedOutputDirectoryRoot(runPaths, lane.prefix)
+            : runPaths;
+        const sessionOptions = {
             cwd: options.cwd,
             prompt: lane.prompt,
-            runRoot: laneRunRoot,
+            runRoot: "physicalRunRoot" in laneRunRoot ? laneRunRoot.physicalRunRoot : laneRunRoot.physicalPath,
             timeoutMs,
             ...(options.actorCommand === undefined ? {} : { actorCommand: options.actorCommand }),
             approvalPolicy: "never",
@@ -1464,12 +1496,14 @@ async function runLocalCodexAppServer(options) {
             ...(process.env.HUMANISH_CODEX_APP_SERVER_MODEL ? { model: process.env.HUMANISH_CODEX_APP_SERVER_MODEL } : {}),
             sandbox: readCodexAppServerSandboxFromEnv(),
             serviceName: "humanish"
-        });
+        };
+        const result = await runCodexAppServerSessionInPreparedRoot(sessionOptions, laneRunRoot);
         return {
             lane,
             result: prefixCodexAppServerResultPaths(result, lane.prefix)
         };
     });
+    await validatePreparedRunArtifactPaths(runPaths);
     const completedAt = new Date().toISOString();
     const statuses = laneResults.map((entry) => entry.result.status);
     const status = aggregateActorStatus(statuses);
@@ -1480,7 +1514,7 @@ async function runLocalCodexAppServer(options) {
         pushEvent("codex-app-server.artifact", `Captured ${entry.result.counts.envelopes} app-server envelope${entry.result.counts.envelopes === 1 ? "" : "s"}; trace summary and transcript were redacted before persistence.`, "info", entry.lane.simId, entry.lane.streamId);
         pushEvent("codex-app-server.verdict", `Codex app-server actor lane ${entry.lane.focus.label} verdict ${entry.result.status}: ${entry.result.reason}`, entry.result.status === "passed" ? "info" : entry.result.status === "timed_out" ? "warn" : "error", entry.lane.simId, entry.lane.streamId);
     }
-    await writeFile(eventsPath, `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
     const bundle = buildLocalCodexAppServerBundle({
         runId,
         simCount: options.simCount,
@@ -1523,7 +1557,13 @@ async function runLocalCodexAppServer(options) {
         events,
         review: createLocalActorReviewSummary(options.simCount === 1 ? "Codex app-server" : "Codex app-server fanout", status, verdictReason)
     });
-    await writeRunBundleArtifacts(absoluteArtifactRoot, bundle);
+    await writeRunBundleArtifacts(runPaths, bundle);
+    await writePreparedRunLatestPointer(runPaths, `${JSON.stringify({
+        schema: "humanish.latest-run.v1",
+        runId,
+        path: artifactRoot,
+        updatedAt: completedAt
+    }, null, 2)}\n`, "utf8");
     return {
         schema: "humanish.run-result.v1",
         ok: status === "passed",
@@ -1534,7 +1574,7 @@ async function runLocalCodexAppServer(options) {
         artifactRoot,
         bundlePath: path.join(artifactRoot, "run.json"),
         reviewPath: path.join(artifactRoot, "review.md"),
-        latestPath: path.join(".humanish", "runs", "latest.json"),
+        latestPath: runPaths.relativeLatestPointer,
         warnings,
         ...(status === "passed"
             ? {}
@@ -1934,13 +1974,23 @@ async function checkCodexWorkspaceTrust(cwd) {
     if (process.env.HUMANISH_SKIP_CODEX_TRUST_PREFLIGHT === "1") {
         return { ok: true };
     }
-    const trustRoot = await detectCodexTrustRoot(cwd);
-    if (!trustRoot) {
+    const detected = await detectCodexTrustRoot(cwd);
+    if (!detected) {
         return { ok: true };
     }
+    if (detected.unsafe) {
+        return {
+            ok: false,
+            trustRoot: detected.worktreeRoot,
+            unsafeMetadata: true,
+            message: `Codex workspace trust preflight blocked local TUI launch; Git worktree metadata failed containment validation: ${detected.worktreeRoot}`,
+            recoveryCommand: `codex --no-alt-screen -C ${shellQuote(detected.worktreeRoot)}`
+        };
+    }
+    const trustRoot = detected.trustRoot;
     const configPath = path.join(process.env.CODEX_HOME ?? path.join(os.homedir(), ".codex"), "config.toml");
     const configText = await readTextIfExists(configPath);
-    if (configText && codexConfigTrustsProject(configText, trustRoot)) {
+    if (configText && await codexConfigTrustsProject(configText, trustRoot)) {
         return { ok: true };
     }
     return {
@@ -1951,42 +2001,16 @@ async function checkCodexWorkspaceTrust(cwd) {
     };
 }
 async function detectCodexTrustRoot(cwd) {
-    const worktreeRoot = await findGitWorktreeRoot(cwd);
-    if (!worktreeRoot) {
+    const inspection = await inspectVerifiedGitWorkspace(cwd);
+    if (inspection.status === "missing") {
         return null;
     }
-    const dotGitPath = path.join(worktreeRoot, ".git");
-    if (await directoryExists(dotGitPath)) {
-        return worktreeRoot;
-    }
-    const gitFile = await readTextIfExists(dotGitPath);
-    if (!gitFile?.startsWith("gitdir:")) {
-        return worktreeRoot;
-    }
-    const gitDir = gitFile.slice("gitdir:".length).trim();
-    const absoluteGitDir = path.isAbsolute(gitDir) ? gitDir : path.resolve(worktreeRoot, gitDir);
-    const commonDirText = await readTextIfExists(path.join(absoluteGitDir, "commondir"));
-    if (!commonDirText) {
-        return worktreeRoot;
-    }
-    const commonDir = commonDirText.trim();
-    const absoluteCommonDir = path.resolve(absoluteGitDir, commonDir);
-    return path.basename(absoluteCommonDir) === ".git" ? path.dirname(absoluteCommonDir) : worktreeRoot;
-}
-async function findGitWorktreeRoot(cwd) {
-    let current = path.resolve(cwd);
-    while (true) {
-        if (await fileExists(path.join(current, ".git")) || await directoryExists(path.join(current, ".git"))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            return null;
-        }
-        current = parent;
+    if (inspection.status === "unsafe") {
+        return { unsafe: true, worktreeRoot: inspection.worktreeRoot };
     }
+    return { unsafe: false, trustRoot: inspection.workspace.trustRoot };
 }
-function codexConfigTrustsProject(configText, trustRoot) {
+async function codexConfigTrustsProject(configText, trustRoot) {
     const sectionPattern = /^\[projects\."((?:\\.|[^"\\])*)"\]\s*$/gm;
     let sectionMatch;
     while ((sectionMatch = sectionPattern.exec(configText)) !== null) {
@@ -1994,7 +2018,7 @@ function codexConfigTrustsProject(configText, trustRoot) {
         const afterSection = configText.slice(sectionMatch.index + sectionMatch[0].length);
         const nextSectionIndex = afterSection.search(/^\[/m);
         const sectionBody = nextSectionIndex === -1 ? afterSection : afterSection.slice(0, nextSectionIndex);
-        if (/^trust_level\s*=\s*"trusted"\s*$/m.test(sectionBody) && isSamePath(projectPath, trustRoot)) {
+        if (/^trust_level\s*=\s*"trusted"\s*$/m.test(sectionBody) && await isSamePhysicalPath(projectPath, trustRoot)) {
             return true;
         }
     }
@@ -2003,10 +2027,17 @@ function codexConfigTrustsProject(configText, trustRoot) {
 function unescapeTomlString(value) {
     return value.replace(/\\(["\\])/g, "$1");
 }
-function isSamePath(candidatePath, targetPath) {
-    const candidate = path.resolve(candidatePath);
-    const target = path.resolve(targetPath);
-    return candidate === target;
+async function isSamePhysicalPath(candidatePath, targetPath) {
+    try {
+        const [candidate, target] = await Promise.all([
+            realpath(path.resolve(candidatePath)),
+            realpath(path.resolve(targetPath))
+        ]);
+        return candidate === target;
+    }
+    catch {
+        return false;
+    }
 }
 function normalizeActorTimeout(value) {
     if (normalizePositiveInteger(value) === null || value === undefined || value > LOCAL_CODEX_TUI_MAX_TIMEOUT_MS) {
@@ -2251,9 +2282,40 @@ function normalizeSimCount(value) {
 }
 export async function verifyRun(cwdInput, runInput) {
     const cwd = path.resolve(cwdInput);
+    let runPaths;
+    try {
+        runPaths = await resolveRunPath(cwd, runInput);
+    }
+    catch {
+        return invalidRunStorageVerifyResult(cwd, runInput);
+    }
+    return verifyPreparedRun(cwd, runInput, runPaths);
+}
+function invalidRunStorageVerifyResult(cwd, runInput) {
+    return {
+        schema: VERIFY_SCHEMA,
+        ok: false,
+        cwd,
+        run: runInput,
+        checks: [{
+                name: "run storage containment",
+                ok: false,
+                message: "run storage must contain only identity-bound directories and single-link regular files"
+            }],
+        shareSafety: {
+            status: "blocked",
+            reasons: [{ code: "VERIFY_FAILED", message: "Run storage failed containment validation." }]
+        },
+        warnings: [],
+        error: {
+            code: "HUMANISH_INVALID_RUN_BUNDLE",
+            message: "Run storage failed containment validation."
+        }
+    };
+}
+async function verifyPreparedRun(cwd, runInput, runPaths) {
     const checks = [];
-    const resolved = await resolveRunPath(cwd, runInput);
-    if (!resolved) {
+    if (!runPaths) {
         return {
             schema: VERIFY_SCHEMA,
             ok: false,
@@ -2276,11 +2338,11 @@ export async function verifyRun(cwdInput, runInput) {
             }
         };
     }
-    const bundlePath = path.join(resolved, "run.json");
-    const bundle = await readJsonIfExists(bundlePath);
-    const cleanupJson = await readJsonIfExists(path.join(resolved, "cleanup.json"));
-    const reviewJson = await readJsonIfExists(path.join(resolved, "review.json"));
-    const reviewMarkdown = await readTextIfExists(path.join(resolved, "review.md"));
+    const bundlePath = path.join(runPaths.absoluteRunRoot, "run.json");
+    const bundle = await readRunJsonIfExists(runPaths, "run.json");
+    const cleanupJson = await readRunJsonIfExists(runPaths, "cleanup.json");
+    const reviewJson = await readRunJsonIfExists(runPaths, "review.json");
+    const reviewMarkdown = await readRunTextIfExists(runPaths, "review.md");
     checks.push({
         name: "run.json exists",
         ok: bundle !== null,
@@ -2306,7 +2368,7 @@ export async function verifyRun(cwdInput, runInput) {
         ok: reviewJson !== null && reviewMarkdown !== null,
         message: "review.json and review.md must exist"
     });
-    const publicSafetyFindings = await scanRunPublicSafetyArtifacts(resolved);
+    const publicSafetyFindings = await scanRunPublicSafetyArtifacts(runPaths);
     checks.push({
         name: "public-safety scan",
         ok: publicSafetyFindings.length === 0,
@@ -2315,7 +2377,7 @@ export async function verifyRun(cwdInput, runInput) {
             : `public-safety findings: ${publicSafetyFindings.slice(0, 5).join(", ")}`
     });
     const missingEvidenceArtifacts = isRunBundle(bundle)
-        ? await missingLocalEvidenceArtifacts(resolved, bundle)
+        ? await missingLocalEvidenceArtifacts(runPaths, bundle)
         : [];
     const invalidEvidenceReferences = isRunBundle(bundle)
         ? invalidRunEvidenceReferences(bundle)
@@ -2330,7 +2392,7 @@ export async function verifyRun(cwdInput, runInput) {
                 : `missing local evidence artifacts: ${missingEvidenceArtifacts.join(", ")}`
     });
     const terminalProductFindings = isRunBundle(bundle)
-        ? await validateTerminalProductEvidence(resolved, bundle)
+        ? await validateTerminalProductEvidence(runPaths, bundle)
         : [];
     checks.push({
         name: "terminal-product evidence",
@@ -2340,7 +2402,7 @@ export async function verifyRun(cwdInput, runInput) {
             : `terminal-product findings: ${terminalProductFindings.join(", ")}`
     });
     const codexAppServerFindings = isRunBundle(bundle)
-        ? await validateCodexAppServerEvidence(resolved, bundle)
+        ? await validateCodexAppServerEvidence(runPaths, bundle)
         : [];
     checks.push({
         name: "codex app-server evidence",
@@ -2435,7 +2497,27 @@ export async function verifyRun(cwdInput, runInput) {
 export async function cleanupRun(cwdInput, runInput, hooks = {}) {
     const cwd = path.resolve(cwdInput);
     const checkedAt = (hooks.now ?? (() => new Date()))().toISOString();
-    const resolved = await resolveRunPath(cwd, runInput);
+    let resolved;
+    try {
+        resolved = await resolveRunPath(cwd, runInput);
+    }
+    catch {
+        return {
+            schema: CLEANUP_SCHEMA,
+            ok: false,
+            cwd,
+            run: runInput,
+            checkedAt,
+            summary: { resources: 0, killed: 0, alreadyClean: 0, failed: 0, skipped: 0 },
+            resources: [],
+            adapterResults: [],
+            warnings: [],
+            error: {
+                code: "HUMANISH_INVALID_RUN_BUNDLE",
+                message: "Run storage failed containment validation."
+            }
+        };
+    }
     if (!resolved) {
         return {
             schema: CLEANUP_SCHEMA,
@@ -2453,9 +2535,20 @@ export async function cleanupRun(cwdInput, runInput, hooks = {}) {
             }
         };
     }
-    const bundlePath = path.join(resolved, "run.json");
-    const cleanupPath = path.join(resolved, "cleanup.json");
-    const bundle = await readJsonIfExists(bundlePath);
+    const runPaths = resolved;
+    const bundlePath = path.join(runPaths.absoluteRunRoot, "run.json");
+    const cleanupPath = path.join(runPaths.absoluteRunRoot, "cleanup.json");
+    await prepareContainedOutputFile(runPaths, "cleanup.json");
+    const bundleBytes = await readContainedRegularFile(runPaths, "run.json");
+    let bundle = null;
+    if (bundleBytes) {
+        try {
+            bundle = JSON.parse(bundleBytes.toString("utf8"));
+        }
+        catch {
+            bundle = null;
+        }
+    }
     if (!isRunBundle(bundle)) {
         return {
             schema: CLEANUP_SCHEMA,
@@ -2476,7 +2569,6 @@ export async function cleanupRun(cwdInput, runInput, hooks = {}) {
     }
     const resources = [];
     const warnings = [];
-    let desktopModule = null;
     const providerResources = bundle.providerResources ?? [];
     for (const resource of providerResources) {
         if (resource.provider !== "e2b-desktop" || resource.kind !== "sandbox") {
@@ -2499,41 +2591,22 @@ export async function cleanupRun(cwdInput, runInput, hooks = {}) {
             });
             continue;
         }
-        try {
-            desktopModule ??= await (hooks.loadDesktopModule ?? loadE2BDesktopModule)();
-            if (typeof desktopModule.Sandbox.kill !== "function") {
-                resources.push({
-                    provider: resource.provider,
-                    kind: resource.kind,
-                    id: resource.id,
-                    status: "failed",
-                    message: "installed @e2b/desktop SDK does not expose Sandbox.kill"
-                });
-                continue;
-            }
-            await desktopModule.Sandbox.kill(resource.id, { requestTimeoutMs: 60_000 });
-            resources.push({
-                provider: resource.provider,
-                kind: resource.kind,
-                id: resource.id,
-                status: "killed",
-                message: "resource killed by exact recorded id"
-            });
-        }
-        catch (error) {
-            resources.push({
-                provider: resource.provider,
-                kind: resource.kind,
-                id: resource.id,
-                status: "failed",
-                message: error instanceof Error ? error.message : String(error)
-            });
-        }
+        resources.push({
+            provider: resource.provider,
+            kind: resource.kind,
+            id: resource.id,
+            status: "failed",
+            message: "automatic provider cleanup requires a verified resource lease"
+        });
     }
     let adapterResults = [];
     if (hooks.cleanupAdapterResources) {
         try {
-            adapterResults = await hooks.cleanupAdapterResources({ cwd, runDir: resolved, bundle });
+            adapterResults = await hooks.cleanupAdapterResources({
+                cwd,
+                runDir: runPaths.physicalRunRoot,
+                bundle
+            });
         }
         catch (error) {
             adapterResults = [{
@@ -2542,9 +2615,10 @@ export async function cleanupRun(cwdInput, runInput, hooks = {}) {
                     message: error instanceof Error ? error.message : String(error)
                 }];
         }
+        await validatePreparedRunArtifactPaths(runPaths);
     }
     if (providerResources.length === 0 && adapterResults.length === 0) {
-        warnings.push("Run bundle recorded no run-owned provider resources; nothing to clean.");
+        warnings.push("Run bundle recorded no provider resource evidence; nothing to inspect.");
     }
     const summary = {
         resources: resources.length,
@@ -2568,35 +2642,58 @@ export async function cleanupRun(cwdInput, runInput, hooks = {}) {
         adapterResults,
         warnings
     };
-    await writeJson(cleanupPath, result);
+    await validatePreparedRunArtifactPaths(runPaths);
+    await writeContainedOutputFile(runPaths, "cleanup.json", `${JSON.stringify(result, null, 2)}\n`, "utf8");
     return result;
 }
 export async function loadRunBundle(cwdInput, runInput) {
     const cwd = path.resolve(cwdInput);
-    const resolved = await resolveRunPath(cwd, runInput);
-    if (!resolved) {
+    const runPaths = await resolveRunPath(cwd, runInput).catch(() => null);
+    if (!runPaths) {
         return null;
     }
-    const bundlePath = path.join(resolved, "run.json");
-    const bundle = await readJsonIfExists(bundlePath);
+    return loadRunBundlePrepared(cwd, runPaths);
+}
+/** Internal continuity seam for callers that already bound one run identity. */
+export async function loadRunBundlePrepared(cwdInput, runPaths) {
+    const cwd = path.resolve(cwdInput);
+    await validatePreparedRunArtifactPaths(runPaths);
+    const bundlePath = path.join(runPaths.absoluteRunRoot, "run.json");
+    const bundle = await readRunJsonIfExists(runPaths, "run.json");
     if (!isRunBundle(bundle)) {
         return null;
     }
     return {
         bundle,
         bundlePath: path.relative(cwd, bundlePath),
-        runDir: resolved
+        runDir: runPaths.absoluteRunRoot
     };
 }
+/** Internal continuity seam for callers that already bound one run identity. */
+export async function verifyRunPrepared(cwdInput, runInput, runPaths) {
+    const cwd = path.resolve(cwdInput);
+    try {
+        await validatePreparedRunArtifactPaths(runPaths);
+    }
+    catch {
+        return invalidRunStorageVerifyResult(cwd, runInput);
+    }
+    return verifyPreparedRun(cwd, runInput, runPaths);
+}
 export async function listRuns(cwdInput) {
     const cwd = path.resolve(cwdInput);
-    const runsRoot = path.join(cwd, ".humanish", "runs");
+    const runsRootPath = resolveRunsRoot(cwd);
     // ENOENT (no .humanish/runs yet) is a normal empty state: ok:true, no runs. Any
     // other readdir failure (e.g. permission denied) is a real I/O failure and must
     // not be swallowed into a false "no runs" report.
     let entries;
+    let runsRoot = null;
     try {
-        entries = await readdir(runsRoot, { withFileTypes: true });
+        runsRoot = await bindExistingManagedHumanishOutputDirectory(cwd, "runs");
+        entries = runsRoot ? await readdir(runsRoot.physicalPath) : [];
+        if (runsRoot) {
+            await assertPreparedSelectedOutputDirectory(runsRoot);
+        }
     }
     catch (error) {
         if (isNodeError(error) && error.code === "ENOENT") {
@@ -2608,24 +2705,53 @@ export async function listRuns(cwdInput) {
     }
     let latest;
     try {
-        latest = await readLatest(cwd);
+        latest = runsRoot ? await readLatest(runsRoot) : null;
     }
     catch (error) {
         return runsUnavailableResult(cwd, error);
     }
     const runs = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory()) {
+    for (const entryName of entries) {
+        if (entryName === "latest.json" || !isSafeRunIdSegment(entryName)) {
             continue;
         }
-        const bundle = await readJsonIfExists(path.join(runsRoot, entry.name, "run.json"));
+        const entryPath = path.join(runsRootPath, entryName);
+        const entryStats = await lstat(entryPath, { bigint: true }).catch(() => null);
+        if (!entryStats) {
+            continue;
+        }
+        if (entryStats.isSymbolicLink() || (!entryStats.isDirectory() && !entryStats.isFile()) || (entryStats.isFile() && entryStats.nlink > 1n)) {
+            return runsUnavailableResult(cwd, new Error(`Unsafe Humanish runs entry: ${entryName}`));
+        }
+        if (!entryStats.isDirectory()) {
+            continue;
+        }
+        let entryRunPaths;
+        try {
+            entryRunPaths = await bindExistingRunArtifactPaths(cwd, entryName);
+        }
+        catch (error) {
+            return runsUnavailableResult(cwd, error);
+        }
+        if (runsRoot && entryRunPaths.physicalRunsRoot !== runsRoot.physicalPath) {
+            return runsUnavailableResult(cwd, new Error("Humanish runs root changed physical destination."));
+        }
+        const bundle = await readRunJsonIfExists(entryRunPaths, "run.json");
         runs.push({
-            runId: entry.name,
+            runId: entryName,
             createdAt: isRecord(bundle) && typeof bundle.createdAt === "string" ? bundle.createdAt : null,
             mode: isRecord(bundle) && typeof bundle.mode === "string" ? bundle.mode : null,
-            path: path.join(".humanish", "runs", entry.name)
+            path: path.join(RUNS_RELATIVE_ROOT, entryName)
         });
     }
+    if (runsRoot) {
+        try {
+            await assertPreparedSelectedOutputDirectory(runsRoot);
+        }
+        catch (error) {
+            return runsUnavailableResult(cwd, error);
+        }
+    }
     return {
         schema: RUNS_SCHEMA,
         ok: true,
@@ -2648,13 +2774,19 @@ function runsUnavailableResult(cwd, error) {
     };
 }
 export async function readReview(cwdInput, runInput) {
-    const verified = await verifyRun(cwdInput, runInput);
+    const cwd = path.resolve(cwdInput);
+    let runPaths;
+    try {
+        runPaths = await resolveRunPath(cwd, runInput);
+    }
+    catch {
+        return invalidRunStorageVerifyResult(cwd, runInput);
+    }
+    const verified = await verifyPreparedRun(cwd, runInput, runPaths);
     if (!verified.ok || !verified.bundlePath) {
         return verified;
     }
-    const cwd = path.resolve(cwdInput);
-    const runDir = path.dirname(path.join(cwd, verified.bundlePath));
-    const review = await readJsonIfExists(path.join(runDir, "review.json"));
+    const review = runPaths ? await readRunJsonIfExists(runPaths, "review.json") : null;
     if (!isReviewSummary(review)) {
         return {
             ...verified,
@@ -2667,32 +2799,63 @@ export async function readReview(cwdInput, runInput) {
     }
     return {
         ...review,
-        path: path.relative(cwd, path.join(runDir, "review.json")),
-        runId: path.basename(runDir)
+        path: path.relative(cwd, path.join(runPaths.absoluteRunRoot, "review.json")),
+        runId: path.basename(runPaths.absoluteRunRoot)
     };
 }
 export async function doctor(cwdInput) {
     const cwd = path.resolve(cwdInput);
+    const cwdOk = await validateCwd(cwd).then((error) => error === null).catch(() => false);
+    if (!cwdOk) {
+        const checks = [
+            { name: "target cwd", ok: false, message: "target directory exists" },
+            { name: "package.json", ok: false, message: "package.json is present and safe to read" },
+            { name: "humanish source", ok: false, message: "committed humanish/ source directory is present and safe to read" },
+            { name: "runtime ignore", ok: false, message: ".gitignore safely contains .humanish/" }
+        ];
+        return { schema: DOCTOR_SCHEMA, ok: false, cwd, checks };
+    }
+    let projectRoot;
+    try {
+        projectRoot = await prepareSelectedOutputDirectory(path.dirname(cwd), cwd);
+    }
+    catch {
+        const checks = [
+            { name: "target cwd", ok: false, message: "target directory failed containment validation" },
+            { name: "package.json", ok: false, message: "package.json is present and safe to read" },
+            { name: "humanish source", ok: false, message: "committed humanish/ source directory is present and safe to read" },
+            { name: "runtime ignore", ok: false, message: ".gitignore safely contains .humanish/" }
+        ];
+        return { schema: DOCTOR_SCHEMA, ok: false, cwd, checks };
+    }
+    const safeCheck = async (check) => {
+        try {
+            return await check();
+        }
+        catch {
+            return false;
+        }
+    };
     const checks = [
         {
             name: "target cwd",
-            ok: await directoryExists(cwd),
+            ok: true,
             message: "target directory exists"
         },
         {
             name: "package.json",
-            ok: await fileExists(path.join(cwd, "package.json")),
-            message: "package.json is present"
+            ok: await safeCheck(async () => await readImplicitProjectFile(projectRoot, "package.json") !== null),
+            message: "package.json is present and safe to read"
         },
         {
             name: "humanish source",
-            ok: await directoryExists(path.join(cwd, "humanish")),
-            message: "committed humanish/ source directory is present"
+            ok: await safeCheck(() => implicitProjectDirectoryExists(projectRoot, "humanish")),
+            message: "committed humanish/ source directory is present and safe to read"
         },
         {
             name: "runtime ignore",
-            ok: (await readTextIfExists(path.join(cwd, ".gitignore")))?.includes(".humanish/") ?? false,
-            message: ".gitignore contains .humanish/"
+            ok: await safeCheck(async () => (await readImplicitProjectFile(projectRoot, ".gitignore"))?.includes(".humanish/") ?? false),
+            message: ".gitignore safely contains .humanish/"
         }
     ];
     return {
@@ -2749,7 +2912,83 @@ function createLocalActorReviewSummary(actorLabel, status, reason) {
         ]
     };
 }
-async function loadDryRunSelection(cwd, humanishSource) {
+async function inspectImplicitProjectPath(projectRoot, relativePath) {
+    const segments = relativePath.replace(/\\/g, "/").split("/");
+    if (segments.length === 0 || segments.some((segment) => segment.length === 0)) {
+        throw new Error("Implicit project path must be a non-empty relative path.");
+    }
+    await assertPreparedSelectedOutputDirectory(projectRoot);
+    let current = projectRoot.physicalPath;
+    for (const [index, segment] of segments.entries()) {
+        assertSafeOutputPathSegment(segment, "Implicit project path segment");
+        current = path.join(current, segment);
+        let stats;
+        try {
+            stats = await lstat(current, { bigint: true });
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ENOENT") {
+                return null;
+            }
+            throw error;
+        }
+        if (stats.isSymbolicLink()) {
+            throw new Error(`Implicit project path must not contain symbolic links: ${relativePath}`);
+        }
+        if (!stats.isDirectory() && !stats.isFile()) {
+            throw new Error(`Implicit project path must contain only regular files and directories: ${relativePath}`);
+        }
+        if (stats.isFile() && stats.nlink > 1n) {
+            throw new Error(`Implicit project files must be single-link regular files: ${relativePath}`);
+        }
+        if (index < segments.length - 1 && !stats.isDirectory()) {
+            throw new Error(`Implicit project path parent must be a directory: ${relativePath}`);
+        }
+        if (index === segments.length - 1) {
+            await assertPreparedSelectedOutputDirectory(projectRoot);
+            return stats;
+        }
+    }
+    return null;
+}
+async function implicitProjectDirectoryExists(projectRoot, relativePath) {
+    const stats = await inspectImplicitProjectPath(projectRoot, relativePath);
+    if (!stats) {
+        return false;
+    }
+    if (!stats.isDirectory()) {
+        throw new Error(`Implicit project directory has the wrong type: ${relativePath}`);
+    }
+    return true;
+}
+async function readImplicitProjectFile(projectRoot, relativePath) {
+    const stats = await inspectImplicitProjectPath(projectRoot, relativePath);
+    if (!stats) {
+        return null;
+    }
+    if (!stats.isFile() || stats.nlink !== 1n) {
+        throw new Error(`Implicit project file must be a single-link regular file: ${relativePath}`);
+    }
+    const bytes = await readContainedRegularFile(projectRoot, relativePath.replace(/\\/g, "/"));
+    if (!bytes) {
+        throw new Error(`Implicit project file changed while it was being read: ${relativePath}`);
+    }
+    return bytes.toString("utf8");
+}
+async function listImplicitProjectDirectory(projectRoot, relativePath) {
+    if (!await implicitProjectDirectoryExists(projectRoot, relativePath)) {
+        return [];
+    }
+    const directory = path.join(projectRoot.physicalPath, ...relativePath.replace(/\\/g, "/").split("/"));
+    const names = await readdir(directory);
+    await assertPreparedSelectedOutputDirectory(projectRoot);
+    for (const name of names) {
+        assertSafeOutputPathSegment(name, "Implicit project directory entry");
+        await inspectImplicitProjectPath(projectRoot, `${relativePath.replace(/\\/g, "/")}/${name}`);
+    }
+    return names;
+}
+async function loadDryRunSelection(projectRoot, humanishSource) {
     const warnings = [];
     if (humanishSource === "missing") {
         return {
@@ -2761,9 +3000,9 @@ async function loadDryRunSelection(cwd, humanishSource) {
     }
     const personaPath = "humanish/personas/synthetic-new-user.yaml";
     const scenarioPath = "humanish/scenarios/first-run-smoke.yaml";
-    const personaText = await readTextIfExists(path.join(cwd, personaPath));
-    const scenarioText = await readTextIfExists(path.join(cwd, scenarioPath));
-    const browserJourneySelection = await loadBrowserPersonaJourneySelection(cwd);
+    const personaText = await readImplicitProjectFile(projectRoot, personaPath);
+    const scenarioText = await readImplicitProjectFile(projectRoot, scenarioPath);
+    const browserJourneySelection = await loadBrowserPersonaJourneySelection(projectRoot);
     if (personaText === null) {
         warnings.push(`${personaPath} was not found; using built-in persona defaults.`);
     }
@@ -2808,15 +3047,9 @@ async function loadDryRunSelection(cwd, humanishSource) {
         warnings: [...warnings, ...browserJourneySelection.warnings]
     };
 }
-async function loadBrowserPersonaJourneySelection(cwd) {
+async function loadBrowserPersonaJourneySelection(projectRoot) {
     const warnings = [];
-    const scenarioDir = path.join(cwd, "humanish", "scenarios");
-    const names = await readdir(scenarioDir).catch((error) => {
-        if (isNodeError(error) && error.code === "ENOENT") {
-            return [];
-        }
-        throw error;
-    });
+    const names = await listImplicitProjectDirectory(projectRoot, "humanish/scenarios");
     const files = names
         .filter((name) => name.endsWith(".yaml") || name.endsWith(".yml"))
         .sort((left, right) => {
@@ -2828,8 +3061,7 @@ async function loadBrowserPersonaJourneySelection(cwd) {
     });
     for (const name of files) {
         const relativePath = path.join("humanish", "scenarios", name);
-        const absolutePath = path.join(cwd, relativePath);
-        const text = await readTextIfExists(absolutePath);
+        const text = await readImplicitProjectFile(projectRoot, relativePath);
         if (text === null) {
             continue;
         }
@@ -2904,25 +3136,71 @@ function escapeRegExp(value) {
 }
 async function resolveRunPath(cwd, runInput) {
     if (runInput === "latest") {
-        const latest = await readLatest(cwd);
-        return latest ? path.join(cwd, latest.path) : null;
+        const runsRoot = await bindExistingManagedHumanishOutputDirectory(cwd, "runs");
+        if (!runsRoot) {
+            return null;
+        }
+        const latest = await readLatest(runsRoot);
+        const expected = latest ? resolveLatestRunDirectory(cwd, latest) : null;
+        if (!latest || !expected) {
+            return null;
+        }
+        const runPaths = await bindExistingRunArtifactPaths(cwd, latest.runId);
+        if (runPaths.absoluteRunRoot !== expected
+            || runPaths.physicalRunsRoot !== runsRoot.physicalPath) {
+            throw new Error("Latest run pointer changed physical runs root.");
+        }
+        await assertPreparedSelectedOutputDirectory(runsRoot);
+        return runPaths;
+    }
+    if (!isSafeRunIdSegment(runInput) || !await resolveExistingRunDirectory(cwd, runInput)) {
+        return null;
     }
-    const direct = path.join(cwd, ".humanish", "runs", runInput);
-    return await directoryExists(direct) ? direct : null;
+    return bindExistingRunArtifactPaths(cwd, runInput);
 }
-async function readLatest(cwd) {
-    const latest = await readJsonIfExists(path.join(cwd, ".humanish", "runs", "latest.json"));
-    if (isRunPointer(latest)) {
-        return latest;
+async function readLatest(runsRoot) {
+    const latestPath = path.join(runsRoot.physicalPath, "latest.json");
+    let latestStats;
+    try {
+        latestStats = await lstat(latestPath, { bigint: true });
     }
-    return null;
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+    if (latestStats.isSymbolicLink() || !latestStats.isFile() || latestStats.nlink !== 1n) {
+        throw new Error("Latest run pointer must be a single-link regular file.");
+    }
+    const bytes = await readContainedRegularFile(runsRoot, "latest.json");
+    if (!bytes) {
+        throw new Error("Latest run pointer changed while it was being read.");
+    }
+    let latest;
+    try {
+        latest = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    return isRunPointer(latest) ? latest : null;
 }
-async function readPackageName(cwd) {
-    const packageJson = await readJsonIfExists(path.join(cwd, "package.json"));
-    return isRecord(packageJson) && typeof packageJson.name === "string" ? packageJson.name : null;
+async function readPackageName(projectRoot) {
+    const text = await readImplicitProjectFile(projectRoot, "package.json");
+    if (text === null) {
+        return null;
+    }
+    try {
+        const packageJson = JSON.parse(text);
+        return isRecord(packageJson) && typeof packageJson.name === "string" ? packageJson.name : null;
+    }
+    catch {
+        return null;
+    }
 }
-async function readJsonIfExists(filePath) {
-    const text = await readTextIfExists(filePath);
+async function readRunJsonIfExists(runPaths, ...segments) {
+    const text = await readRunTextIfExists(runPaths, ...segments);
     if (text === null) {
         return null;
     }
@@ -2933,6 +3211,33 @@ async function readJsonIfExists(filePath) {
         return null;
     }
 }
+async function readRunTextIfExists(runPaths, ...segments) {
+    const bytes = await readContainedRegularFile(runPaths, segments.join("/"));
+    return bytes?.toString("utf8") ?? null;
+}
+async function readSafeRunArtifactBytes(runPaths, relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/");
+    const segments = normalized.split("/");
+    if (path.isAbsolute(relativePath)
+        || path.win32.isAbsolute(relativePath)
+        || segments.length === 0
+        || segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+        return null;
+    }
+    return readContainedRegularFile(runPaths, normalized);
+}
+async function readSafeRunArtifactJson(runPaths, relativePath) {
+    const bytes = await readSafeRunArtifactBytes(runPaths, relativePath);
+    if (!bytes) {
+        return null;
+    }
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
 async function readTextIfExists(filePath) {
     try {
         return await readFile(filePath, "utf8");
@@ -2944,22 +3249,18 @@ async function readTextIfExists(filePath) {
         throw error;
     }
 }
-async function writeJson(filePath, value) {
-    await writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-}
-async function writeRunBundleArtifacts(absoluteArtifactRoot, bundle) {
+async function writeRunBundleArtifacts(runPaths, bundle) {
     const publicBundle = {
         ...bundle,
         cwd: PUBLIC_TARGET_CWD
     };
-    await writeJson(path.join(absoluteArtifactRoot, "run.json"), publicBundle);
-    await writeJson(path.join(absoluteArtifactRoot, "review.json"), publicBundle.review);
-    await writeFile(path.join(absoluteArtifactRoot, "review.md"), renderReviewMarkdown(publicBundle), "utf8");
-    await writeFile(path.join(absoluteArtifactRoot, "events.ndjson"), `${publicBundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
-    await mkdir(path.join(absoluteArtifactRoot, "observer"), { recursive: true });
-    await writeJson(path.join(absoluteArtifactRoot, "observer", "observer-data.json"), buildObserverData(publicBundle));
-}
-async function missingLocalEvidenceArtifacts(runRoot, bundle) {
+    await writeContainedOutputFile(runPaths, "run.json", `${JSON.stringify(publicBundle, null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "review.json", `${JSON.stringify(publicBundle.review, null, 2)}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "review.md", renderReviewMarkdown(publicBundle), "utf8");
+    await writeContainedOutputFile(runPaths, "events.ndjson", `${publicBundle.events.map((event) => JSON.stringify(event)).join("\n")}\n`, "utf8");
+    await writeContainedOutputFile(runPaths, "observer/observer-data.json", `${JSON.stringify(buildObserverData(publicBundle), null, 2)}\n`, "utf8");
+}
+async function missingLocalEvidenceArtifacts(runPaths, bundle) {
     const requiredPaths = new Map();
     const addRequiredPath = (artifactPath, options = {}) => {
         const existing = requiredPaths.get(artifactPath);
@@ -2990,15 +3291,13 @@ async function missingLocalEvidenceArtifacts(runRoot, bundle) {
     }
     const missing = [];
     for (const [artifactPath, requirements] of requiredPaths) {
-        const absolutePath = path.join(runRoot, artifactPath);
-        const stats = await stat(absolutePath).catch(() => null);
-        if (!stats?.isFile() || stats.size <= 0) {
+        const bytes = await readSafeRunArtifactBytes(runPaths, artifactPath);
+        if (!bytes || bytes.length === 0) {
             missing.push(artifactPath);
             continue;
         }
         if (requirements.screenshot) {
-            const bytes = await readFile(absolutePath).catch(() => null);
-            const imageError = bytes ? screenshotEvidenceError(artifactPath, bytes) : "could not read screenshot bytes";
+            const imageError = screenshotEvidenceError(artifactPath, bytes);
             if (imageError) {
                 missing.push(`${artifactPath} (${imageError})`);
             }
@@ -3060,7 +3359,7 @@ const TERMINAL_TRANSCRIPT_FILE = "terminal-transcript.txt";
  * file is already caught by scanRunPublicSafetyArtifacts; this check enforces the STRUCTURAL
  * evidence + the proven-teardown invariant. Dry-run/contract bundles are exempt (mode !== live).
  */
-async function validateTerminalProductEvidence(runRoot, bundle) {
+async function validateTerminalProductEvidence(runPaths, bundle) {
     if (bundle.mode !== "live") {
         return [];
     }
@@ -3073,7 +3372,7 @@ async function validateTerminalProductEvidence(runRoot, bundle) {
         return findings;
     }
     // The lane writes exactly one terminal run's ledgers/evidence at fixed paths in the run root.
-    const ledgers = await readJsonIfExists(path.join(runRoot, TERMINAL_LEDGERS_FILE));
+    const ledgers = await readSafeRunArtifactJson(runPaths, TERMINAL_LEDGERS_FILE);
     if (!isRecord(ledgers) || ledgers.schema !== "humanish.terminal-ledgers.v1") {
         findings.push(`missing or malformed ${TERMINAL_LEDGERS_FILE} (humanish.terminal-ledgers.v1)`);
         return findings;
@@ -3108,17 +3407,17 @@ async function validateTerminalProductEvidence(runRoot, bundle) {
     // The redacted exec-stream + normalized transcript artifacts must be WRITTEN (the producer
     // always writes them on the live path, even empty for a no-output blocked run — so absence is a
     // real evidence gap, while emptiness is legitimate and keeps blocked runs verifiable).
-    if (!(await fileExists(path.join(runRoot, TERMINAL_EVENTS_FILE)))) {
+    if (!(await readSafeRunArtifactBytes(runPaths, TERMINAL_EVENTS_FILE))) {
         findings.push(`missing terminal event stream artifact (${TERMINAL_EVENTS_FILE})`);
     }
-    if (!(await fileExists(path.join(runRoot, TERMINAL_TRANSCRIPT_FILE)))) {
+    if (!(await readSafeRunArtifactBytes(runPaths, TERMINAL_TRANSCRIPT_FILE))) {
         findings.push(`missing normalized terminal transcript artifact (${TERMINAL_TRANSCRIPT_FILE})`);
     }
     // The provider-neutral actor trace must be on the terminal lane with redaction passed.
     for (const stream of terminalStreams) {
         const traceArtifact = stream.artifacts.find((artifact) => artifact.kind === "trace");
         const tracePath = traceArtifact?.path ?? "actor.json";
-        const trace = await readJsonIfExists(path.join(runRoot, tracePath));
+        const trace = await readSafeRunArtifactJson(runPaths, tracePath);
         if (!isRecord(trace) || trace.lane !== "terminal") {
             findings.push(`${stream.id} missing terminal-lane actor trace`);
             continue;
@@ -3203,7 +3502,7 @@ function validateTerminalCostEvidence(ledgers) {
     }
     return findings;
 }
-async function validateCodexAppServerEvidence(runRoot, bundle) {
+async function validateCodexAppServerEvidence(runPaths, bundle) {
     if (bundle.mode !== "live") {
         return [];
     }
@@ -3228,7 +3527,7 @@ async function validateCodexAppServerEvidence(runRoot, bundle) {
             findings.push(`${stream.id} missing codex app-server trace artifact`);
             continue;
         }
-        const trace = await readJsonIfExists(path.join(runRoot, traceArtifact.path));
+        const trace = await readSafeRunArtifactJson(runPaths, traceArtifact.path);
         if (!isRecord(trace) || ![CODEX_APP_SERVER_TRACE_SCHEMA, CODEX_APP_SERVER_PROJECTED_TRACE_SCHEMA].includes(String(trace.schema))) {
             findings.push(`${stream.id} trace artifact must use ${CODEX_APP_SERVER_TRACE_SCHEMA} or ${CODEX_APP_SERVER_PROJECTED_TRACE_SCHEMA}`);
         }
@@ -3878,34 +4177,46 @@ const riskyPublicArtifactPathSegments = new Set([
     "Secure Preferences",
     "profiles"
 ]);
-async function scanRunPublicSafetyArtifacts(runRoot) {
+async function scanRunPublicSafetyArtifacts(runPaths) {
     const findings = [];
-    await scanRunPublicSafetyDirectory(runRoot, runRoot, findings);
+    await validatePreparedRunArtifactPaths(runPaths);
+    await scanRunPublicSafetyDirectory(runPaths, "", findings);
+    await validatePreparedRunArtifactPaths(runPaths);
     return findings;
 }
-async function scanRunPublicSafetyDirectory(root, current, findings) {
+async function scanRunPublicSafetyDirectory(runPaths, relativeDirectory, findings) {
     if (findings.length >= 50) {
         return;
     }
-    const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
-    for (const entry of entries) {
-        const absolutePath = path.join(current, entry.name);
-        const relativePath = path.relative(root, absolutePath).replace(/\\/g, "/");
+    const current = relativeDirectory
+        ? path.join(runPaths.physicalRunRoot, ...relativeDirectory.split("/"))
+        : runPaths.physicalRunRoot;
+    const entries = await readdir(current).catch(() => []);
+    for (const entryName of entries) {
+        const relativePath = relativeDirectory ? `${relativeDirectory}/${entryName}` : entryName;
         if (isRiskyPublicArtifactPath(relativePath) || containsSensitivePattern(relativePath)) {
             findings.push(`risky artifact path ${relativePath}`);
             if (findings.length >= 50)
                 return;
         }
-        if (entry.isDirectory()) {
-            await scanRunPublicSafetyDirectory(root, absolutePath, findings);
+        const stats = await lstat(path.join(current, entryName), { bigint: true }).catch(() => null);
+        if (!stats || stats.isSymbolicLink() || (!stats.isDirectory() && !stats.isFile()) || (stats.isFile() && stats.nlink > 1n)) {
+            findings.push(`unsafe artifact leaf ${relativePath}`);
+            if (findings.length >= 50)
+                return;
+            continue;
+        }
+        if (stats.isDirectory()) {
+            await scanRunPublicSafetyDirectory(runPaths, relativePath, findings);
             if (findings.length >= 50)
                 return;
             continue;
         }
-        if (!entry.isFile() || !shouldScanTextArtifact(relativePath)) {
+        if (!shouldScanTextArtifact(relativePath)) {
             continue;
         }
-        const text = await readFile(absolutePath, "utf8").catch(() => null);
+        const bytes = await readSafeRunArtifactBytes(runPaths, relativePath);
+        const text = bytes?.toString("utf8") ?? null;
         if (text !== null && containsSensitivePattern(text)) {
             findings.push(`sensitive text ${relativePath}`);
             if (findings.length >= 50)
@@ -3961,28 +4272,6 @@ async function validateCwd(cwd) {
         throw error;
     }
 }
-async function directoryExists(directoryPath) {
-    try {
-        return (await stat(directoryPath)).isDirectory();
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT") {
-            return false;
-        }
-        throw error;
-    }
-}
-async function fileExists(filePath) {
-    try {
-        return (await stat(filePath)).isFile();
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT") {
-            return false;
-        }
-        throw error;
-    }
-}
 function containsSensitivePattern(text) {
     return containsSensitive(text);
 }