humanish 0.57.0 → 0.58.0

package/README.md

@@ -67,6 +67,44 @@ npx skills add danielgwilson/humanish --skill humanish
 The skill lives at [`skills/humanish/SKILL.md`](skills/humanish/SKILL.md)
 for skills.sh discovery.
 
+## A First Live Run Without a Provider API Key
+
+A live study normally needs a provider API key. If you already have a coding
+agent signed in — Codex on a ChatGPT plan, Claude Code on a Max plan — humanish
+can use it as the participant's brain instead, and then the only credential it
+needs is `E2B_API_KEY`.
+
+```bash
+humanish doctor      # says which local agents are installed and signed in
+```
+
+```yaml
+actors:
+  - type: local-agent   # instead of openai-computer-use
+    persona: synthetic-new-user
+    mission: >-
+      ...
+```
+
+humanish never reads those credentials. It checks that the credential file
+**exists**, spawns the CLI tool-restricted (`--sandbox read-only` for Codex,
+`--allowedTools Read` for Claude Code) in a scratch directory, and hands it one
+screenshot per turn. The agent only **decides**; humanish performs the action
+inside the E2B sandbox, so nothing the persona chooses ever runs on your machine.
+
+Three things to know before you rely on it:
+
+- **It is not free.** Subscription usage consumes your own plan. Runs driven this
+  way record `estimatedCostUsd: null` with `reason: "no_token_usage"` rather than
+  `$0`, because `$0` would be untrue. Rate limits on those plans are built for
+  interactive coding; humanish fails closed with the CLI's own message rather
+  than retrying into them.
+- **It is slower.** Roughly 9 seconds per turn against about 3 for a direct API
+  call, so give the lane a longer `execution.timeoutMs` than you would otherwise.
+- **The evidence says which brain ran it.** The trace records
+  `ids.model: "codex (local, operator-authenticated)"`, so a local-agent run is
+  never silently compared against an API one.
+
 ## Public-Safety Boundary
 
 Humanish is designed for public repositories and public issue queues. The

package/dist/actor-registry.d.ts

@@ -6,7 +6,7 @@ import { type ClaudeAgentSessionOptions, type ClaudeAgentSessionResult, type Cla
 import { type CuaActorSessionOptions } from "./computer-use-actor.js";
 import type { CuaLoopResult } from "./computer-use.js";
 import { type ScriptedBrowserSessionOptions, type ScriptedBrowserSessionResult } from "./scripted-browser-actor.js";
-export type ActorId = "codex-app-server" | "pi-agent-core" | "claude-agent-sdk" | "openai-computer-use" | "scripted-browser" | "codex-exec";
+export type ActorId = "codex-app-server" | "pi-agent-core" | "claude-agent-sdk" | "openai-computer-use" | "local-agent" | "scripted-browser" | "codex-exec";
 interface ActorDescriptorBase {
     id: ActorId;
     label: string;
@@ -30,6 +30,10 @@ export interface CuaActorDescriptor extends ActorDescriptorBase {
     id: "openai-computer-use";
     runSession(options: CuaActorSessionOptions): Promise<CuaLoopResult>;
 }
+export interface LocalAgentActorDescriptor extends ActorDescriptorBase {
+    id: "local-agent";
+    runSession(options: CuaActorSessionOptions): Promise<CuaLoopResult>;
+}
 export interface ScriptedBrowserActorDescriptor extends ActorDescriptorBase {
     id: "scripted-browser";
     runSession(options: ScriptedBrowserSessionOptions): Promise<ScriptedBrowserSessionResult>;
@@ -38,7 +42,7 @@ export interface TerminalActorDescriptor extends ActorDescriptorBase {
     id: "codex-exec";
     runSession(options: TerminalAgentSessionOptions): Promise<TerminalAgentSessionResult>;
 }
-export type ActorDescriptor = CodexActorDescriptor | PiActorDescriptor | ClaudeActorDescriptor | CuaActorDescriptor | ScriptedBrowserActorDescriptor | TerminalActorDescriptor;
+export type ActorDescriptor = CodexActorDescriptor | PiActorDescriptor | ClaudeActorDescriptor | CuaActorDescriptor | LocalAgentActorDescriptor | ScriptedBrowserActorDescriptor | TerminalActorDescriptor;
 /**
  * REGISTRY CONTRACT: an actor whose capabilities include the "computer-use" lane is a
  * CuaActorDescriptor — its runSession takes CuaActorSessionOptions and returns a CuaLoopResult.

package/dist/actor-registry.js

@@ -4,6 +4,7 @@ import { runTerminalAgentSession } from "./terminal-agent-actor.js";
 import { piSessionToActorTrace } from "./pi-agent-core.js";
 import { claudeSessionToActorTrace, runClaudeAgentSession } from "./claude-agent-sdk.js";
 import { runCuaActorSession } from "./computer-use-actor.js";
+import { LOCAL_AGENT_CAPABILITIES } from "./local-agent-cli.js";
 import { OPENAI_RESPONSES_CU_CAPABILITIES } from "./openai-responses-cu.js";
 import { runScriptedBrowserSession } from "./scripted-browser-actor.js";
 /**
@@ -58,6 +59,17 @@ export const actorRegistry = {
     },
     // The ActorId names the actor slot (keeps the lane open for a future stagehand-cua provider);
     // the trace's `provider` string stays "openai-responses-cu" (the concrete model adapter).
+    // The operator's own signed-in coding agent as the computer-use brain (Codex on a ChatGPT plan,
+    // Claude Code on a Max plan). Same lane, same loop, same evidence — the only difference is where
+    // the next action comes from, which is exactly why it is a provider swap and not a new lane.
+    // It exists so someone new can watch a persona drive a real desktop without first going to find
+    // an API key; the machine they are on very often already has one of these signed in.
+    "local-agent": {
+        id: "local-agent",
+        label: "Local coding agent (operator-authenticated)",
+        capabilities: LOCAL_AGENT_CAPABILITIES,
+        runSession: runCuaActorSession
+    },
     "openai-computer-use": {
         id: "openai-computer-use",
         label: "OpenAI Computer Use",

package/dist/actor-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"actor-registry.js","sourceRoot":"","sources":["../src/actor-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,EAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA+B,MAAM,yBAAyB,CAAC;AAE1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,yBAAyB,EAG1B,MAAM,6BAA6B,CAAC;AAqErC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B;IAC9D,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAA2B;IAC1E,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAA2B;IACnE,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC7D,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,kBAAkB;QACzB,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,wBAAwB;QACpC,YAAY,EAAE,uBAAuB;KACtC;IACD,eAAe,EAAE;QACf,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,eAAe;QACtB,YAAY,EAAE,0BAA0B;QACxC,YAAY,EAAE,qBAAqB;KACpC;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,kBAAkB;QACzB,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,qBAAqB;QACjC,YAAY,EAAE,yBAAyB;KACxC;IACD,8FAA8F;IAC9F,0FAA0F;IAC1F,qBAAqB,EAAE;QACrB,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,qBAAqB;QAC5B,YAAY,EAAE,gCAAgC;QAC9C,UAAU,EAAE,kBAAkB;KAC/B;IACD,uFAAuF;IACvF,8DAA8D;IAC9D,gEAAgE;IAChE,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,mDAAmD;QAC1D,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,yBAAyB;KACtC;IACD,4FAA4F;IAC5F,yFAAyF;IACzF,gGAAgG;IAChG,+DAA+D;IAC/D,YAAY,EAAE;QACZ,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,oDAAoD;QAC3D,YAAY,EAAE,2BAA2B;QACzC,UAAU,EAAE,uBAAuB;KACpC;CACF,CAAC;AAWF,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"actor-registry.js","sourceRoot":"","sources":["../src/actor-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,EAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAA+B,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,yBAAyB,EAG1B,MAAM,6BAA6B,CAAC;AA8ErC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B;IAC9D,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAA2B;IAC1E,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAA2B;IACnE,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC7D,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,kBAAkB;QACzB,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,wBAAwB;QACpC,YAAY,EAAE,uBAAuB;KACtC;IACD,eAAe,EAAE;QACf,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,eAAe;QACtB,YAAY,EAAE,0BAA0B;QACxC,YAAY,EAAE,qBAAqB;KACpC;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,kBAAkB;QACzB,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,qBAAqB;QACjC,YAAY,EAAE,yBAAyB;KACxC;IACD,8FAA8F;IAC9F,0FAA0F;IAC1F,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,gGAAgG;IAChG,qFAAqF;IACrF,aAAa,EAAE;QACb,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,6CAA6C;QACpD,YAAY,EAAE,wBAAwB;QACtC,UAAU,EAAE,kBAAkB;KAC/B;IACD,qBAAqB,EAAE;QACrB,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,qBAAqB;QAC5B,YAAY,EAAE,gCAAgC;QAC9C,UAAU,EAAE,kBAAkB;KAC/B;IACD,uFAAuF;IACvF,8DAA8D;IAC9D,gEAAgE;IAChE,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,mDAAmD;QAC1D,YAAY,EAAE,6BAA6B;QAC3C,UAAU,EAAE,yBAAyB;KACtC;IACD,4FAA4F;IAC5F,yFAAyF;IACzF,gGAAgG;IAChG,+DAA+D;IAC/D,YAAY,EAAE;QACZ,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,oDAAoD;QAC3D,YAAY,EAAE,2BAA2B;QACzC,UAAU,EAAE,uBAAuB;KACpC;CACF,CAAC;AAWF,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cua-actor-lab.d.ts

@@ -5,6 +5,7 @@ import { type CuaActorDescriptor } from "./actor-registry.js";
 import type { CuaActorSessionOptions } from "./computer-use-actor.js";
 import type { CuaExecutor, CuaLoopResult, CuaProvider } from "./computer-use.js";
 import type { ReasoningEffort } from "./reasoning-effort.js";
+import { type LocalAgentId } from "./local-agent-cli.js";
 import { type E2BDesktopModule, type E2BDesktopSandbox } from "./e2b-desktop-launch.js";
 import { type DetachedTimers } from "./e2b-detached.js";
 import { type DevicePreset } from "./device-presets.js";
@@ -512,6 +513,8 @@ export interface CuaLaneDeps {
     config: LabConfig;
     descriptor: CuaActorDescriptor;
     appUrl: string;
+    /** When set, the computer-use brain is this locally-signed-in CLI instead of a keyed API. */
+    localAgent?: LocalAgentId;
     cloneRoute: boolean;
     /** desktop-cli (#495): a CLI studied at a desktop. Nothing is cloned and no browser is opened. */
     desktopCliRoute?: boolean;

package/dist/cua-actor-lab.js

@@ -31,6 +31,8 @@ import { adapterScoreFailureMessage, applyBrowserAdapterHooks } from "./adapter-
 import { actorRegistry, isCuaActorDescriptor } from "./actor-registry.js";
 import { CHROMIUM_EVIDENCE_HYGIENE_FLAGS, chromiumEvidenceProfilePreferencesJson } from "./browser-evidence-hygiene.js";
 import { DEFAULT_OPENAI_CU_MODEL } from "./openai-responses-cu.js";
+import { createLocalAgentProvider, detectLocalAgents } from "./local-agent-cli.js";
+import { startAppServerSession } from "./local-agent-appserver.js";
 import { createDesktopSandbox, loadE2BDesktopModule } from "./e2b-desktop-launch.js";
 import { probeUrl, readDetachedLog, runDetachedStep, startDetachedProcess } from "./e2b-detached.js";
 import { DEFAULT_SANDBOX_CATCH_PORT, collectCommsThread, collectExternalCommsThread, deployCommsCatch, externalCatchHealthy, externalInboxUrl, refreshInboxSurface, writeInboxSurface } from "./comms-sandbox-catch.js";
@@ -1273,6 +1275,9 @@ export function resolveSelfReportedFriction(session) {
 export async function runCuaLane(spec, deps) {
     const { config, appUrl, cloneRoute, localTreeRoute, serve, subjectRepo, subjectEnvNames } = deps;
     const desktopCliRoute = deps.desktopCliRoute === true;
+    // The local brain, when there is one. `appServer` owns a process, so the lane closes it.
+    let appServer;
+    let localAgentProvider;
     const subjectEnvValues = config.subject.envValues ?? {};
     const targetUrl = spec.targetUrl ?? appUrl;
     const env = deps.env;
@@ -1560,6 +1565,24 @@ export async function runCuaLane(spec, deps) {
                 await openDesktopTerminal(desktop, deps.requestTimeoutMs, config.subject.product?.workdir);
                 await desktop.wait(BROWSER_SETTLE_MS).catch(() => undefined);
             }
+            // Start the brain BEFORE the first screenshot: the app-server handshake is ~500ms, and it
+            // is paid here, while the sandbox is still settling, rather than inside turn one.
+            if (deps.localAgent === "codex") {
+                appServer = await startAppServerSession({
+                    ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
+                    ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model }),
+                    // The persona lives on the THREAD, so it is stated once instead of re-sent every turn.
+                    baseInstructions: spec.instructions
+                });
+                localAgentProvider = appServer.provider;
+            }
+            else if (deps.localAgent === "claude") {
+                localAgentProvider = createLocalAgentProvider({
+                    agent: "claude",
+                    ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
+                    ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model })
+                });
+            }
             // World is ready: release the pipeline gate so the remaining lanes may start.
             provisioned = true;
             signal(true);
@@ -1625,6 +1648,10 @@ export async function runCuaLane(spec, deps) {
                         : spec.instructions,
                 persona: spec.persona,
                 timeoutMs: deps.timeoutMs,
+                // The brain is either a keyed API client or a CLI the operator is already signed in to.
+                // Everything below this line — loop, executor, trace, affordances — is identical either
+                // way, which is what makes a local-agent run comparable to an API one.
+                ...(localAgentProvider === undefined ? {} : { provider: localAgentProvider }),
                 openai: {
                     apiKey: deps.openaiApiKey,
                     ...(config.actors[0]?.model ? { model: config.actors[0].model } : {}),
@@ -1687,6 +1714,9 @@ export async function runCuaLane(spec, deps) {
         sessionError = redactText(deps.scrubKnownValues(toErrorMessage(error)));
     }
     finally {
+        // The local brain owns a process. Close it before anything else can throw: a leaked
+        // app-server per lane would outlive the run and keep a thread open on the operator's plan.
+        appServer?.close();
         // Stop the mid-run inbox-surface loop FIRST — before the teardown evidence drain below — so the two
         // `cat`s never overlap and the final surface state is deterministic. A surface failure can never
         // block teardown (the loop body is fully try/caught and this await is on its already-caught promise).
@@ -2371,14 +2401,48 @@ async function runCuaActorLabInScope(options) {
     const redactRepoLabel = config.policies?.redactRepos ?? subjectEnvNames.includes("GITHUB_TOKEN");
     const publicRepo = cloneRoute && subjectRepo ? (redactRepoLabel ? "repo-01" : subjectRepo) : undefined;
     const hasGithubToken = subjectEnvNames.includes("GITHUB_TOKEN");
-    // Key-gating is route-aware: the in-process route uses the caller's OWN model + executor.
+    // The operator's own signed-in coding agent is the brain, so there is no provider key to ask
+    // for — the entire point of the actor. E2B is still required: the persona needs a machine.
+    const localAgentRoute = actorType === "local-agent";
+    // Which local CLI, from its OWN field: `model` means the model, so that "Claude Code running
+    // Opus" is sayable. Preflight below refuses when the chosen one is missing or signed out — that
+    // news is worthless after a sandbox is paid for.
+    const preferredLocalAgent = config.actors[0]?.localAgent ?? "codex";
+    // Key-gating is route-aware: the in-process route uses the caller's OWN model + executor, and
+    // the local-agent route uses a CLI the operator has already signed in to.
     if (!dryRun && !inProcessRoute) {
         const missingKeys = [
-            ...(openaiApiKey ? [] : ["OPENAI_API_KEY"]),
+            ...(openaiApiKey || localAgentRoute ? [] : ["OPENAI_API_KEY"]),
             ...(e2bApiKey ? [] : ["E2B_API_KEY"])
         ];
         if (missingKeys.length > 0) {
-            return fail("HUMANISH_CUA_LAB_KEYS_MISSING", `Live computer-use labs need ${missingKeys.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missingKeys, env)}`, descriptor.id);
+            // The moment someone new actually hits the wall. If a signed-in coding agent is sitting
+            // right there, say so HERE rather than making them go and find an API key — that detour is
+            // where most people trying humanish stop.
+            const suggestion = missingKeys.includes("OPENAI_API_KEY")
+                ? await (async () => {
+                    const ready = (await detectLocalAgents()).filter((agent) => agent.credentialsPresent);
+                    return ready.length === 0
+                        ? ""
+                        : ` You have ${ready.map((agent) => agent.label).join(" and ")} signed in on this machine`
+                            + ` — set actors[0].type: local-agent to use ${ready.length === 1 ? "it" : "one"} instead of a key.`;
+                })()
+                : "";
+            return fail("HUMANISH_CUA_LAB_KEYS_MISSING", `Live computer-use labs need ${missingKeys.join(" and ")} in the environment (values are never persisted). ${describeMissingKeys(missingKeys, env)}${suggestion}`, descriptor.id);
+        }
+        if (localAgentRoute) {
+            // Refuse HERE, before a sandbox exists. "codex is not installed" discovered after the
+            // machine is paid for is the same information delivered at the worst possible moment.
+            const available = await detectLocalAgents();
+            const chosen = available.find((agent) => agent.id === preferredLocalAgent);
+            if (chosen === undefined) {
+                return fail("HUMANISH_CUA_LAB_KEYS_MISSING", `actors[0].type: local-agent needs the ${preferredLocalAgent} CLI on PATH and signed in. `
+                    + `Install it, or set OPENAI_API_KEY and use actors[0].type: openai-computer-use instead.`, descriptor.id);
+            }
+            if (!chosen.credentialsPresent) {
+                return fail("HUMANISH_CUA_LAB_KEYS_MISSING", `${chosen.label} is installed but not signed in — run \`${chosen.bin}\` once to log in. `
+                    + "humanish never reads its credentials; it only checks that the file exists.", descriptor.id);
+            }
         }
         const missingSubjectEnv = subjectEnvNames.filter((name) => !env[name]?.trim());
         if (missingSubjectEnv.length > 0) {
@@ -2466,6 +2530,7 @@ async function runCuaActorLabInScope(options) {
         config,
         descriptor,
         appUrl,
+        ...(localAgentRoute ? { localAgent: preferredLocalAgent } : {}),
         cloneRoute,
         desktopCliRoute,
         localTreeRoute,
@@ -4227,7 +4292,13 @@ export function buildCuaFanoutBundle(args) {
     // collapse the run to one word; this does not (docs/principles/three-roles.md).
     const terminalOutcomes = (outcomes ?? []).filter((outcome) => outcome?.session?.status !== undefined);
     const participants = terminalOutcomes.length > 0
-        ? tallyParticipantOutcomes(terminalOutcomes.map((outcome) => outcome.session.status), 
+        ? tallyParticipantOutcomes(
+        // A NO-ENGAGEMENT lane is not a participant who reached the goal. It said "done" having
+        // taken zero actions and said nothing, and `passedLanes` below already refuses to count
+        // it — but `reachedGoal` was reading the trace status directly, so one run could be both
+        // "not a passed lane" AND "1/1 reached the goal". The headline number a researcher reads
+        // first was the dishonest one. Found by a provider bug that ended a study on turn one.
+        terminalOutcomes.map((outcome) => (outcome.noEngagement === true ? "incomplete" : outcome.session.status)), 
         // A participant who reached the goal AND told you the road there was broken is the most
         // useful result a study produces; reporting only the outcome would bury it.
         terminalOutcomes.map((outcome) => outcome.reportedFriction === true))