humanish 0.93.1 → 0.95.0

package/dist/tui-contract.d.ts

@@ -6,6 +6,7 @@ import type { TuiActionResult } from "./tui-actions.js";
 import type { TuiProjectState } from "./tui-project.js";
 import type { ReadRunIndexOptions, RunIndexResult } from "./run-index.js";
 import type { LaunchRunOptions, LaunchRunResult } from "./tui-launch.js";
+import type { CommsSetupResult, CommsSetupStatus } from "./comms-connections.js";
 /** The humanish version string shown in the frame, so a screenshot in a bug report is datable. */
 export interface TuiVersionInfo {
     cli: string;
@@ -16,6 +17,11 @@ export interface TuiVersionInfo {
  * one place, and anything absent here is something the TUI simply cannot do.
  */
 export interface TuiCapabilities {
+    /** Optional for older embedders. Credentials are never returned to the view. */
+    comms?: {
+        read(): Promise<CommsSetupStatus>;
+        save(): Promise<CommsSetupResult>;
+    };
     /** Read every run in the project, cheapest source first. */
     readRunIndex(cwd: string, options?: ReadRunIndexOptions): Promise<RunIndexResult>;
     /**
@@ -62,6 +68,9 @@ export interface TuiCapabilities {
     initProject(cwd: string): Promise<TuiActionResult>;
 }
 export interface TuiOptions {
+    /** Return to setup after the host-owned hidden prompt has finished. */
+    initialScreen?: "connections";
+    connectionNotice?: string;
     /** The project the surface is reading. Already resolved by the CLI. */
     cwd: string;
     version: TuiVersionInfo;
@@ -80,7 +89,10 @@ export interface TuiOptions {
  * Start the surface. Resolves with the process exit code when the operator quits — the TUI owns the
  * screen until then, so the CLI must not write to stdout while this is pending.
  */
-export type StartTui = (options: TuiOptions) => Promise<number>;
+export type TuiHandoff = {
+    action: "agentmail-key";
+};
+export type StartTui = (options: TuiOptions) => Promise<number | TuiHandoff>;
 /** The shape `dist/tui-app.js` exports. Asserted at the load boundary in program.ts. */
 export interface TuiModule {
     startTui: StartTui;

package/dist/tui-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"tui-contract.js","sourceRoot":"","sources":["../src/tui-contract.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,mGAAmG;AACnG,mBAAmB;AA+FnB,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,OAAO,CAAC,OAAO;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,+BAA+B,kBAAkB,cAAc,KAAK,CAAC,WAAW,mCAAmC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,WAAW;QACtB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,kJAAkJ,CAAC;AACzJ,CAAC"}
+{"version":3,"file":"tui-contract.js","sourceRoot":"","sources":["../src/tui-contract.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,mGAAmG;AACnG,mBAAmB;AAyGnB,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,OAAO,CAAC,OAAO;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,+BAA+B,kBAAkB,cAAc,KAAK,CAAC,WAAW,mCAAmC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,WAAW;QACtB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,kJAAkJ,CAAC;AACzJ,CAAC"}

package/docs/architecture/comms-inbox.md

@@ -0,0 +1,78 @@
+# Participant inboxes
+
+The catch captures application mail without sending it to an external recipient.
+Humanish gives each participant an address and a matching
+`/inbox/for/<address-digest>` URL. The same address scope applies to list, message,
+plain view, latest-message and JSON routes. Navigating back from a missing message
+stays in that scope. An unknown scope is empty; it never falls back to all mail.
+A lane without an assigned address receives no inbox instruction.
+
+This works with separate participant worlds, shared worlds, and an external catch.
+Sharing an application world does not require sharing an inbox. If a lab deliberately
+assigns the same address to two participants, both see that address's mail. Generated
+addresses that collide after normalization are made distinct. A message addressed
+to several participants appears in each recipient's inbox and retains its actual
+To field.
+
+`/inbox` remains available and is labeled **Shared operator inbox**. Address digests
+are routing identifiers, not authentication credentials. The catch is study
+infrastructure, not a mailbox service with hostile-tenant isolation. Keep its network
+exposure appropriate for test mail. The read-only listener cannot expose the private
+`/deliveries` drain, even when supplied a valid drain token. The capture listener
+retains its existing optional bearer-token protection for that endpoint.
+
+A standalone catch tracks its generated files. Reusing its directory with a changed
+`--recipient` roster or an emptied delivery log removes obsolete message, latest and
+recipient routes; unrelated files are untouched.
+
+## Existing external catches
+
+Upgrade the Humanish installation that runs `humanish comms catch` and **restart that
+catch process**, as well as upgrading the installation that starts the study. Updating
+only the study client leaves an older catch without participant routes.
+
+Before allocating participants, the client checks `/health` on both `catchBaseUrl`
+and a distinct `inboxBaseUrl`. Each must return the normal service marker and
+`capabilities: ["recipient-inbox-v1", ...]`. Missing, malformed or older responses
+fail admission with an upgrade/restart instruction. Existing email capture endpoints
+and unscoped operator URLs remain available; their payload contracts are unchanged.
+
+## Captured and remote images
+
+The SMTP catch preserves MIME parts with a Content-ID when they contain PNG, JPEG,
+GIF or WebP bytes. The generic `/emails` payload can also carry runtime-only
+`inlineImages` entries with `contentId`, `contentType` and `base64`. Provider-specific
+attachment fields are not converted; unsupported or missing CID references show an
+explicit unavailable-image placeholder instead of pretending capture succeeded.
+
+Captured images are limited to 12 entries, 1 MiB each and 2 MiB total. The renderer
+checks canonical base64 and the declared raster format's signature before creating a
+data URL. This is not a full image decoder; malformed raster content can still fail
+in the browser. Inline data URLs receive the same per-image checks. SVG, arbitrary
+attachment URLs and local paths are not fetched or converted.
+
+HTTP(S) images remain browser loads with `no-referrer`. Humanish does not fetch or
+proxy them server-side. Relative image URLs use the existing declared origin-rewrite
+map when available; otherwise they receive an explicit placeholder. Remote URLs that
+return errors retain the browser's alt-text fallback. The renderer does not claim to
+repair a dead URL. The inbox retains `script-src 'none'` and the existing HTML
+neutralization and origin-rewrite protections.
+
+Raw mail and image bytes remain runtime catch data. Persisted comms evidence remains
+digest-only; adding image capture does not add raw attachments to the run artifact.
+
+## Reproduce the contract
+
+```bash
+pnpm exec vitest run tests/comms*.test.ts
+pnpm exec tsx scripts/comms-inbox-proof.ts
+```
+
+The browser proof starts owned loopback HTTP, read-only inbox and SMTP listeners,
+sends fictional multipart mail through the real MIME parser, and renders two recipient
+inboxes in Chromium at desktop and phone sizes. It checks decoded CID/data/remote
+images, unavailable sources, a genuine remote 404, recipient isolation across HTML
+and JSON, navigation, script blocking, referrer suppression, directory reuse and drain
+access. Screenshots and a machine-readable receipt are saved under the ignored
+`.humanish/comms-inbox-proof/` directory. It uses no external email delivery, paid model
+calls or hosted desktop, and makes no claim about those providers.

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.93.1`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.95.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.
@@ -265,10 +265,13 @@ A lab is a composition over code primitives, not a hardcoded kind:
   `redactScreenshots: true` (blur unimplemented there) and
   `allowPublicTargets: true` fail-closed rather than ignoring them.
 - `comms` (#297; hosted on the clone/local-tree computer-use lanes and the
-  CONCURRENT shared-world getHost plane — warned inert everywhere else,
-  including app-url/operator-provided subjects and the sequential
-  `concurrency: 1` shared world, neither of which has a catch to host): off-app
-  email/SMS the app itself SENDS, made a persona-driven testable surface.
+  concurrent shared-world getHost plane, or connected to an external catch on
+  app-url/operator-provided subjects; unwired on sequential `concurrency: 1`
+  shared worlds): off-app
+  email the app itself sends, made a persona-driven testable surface. Lab
+  configuration rejects `comms.sms` and unknown channel names; message-bus SMS
+  types do not imply a supported SMS execution route. SMTP capture is supported
+  on per-lane provisioned routes and rejected for shared-world studies.
   `comms.email` = `{ kind: fake, injectEnv?, port?, recipients?, linkOrigin?, external? }`.
   `injectEnv` is the ADOPTER-NAMED env var the app reads for its email-API base
   URL (e.g. `RESEND_API_URL`); the harness sets it to an in-sandbox catch (so it
@@ -310,6 +313,31 @@ A lab is a composition over code primitives, not a hardcoded kind:
   persona saw the email is its screenshots of the inbox page. Requires `python3`
   in the subject sandbox (the stock E2B desktop template has it).
 
+### Communication connection setup
+
+`.humanish/local/comms.yaml` is a project-local, non-secret configuration file:
+
+```yaml
+schema: humanish.comms-connections.v1
+connections:
+  agentmail:
+    provider: agentmail
+    apiKeyEnv: AGENTMAIL_API_KEY
+```
+
+Only AgentMail setup is currently supported. Connection names use lowercase
+letters, digits and hyphens, beginning with a letter, up to 48 characters.
+`apiKeyEnv` names an environment variable; it never contains its value.
+Invalid fields, unsupported providers and unsafe filesystem paths are rejected.
+Adding an existing name with different settings refuses to overwrite it.
+
+`comms connections list --json` returns `humanish.comms-setup.v1`: configured
+profiles and local key presence/source, not provider authentication or delivery.
+`comms providers --json` returns `humanish.comms-providers.v1` with explicit
+setup/receiving availability. The key store accepts `humanish keys set agentmail`.
+Saving a connection neither modifies a lab nor creates a provider resource;
+`comms.email.connection` in a study remains unsupported and is rejected.
+
 Lab backends report results in their own schemas (`humanish.run-result.v1`,
 `humanish.oss-lab-result.v1`, `humanish.oss-meta-lab-result.v1`,
 `humanish.cua-lab-result.v2`, `humanish.scripted-lab-result.v1`,

package/docs/contracts/study-analysis.md

@@ -31,7 +31,17 @@ admission. It bounds a conservative estimate, not an exact provider bill.
 estimate retains valid findings and usage but returns a partial result and a
 nonzero command exit, including when that version is reused.
 
-The defaults allow five minutes and 16,384 output tokens, including reasoning.
+The default deadline is ten minutes. With no explicit output-token limit, analysis
+uses 32,768 tokens if admission fits the declared budget, or retains the prior
+16,384-token allowance otherwise. Explicit limits are never adjusted. Selection
+happens before dispatch; `admission.outputTokenAllowance` exposes it in dry-run,
+and the saved configuration, digest and automatic job bind the selected allowance.
+This selection never increases the spending limit or starts a retry.
+The configured wall-clock deadline covers the entire request, including waiting
+for response headers and reading the body. A request-scoped dispatcher prevents
+Node's separate fetch timeout from cutting a longer configured deadline short;
+it does not change other network requests in the process. Transport failures
+retain only an allowlisted cause code, never provider exception text or URLs.
 The analysis checks the assigned requirements against the retained end state;
 an unverified essential result remains unknown even if the participant reported
 success. Findings keep reported concerns and observed recovery distinct across

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-17. Release baseline: `0.93.1`.
+Status date: 2026-09-20. Release baseline: `0.95.0`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.93.1-observer-review-controls.md).
+in the [release notes](../release/0.95.0-connections-setup.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.93.1`)
+## Current Program Truth (source `0.95.0`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -100,9 +100,9 @@ substitute for it.
 | Observer | Live/recorded views, shared grid and participant playback, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
 | Review and feedback | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication |
 | Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
-| TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving and run library | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |
-| Off-app communication | In-sandbox email/SMS catch and digest-only thread evidence | This does not establish real-provider delivery |
-| Mobile and media | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed | Physical-device and touch fidelity remain unproven; unsupported microphone declarations are rejected |
+| TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving, run library and AgentMail connection/key setup | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |
+| Off-app communication | Recipient-scoped synthetic email inboxes, supported inline raster images, email capture and digest-only thread evidence | Scope prevents accidental cross-recipient browsing; it is not tenant authentication or real-provider delivery. AgentMail setup does not enable receiving; SMS is not a configured execution route |
+| Mobile and media | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed; a synthetic video-only call with separate hosted peers is proven | Audio, TURN, provider-specific rooms, physical-device and touch fidelity remain unproven; unsupported media declarations are rejected |
 
 Use the [task support matrix](../architecture/task-protocol-support.md),
 [actor registry](https://github.com/danielgwilson/humanish/blob/main/src/actor-registry.ts)

package/docs/product/automatic-analysis.md

@@ -4,16 +4,19 @@ Supported live studies automatically request analysis after each recording finis
 separate from participant feedback and the recorded study verdict.
 
 The default is `gpt-6-astra` with high reasoning effort, a separate $3 admission
-estimate limit, a 300-second timeout and 16,384 output tokens. To customize it:
+estimate limit and a 600-second timeout. When no output limit is specified,
+Humanish selects 32,768 tokens if the exact input's admission estimate fits that
+budget; otherwise it keeps the established 16,384-token allowance. This preserves
+previously admitted studies without increasing their spending limit. To customize it:
 
 ```yaml
 review:
   analysis:
     maxCostUsd: 3
-    # Optional; these values match manual analysis defaults.
+    # Optional overrides. Omit maxOutputTokens for budget-aware selection.
     model: gpt-6-astra
-    timeoutMs: 300000
-    maxOutputTokens: 16384
+    timeoutMs: 600000
+    # maxOutputTokens: 32768
     # question: Where did participants need to recover?
 ```
 
@@ -21,6 +24,12 @@ Omitting `review.analysis` uses these defaults. Set `review.analysis: false` to
 run participants without the additional analysis request. An explicit analysis
 mapping requires `maxCostUsd`. This limits an admission estimate, not the
 provider's final bill, and is separate from participant spending limits. Analysis
+can decline a large study before dispatch when its conservative estimate exceeds
+that limit. Use `analyze --dry-run --max-cost <usd>` on retained evidence to inspect
+the estimate and selected token allowance before deliberately choosing a larger budget. Explicit
+`maxOutputTokens` and `--max-output-tokens` limits are honored exactly. The output allowance
+includes reasoning as well as the report; exhausting it does not produce a usable
+report and never starts an automatic retry. Analysis
 sends selected retained text and captures to OpenAI using `OPENAI_API_KEY`.
 Analysis runs in the Humanish runner using its credentials. This setting adds no
 credential channel to the target application; each participant backend retains

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.93.1` (2026-09-17). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.95.0` (2026-09-20). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,16 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.95.0 release note](../release/0.95.0-connections-setup.md) describes
+AgentMail connection setup, hidden key entry and return to the TUI, matching
+CLI setup commands, and truthful credential status. Real email receiving is
+still unavailable; saved connections cannot be used in studies yet.
+
+The [0.94.0 release note](../release/0.94.0-reliability.md) describes analysis
+request deadlines and budget-aware output, smaller portable recordings,
+recipient-scoped synthetic inboxes, route-aware setup checks, decoded capture
+transitions, pin movement, and explicit camera-support boundaries.
+
 The [0.93.1 release note](../release/0.93.1-observer-review-controls.md) describes
 a compact findings overview, separate analysis-attempt details, styled Observer
 selects and checkboxes, clearer pin/theme states, and smoother navigation.
@@ -149,11 +159,12 @@ Implemented:
   deterministic proof, while concurrent has deterministic and kept live proof;
 - `subject.source: local-tree`, which packages one selected working tree with a
   content pin before using the same provision-and-serve path as clone subjects;
-- an off-app comms funnel for email/SMS-gated flows: a vendor-neutral in-sandbox
+- an off-app comms funnel for email-gated flows: a vendor-neutral in-sandbox
   catch redirects the app's own send API, a persona reads a minimal inbox surface
   and clicks through, and a digest-only `humanish.comms-thread.v1` artifact
   records the thread with no raw address, link, or code — wired into the
-  computer-use and shared-world routes and live-proven on computer-use;
+  computer-use and concurrent shared-world routes and live-proven on computer-use.
+  SMS is not yet a configured execution route;
 - resolved-persona directives that actually shape the actor prompt on the
   terminal-product route (traits are applied and recorded in the actor trace, not
   decorative), reusing the same `persona.ts` compiler as the computer-use lane;

package/docs/release/0.94.0-reliability.md

@@ -0,0 +1,48 @@
+# Humanish 0.94.0
+
+Long analysis requests now honor Humanish's configured deadline instead of
+ending early at the HTTP client's header timeout. The default deadline is ten
+minutes. Omitted output settings use up to 32,768 tokens when the existing
+declared budget admits that allowance, otherwise retaining 16,384. Explicit
+output settings remain exact. This adds no retries or automatic budget increase.
+
+Portable HTML stores each distinct raster capture once and resolves it on
+demand. A retained 12-participant, 344-capture recording decreased from about
+309 MiB to 143 MiB without changing capture bytes or timestamps. Existing
+recordings remain readable; new exports retain the same sharing checks.
+
+Participant inbox links now open that participant's synthetic recipient scope.
+Unknown scopes fail closed, while the shared inbox remains explicitly labeled
+for operators. Supported captured inline images render; unsupported references
+show an explanation. Remote images still depend on their original host.
+Recipient scopes are navigation isolation, not tenant authentication.
+
+`humanish doctor --lab <lab>` separates participant authentication, hosted
+desktop requirements and automatic-analysis credentials. Local Codex or Claude
+authentication is checked through that CLI rather than inferred from a file.
+The keyless first run needs no model or desktop credentials.
+Projects without `package.json` are valid; `doctor` treats the missing optional
+npm integration as information while still rejecting unsafe or unreadable files.
+
+Observer keeps the previous decoded capture visible while loading the selected
+one, labels it as previous evidence, and withholds action pins until the selected
+image is ready. Pinning animates the displaced cards as well as the selected
+card, preserving focus and respecting reduced motion. Pin and unpin are
+available directly on each card, with readable metadata and phone touch targets.
+A repeatable browser
+gate checks capture transitions, motion and automated accessibility in both
+themes at desktop and phone widths.
+
+An actual Humanish participant joined a synthetic camera room with a separate
+hosted peer, exchanged moving video, and left. A second participant denied the
+native camera prompt and stayed outside the room. Unsupported media routes and
+microphone-file injection now fail before execution instead of silently ignoring
+the declaration. This proves one video-only Chromium path; audio, TURN and
+provider-specific rooms remain unproven.
+
+Kept evidence and limits:
+
+- [Analysis reliability](../goals/computer-use-actor/receipts/analysis-reliability-2026-09-19.md)
+- [Portable recording comparison](../goals/observer-qol/receipts/2026-09-19-portable-export.md)
+- [Setup, inbox and camera proof](../goals/computer-use-actor/receipts/reliability-2026-09-19.md)
+- [Observer capture and accessibility gate](https://github.com/danielgwilson/humanish/blob/main/scripts/observer-reliability-proof.md)

package/docs/release/0.95.0-connections-setup.md

@@ -0,0 +1,38 @@
+# 0.95.0 — Connections and hidden key entry
+
+Open `humanish tui` and press **c** to configure AgentMail. **Add API key**
+opens a hidden terminal prompt, then returns to Connections. Ctrl+C cancels
+without changing the existing key or profile. Existing keys can be reused or
+replaced. Entry uses the host's key store, outside the TUI rendering contract.
+
+Keys live in the existing user-level store with file mode 0600. Project
+connection metadata lives in `.humanish/local/comms.yaml` and contains only a
+provider name and environment-variable reference. Explicit environment/env-file
+values retain precedence; strict key mode continues to disable discovery.
+The screen identifies those cases instead of claiming a newly stored key is active.
+
+Agents have matching commands:
+
+```bash
+humanish comms providers --json
+humanish keys set agentmail
+humanish comms connections add agentmail --json
+humanish comms connections list --json
+```
+
+This is connection setup only. Authentication, permissions, capacity and
+delivery are unverified, and this version does not acquire mailboxes or enable
+provider-backed email in studies. Unsupported study connection/SMS selectors
+and shared-world SMTP declarations fail before execution. Supported local
+email capture remains available.
+
+The release also includes TUI `--env-file` propagation and route-specific key
+requirements from #793. Dry-run, local-agent and terminal participants no longer
+inherit a hardcoded OpenAI-plus-E2B key requirement.
+
+Validation covers local configuration, containment, credential precedence,
+hidden entry/cancellation/paste, persistence and TUI frames at 80 and 45
+columns. `pnpm tui:connections:proof` drives the built CLI in a real PTY with
+synthetic keys and an isolated store, checking cancellation, replacement,
+restart and absence of credential values from terminal output. It requires
+Python 3 with Unix PTY support; it does not contact AgentMail.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.93.1",
+  "version": "0.95.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [
@@ -80,7 +80,9 @@
     "docs:check": "tsx scripts/generate-cli-docs.ts --check",
     "observer:browser:proof": "node scripts/observer-browser-proof.mjs",
     "observer:iframe:proof": "node scripts/observer-iframe-proof.mjs",
-    "observer:chrome:proof": "node scripts/observer-chrome-proof.mjs"
+    "observer:chrome:proof": "node scripts/observer-chrome-proof.mjs",
+    "observer:reliability:proof": "node scripts/observer-reliability-proof.mjs",
+    "tui:connections:proof": "python3 scripts/tui-connections-proof.py"
   },
   "repository": {
     "type": "git",
@@ -94,6 +96,7 @@
     "commander": "^14.0.3",
     "playwright-core": "^1.60.0",
     "pngjs": "^7.0.0",
+    "undici": "^6.28.1",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
@@ -114,6 +117,7 @@
     "@e2b/desktop": "^2.4.0",
     "@types/node": "^20.19.41",
     "@types/pngjs": "^6.0.5",
+    "axe-core": "4.13.0",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.7"

package/skills/humanish/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: humanish
-description: Install and configure Humanish CLI in a JavaScript app as an open-source-safe persona simulation harness. Use when an agent needs to add humanish, run safe first setup, create synthetic personas or scenarios, configure env var names without values, capture the email or SMS an app sends so a persona can complete an email-gated flow (e.g. a signup verification link or one-time code), run verification and Observer commands, or draft public-safe feedback issues without GitHub mutation.
+description: Install and configure Humanish CLI in a JavaScript app as an open-source-safe persona simulation harness. Use when an agent needs to add humanish, run safe first setup, create synthetic personas or scenarios, configure env var names without values, capture the email an app sends so a persona can complete an email-gated flow (e.g. a signup verification link or one-time code), run verification and Observer commands, or draft public-safe feedback issues without GitHub mutation.
 ---
 
 # Humanish CLI
@@ -36,10 +36,21 @@ Everything it shows has a machine-readable equivalent, which is what you want:
 | browsing runs | `npx humanish runs --json` |
 | starting a run | `npx humanish lab run <lab> --json --no-open` |
 | a run's outcome | `npx humanish review --run <id> --json` |
+| communication setup | `npx humanish comms providers --json` and `npx humanish comms connections list --json` |
 
 If a human asks you to "open the TUI", tell them the command to type; do not run
 it on their behalf.
 
+For AgentMail credential setup, a human can open `humanish tui`, press `c`,
+and choose **Add API key**. Hidden entry returns to Connections after saving or
+cancelling. The key is stored for that OS user, while the connection profile is
+project-local. Never ask for the key in chat. The CLI alternative is
+`humanish keys set agentmail` (hidden prompt; agents may use `--stdin` from an
+authorized credential source), followed by
+`humanish comms connections add agentmail --json`. Existing env/file precedence
+and `HUMANISH_STRICT_KEYS=1` still apply. Read installed provider capabilities:
+this release supports setup only, not authenticated checks or real email delivery.
+
 ## Setup Workflow
 
 1. Inspect public target-repo files only: `package.json`, docs, route/app
@@ -203,9 +214,9 @@ npx humanish watch first-run
 npx humanish lab run first-run --json --no-open
 ```
 
-### Off-app email/SMS verification (comms)
+### Off-app email verification (comms)
 
-When a flow is gated behind an email or SMS the app itself SENDS — a signup
+When a flow is gated behind an email the app itself sends — a signup
 verification link, a one-time code, a magic link — add a `comms:` block. The
 harness redirects the app's email-API sends into a catch INSIDE the sandbox (no
 mail leaves the machine), gives the persona a synthetic inbox to open and click
@@ -213,6 +224,11 @@ through, and writes a digest-only `humanish.comms-thread.v1` evidence artifact (
 raw address/link/code persists). Reach for this whenever a persona must read mail
 the app sent it to finish a step.
 
+Lab execution supports email capture only. `comms.sms`, saved connection
+selectors and unknown channel names are rejected. AgentMail connection/key
+setup is available separately; it does not enable real receiving yet. Real SMS
+delivery is also unavailable; a message-bus type does not establish route support.
+
 ```yaml
 comms:
   email:
@@ -247,10 +263,15 @@ The app keeps calling its email API normally (Resend/SendGrid-shaped, or a custo
 profile); only the base URL is redirected. Route support: the clone/local-tree
 computer-use route (inbox on the sandbox's own loopback) and the CONCURRENT
 shared-world route (inbox getHost-exposed from the subject sandbox; the default
-since every seat now runs live at once). Declared anywhere else — app-url /
-operator-provided subjects, or a sequential `concurrency: 1` shared world — it is
-warned inert at parse: no catch exists there and no actor hears about an inbox.
-It needs `python3` in the subject sandbox (the stock E2B desktop has it).
+since every seat now runs live at once). SMTP capture is supported on per-lane
+provisioned routes; shared-world SMTP is rejected because it is not wired there.
+For app-url/operator-provided subjects, run `humanish comms catch` on a reachable
+host, point the app's email sends at that catch, and declare
+`comms.email.external.catchBaseUrl` (plus `inboxBaseUrl` if different). A declared
+`authTokenEnv` is an environment variable name, never a credential value.
+Sequential `concurrency: 1` shared-world email remains unwired; do not silently
+change study concurrency to work around that limitation. The in-sandbox catch
+needs `python3` (the stock E2B desktop has it).
 Evidence is digest-only (`humanish.comms-thread.v1` — counts and digests, never
 raw mail); the *readable* proof a persona saw the email is its screenshots of the
 inbox page. See `docs/contracts/schemas.md` for the full `comms:` shape and