bareloop 0.23.0 → 0.25.0

package/types/providers.d.ts

@@ -31,23 +31,31 @@ export function makeProvider(providerName: string, { apiKey, model, baseUrl }?:
  * before this factory existed — that decision stays where each runner's own
  * `--model` flag/spec precedence lives, not duplicated in here).
  *
- * The JUDGE stays pinned to `anthropic-api`/`judgeModel` regardless of
- * `providerName` — arbiter territory (PRD item 28: "the judge stays PINNED
- * … regardless of the job's worker provider"). A signed `judge:{provider,
- * model}` field with its own calibration record is PRD item 28 part (2),
- * NOT built here; until it lands, the judge always needs its own
- * `judgeApiKey` (today, always `ANTHROPIC_API_KEY`), independent of which
- * key the worker used.
+ * THE JUDGE IS NO LONGER PINNED TO ANTHROPIC (PRD item 32.2, hamr 2026-09-10:
+ * *"what i care about is that judge becomes llm agnostic and not set to one
+ * model or provider"*). It is constructed through this same factory, from a
+ * `judgeProviderName`/`judgeModel` pair the CALLER resolved (`resolveJudge`,
+ * src/judged.js — the spec's signed `judge` override, else the job's own worker
+ * provider and model). Item 28's pin, and item 28 part (2)'s deferral of a
+ * signed `judge:{provider,model}` field, both close here.
+ *
+ * `judgeApiKey` stays a SEPARATE argument rather than being derived: the judge
+ * may legitimately be a different provider from the worker, and reading its key
+ * for it would put a second env-var reader in a module whose whole job is to
+ * have exactly one. The caller reads the resolved judge provider's own `envKey`
+ * and hands the key in — the same contract the worker key already has here.
  * @param {object} args
  * @param {string} args.providerName spec.provider (or the anthropic-api default)
  * @param {string|undefined} args.apiKey the WORKER's key, read from the provider's own `envKey`
  * @param {string} args.model the already-resolved worker model id
  * @param {Readonly<Record<string, string>>} args.tierModels the already-resolved tier -> model map (spec override folded in by the caller)
  * @param {string|undefined} [args.baseUrl] spec.baseUrl, if any
- * @param {string|undefined} args.judgeApiKey the judge's own key (today: `ANTHROPIC_API_KEY`)
- * @param {string} args.judgeModel `JUDGE_MODEL`
+ * @param {string|undefined} args.judgeApiKey the judge's own key, read by the caller from the RESOLVED judge provider's `envKey`
+ * @param {string} args.judgeModel the resolved judge model id
+ * @param {string} [args.judgeProviderName] the resolved judge provider name; defaults to `providerName` (the job's own worker provider), which is `resolveJudge`'s own default
+ * @param {string|undefined} [args.judgeBaseUrl] the judge provider's endpoint, when it takes one
  */
-export function buildRunnerProviders({ providerName, apiKey, model, tierModels, baseUrl, judgeApiKey, judgeModel, }: {
+export function buildRunnerProviders({ providerName, apiKey, model, tierModels, baseUrl, judgeApiKey, judgeModel, judgeProviderName, judgeBaseUrl, }: {
     providerName: string;
     apiKey: string | undefined;
     model: string;
@@ -55,11 +63,32 @@ export function buildRunnerProviders({ providerName, apiKey, model, tierModels,
     baseUrl?: string | undefined;
     judgeApiKey: string | undefined;
     judgeModel: string;
+    judgeProviderName?: string | undefined;
+    judgeBaseUrl?: string | undefined;
 }): {
     provider: any;
     providerFor: (tier: string) => any;
     judgeProvider: any;
 };
+/**
+ * The launch-time warning lines for an ADMITTED-PENDING-PROBE provider, or
+ * `null` when the provider has paid for its own end-to-end probe (and for an
+ * off-table name — an unknown provider is `resolveProvider`'s named throw to
+ * report, never this function's warning to soften).
+ *
+ * This lives here, next to `PROBE_STATUS`, rather than inline in the runner,
+ * for one reason: inline it was UNTESTABLE. `scripts/run-u.mjs` reaches this
+ * point only with a real job row (a machine-local patient path) and a real
+ * signed spec, so nothing in the suite could reach the branch, and a warning
+ * nothing executes drifts exactly the way the green-only prose did (item 31.2).
+ *
+ * It never REFUSES, and it never returns a shape a caller can mistake for a
+ * refusal: hamr admitted `gemini-api` to the menu, and a probe table that
+ * quietly withheld it would be a second ruling nobody made.
+ * @param {string} providerName
+ * @returns {string[]|null} lines to print, in order, or null when there is nothing to say
+ */
+export function probeWarningLines(providerName: string): string[] | null;
 /**
  * Today's anthropic-api tier table — EXACTLY the `DEFAULT_TIER_MODELS` both
  * runners hardcoded before this factory existed. Any change to these two
@@ -84,6 +113,35 @@ export const OPENAI_TIER_MODELS: Readonly<{
     sonnet: "deepseek-chat";
     haiku: "deepseek-chat";
 }>;
+/**
+ * Gemini (PRD item 31.3, hamr 2026-09-09: "anthropic, openai, gemini drop
+ * ollama for now"). Two real tiers, unlike DeepSeek's single model: `flash` is
+ * the cheap tier by design, so `haiku` maps to it honestly rather than
+ * repeating one id.
+ *
+ * ADMITTED-PENDING-PROBE. The probe rule stands (PRD item 28 ruling (d),
+ * 2026-09-09): no endpoint is in the menu without its own clean paid probe,
+ * and `gemini-api` has ZERO runs. `anthropic-api` is the original (~167
+ * archived runs) and `openai-api` was probed green through the shipped runner
+ * (run mtu12vks, $1.64/$4, F157); gemini owes that fire and has not paid it.
+ * `PROBE_STATUS` below is the machine-readable form of that debt — nothing in
+ * here silently pretends the provider is proven.
+ */
+export const GEMINI_TIER_MODELS: Readonly<{
+    sonnet: "gemini-2.5-pro";
+    haiku: "gemini-2.5-flash";
+}>;
+/**
+ * Which admitted providers have paid for their own end-to-end probe, and which
+ * have not. Read by the runner to print a loud marker; never read to REFUSE —
+ * hamr admitted gemini to the menu, and a table that quietly withheld it would
+ * be a second, invisible ruling. An unprobed provider runs, and says so.
+ * @type {Readonly<Record<string, {probed: boolean, evidence: string}>>}
+ */
+export const PROBE_STATUS: Readonly<Record<string, {
+    probed: boolean;
+    evidence: string;
+}>>;
 export type ProviderTableEntry = {
     /**
      * the bare-agent provider class
@@ -98,7 +156,11 @@ export type ProviderTableEntry = {
      */
     tiers: Readonly<Record<string, string>>;
     /**
-     * per-model request-key/param gating, applied on TOP of {exposeErrorBody:true, apiKey, model, baseUrl?}
+     * the CONSTRUCTOR OPTION NAME this provider reads its endpoint from — NOT assumed to be `baseUrl` (see below)
+     */
+    endpointKey: string;
+    /**
+     * per-model request-key/param gating, applied on TOP of {exposeErrorBody:true, apiKey, model, <endpointKey>?}
      */
     paramsFor: (model: string | undefined) => Record<string, any>;
 };

package/types/run.d.ts

@@ -34,9 +34,14 @@
  *   metered claude-json text provider for the toolless drafter); ignored on every Loop-driven provider
  * @param {(type: string, data?: object) => object} opts.emit spine emitter
  * @param {(tier: string) => any} [opts.providerFor] P: per-step model-tier provider factory (forwarded to the plan flow)
+ * @param {string|null} [opts.judgeModel] SOFTGREEN — WHICH model the judge provider drives
+ *   (PRD item 32.1), resolved by the CALLER (`resolveJudge`, src/judged.js) and passed
+ *   through untouched. Travels with `judgeProvider`; absent, a judged stage stops as a
+ *   wiring gap rather than grading under an identity nobody named.
  * @param {any} [opts.judgeProvider] SOFTGREEN — the provider a JUDGED close stage runs its
- *   locate call through, wired by the operator and PINNED to `JUDGE_MODEL` (src/judged.js:
- *   the only tier with established injection resistance upstream). Forwarded to the plan
+ *   locate call through, built by the CALLER from the RESOLVED judge identity (PRD item
+ *   32.1: `resolveJudge`/`resolveJobJudge`, src/judged.js — the spec's signed `judge`
+ *   override, else the job's own worker provider and model), never pinned. Forwarded to the plan
  *   flow. It is its own seam and not `provider`/`providerFor`, because the judge tier is
  *   never a step knob and never agent-selectable; absent, a judged stage instrument-stops as
  *   a wiring gap rather than grading on whatever binding happened to be at hand. Its spend
@@ -176,7 +181,7 @@
  *   deliberately NOT in the resumable/checkpoint set (`src/reuse.js`) — an
  *   unknown in-flight state is not a known-safe resume point.
  */
-export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, resumable }: {
+export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, resumable }: {
     approvals: unknown;
     workdir: string;
     provider: any;
@@ -188,6 +193,7 @@ export function runJob(rawSpec: object | string, { approvals, workdir, provider,
     }) => any) | undefined;
     emit: (type: string, data?: object) => object;
     providerFor?: ((tier: string) => any) | undefined;
+    judgeModel?: string | null | undefined;
     judgeProvider?: any;
     capRuns?: number | undefined;
     strikeLimit?: number | undefined;

package/types/source.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Build the frozen source tree — `<into>/tree/input/…` (the copy), `<into>/tree/output/`
+ * (empty, where the run writes), `<into>/source.json` (the manifest, OUTSIDE
+ * the tree so no worker can read or edit it). One hidden git commit seeds the
+ * tree with a neutralized identity; the seed sha rides in the manifest and is
+ * what every close in this run measures against (`seedAtHead`, src/kinds.js).
+ *
+ * `destination`, when given, is recorded in the manifest (never in a signed
+ * job spec — a job spec is a repeatable SHAPE, source/destination a PER-RUN
+ * value, see `readSourceManifest`'s own comment) as the run's declared
+ * drop-off point. D3 rework (hamr's ruling, 2026-09-12, condensed in
+ * `docs/product/ITEM33-BUILD.md`): **destination is a DIRECTORY, never a
+ * filename** — it may already exist (need not be empty), and it may sit
+ * inside the source itself (the same-dir case: "i can limit your actions to
+ * a certain fix in a certain dir and your output will also be there"). A job
+ * may produce more than one file; the agent names them, and `copyOut`
+ * delivers every non-empty file it finds under `output/`, each under its own
+ * dated name. There is therefore no separate `output` field any more — the
+ * old single-file `output-invalid` guard existed only to stop a
+ * manifest-declared path from escaping the tree, and that vector is closed
+ * structurally now: `copyOut` always reads `output/` itself, never a path a
+ * manifest could have been hand-edited to name.
+ *
+ * A `kind: 'repo'` source's `destination` is a DIFFERENT thing entirely
+ * (hamr: "destination if for code on a green then that would be the place
+ * agent allowed to do changes") — it names the WRITE FENCE inside the copied
+ * repo, the signed `writeScope` field's job (`src/job.js:363`), not a
+ * filesystem drop-off point this door proves or copies into. It is recorded
+ * as declared, unvalidated by `proveDestination`, and `frontDoorFromManifest`
+ * never hands a repo source's destination to `copyOut` — wiring it into
+ * `writeScope` is M3/M4's job, not this one.
+ * @param {{source: string, into: string, destination?: string,
+ *   fetchTimeoutMs?: number}} args `fetchTimeoutMs` is test-only — production
+ *   callers omit it and get `PROVIDER_TIMEOUT_MS`.
+ * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: object}|SourceRefusal>}
+ */
+export function prepareSource({ source, into, destination, fetchTimeoutMs }: {
+    source: string;
+    into: string;
+    destination?: string;
+    fetchTimeoutMs?: number;
+}): Promise<{
+    stop: null;
+    into: string;
+    tree: string;
+    manifestPath: string;
+    manifest: object;
+} | SourceRefusal>;
+/**
+ * The delivered name (M2b fix 4, kept under D3): a destination FILE of
+ * `/home/me/profile.md` lands as `/home/me/profile-2026-09-12.md`, and a
+ * SECOND delivery of the same name the same day as
+ * `profile-2026-09-12-2.md`, `-3`, … (the work-branch collision rule, the same
+ * spelling `prepareWorkBranch` uses). The date is the delivery's, not the
+ * run's: what a person wants to know opening the folder later is when the file
+ * arrived. D3: `destination` here is a FULL FILE PATH inside the destination
+ * DIRECTORY (`copyOut` builds one per output file it delivers) — this
+ * function itself is unchanged from M2b, it is just no longer handed the
+ * bare top-level destination directly.
+ *
+ * Nothing is ever overwritten, which is why the name is computed rather than
+ * taken: a plain `profile.md` would eventually collide with the person's own
+ * file or a previous run's, and the only honest answers to a collision are
+ * "refuse" or "a new name" — hamr picked a new name.
+ * @param {string} destination the absolute FILE path as declared
+ * @param {Date} now
+ * @param {number} n 1 = the plain dated name, 2+ = the same-day suffix
+ * @returns {string}
+ */
+export function datedDestination(destination: string, now: Date, n: number): string;
+/**
+ * The first dated name that is free, or a refusal when every same-day slot up
+ * to `MAX_SAME_DAY` is taken. Used by `copyOut` at delivery time (per output
+ * file) so a same-day repeat delivery of the same name never disagrees with
+ * what "landable" means.
+ * @param {string} destination an absolute FILE path
+ * @param {Date} [now]
+ * @returns {{stop: null, path: string}|SourceRefusal}
+ */
+export function pickDelivery(destination: string, now?: Date): {
+    stop: null;
+    path: string;
+} | SourceRefusal;
+/**
+ * Prove a destination DIRECTORY is landable — $0, mechanical, before any
+ * token spends (PRD item 33 ruling: "source and destination are proven at
+ * job start"). D3 rework (hamr's ruling, 2026-09-12): **destination is a
+ * directory, never a filename** — it may already exist, and need not be
+ * empty (a job may write into a folder that already holds other files, or
+ * even sit inside the source itself, the same-dir case). What this proves is
+ * narrower than the M2/M2b version: only that the directory is USABLE
+ * (exists as a directory and is writable, or can be created) — it can say
+ * nothing about individual delivered FILE names, because those are not known
+ * until the run actually produces them (the agent names its own output
+ * files); per-file same-day collisions are handled at delivery time, inside
+ * `copyOut`, via `pickDelivery`.
+ * @param {unknown} destination absolute directory path
+ * @param {{into: string}} o `into` — the run's own scratch root (prepared by
+ *   `prepareSource`, or a run's own `workdir` when there is no source door);
+ *   the destination may never sit inside it.
+ * @returns {Promise<{stop: null}|SourceRefusal>}
+ */
+export function proveDestination(destination: unknown, { into }: {
+    into: string;
+}): Promise<{
+    stop: null;
+} | SourceRefusal>;
+/**
+ * Copy the run's own output to the proven destination DIRECTORY — once per
+ * file, never overwriting (`COPYFILE_EXCL`, so even a file that appears
+ * between `proveDestination` and here refuses rather than clobbers), on a
+ * minted green only. This function renders no verdict and changes none: a
+ * refusal here is reported beside the green it could not deliver, never
+ * folded back into it.
+ *
+ * D3 rework (hamr's ruling, 2026-09-12): a job may produce MORE THAN ONE
+ * file (his example: a flight search producing one sheet for "SFO→LAX
+ * red-eye" and another for "SFO under $700") — the agent names them
+ * meaningfully, and EVERY non-empty file under `tree/output/` (excluding
+ * `output/.gitkeep`) is delivered, each under its own dated name
+ * (`datedDestination`/`pickDelivery`, M2b fix 4, unchanged). An empty file is
+ * silently skipped (not a delivered result, same judgment M2b made for the
+ * single-file case) rather than refusing the whole batch over one empty
+ * file; the refusal is reserved for the case where NOTHING is left to
+ * deliver at all.
+ *
+ * `into`, when given, is the run's own SCRATCH ROOT (`prepareSource`'s
+ * `into`, of which `tree` is the `tree/` subdirectory) — review finding #3:
+ * a destination sitting inside `<into>` but outside `tree` (e.g. dropped
+ * straight in the scratch area, never inside the frozen tree) must still
+ * refuse `destination-contained`, which a containment check against `tree`
+ * alone cannot see. Omitted, it defaults to `tree` (the pre-fix behaviour),
+ * for direct callers that only ever had a tree, never an `into`.
+ * @param {{tree: string, into?: string, destination: string}} o
+ * @returns {Promise<{stop: null, files: {path: string, bytes: number, sha256: string}[]}|SourceRefusal>}
+ */
+export function copyOut({ tree, into, destination }: {
+    tree: string;
+    into?: string;
+    destination: string;
+}): Promise<{
+    stop: null;
+    files: {
+        path: string;
+        bytes: number;
+        sha256: string;
+    }[];
+} | SourceRefusal>;
+/**
+ * Read a source-door manifest, if one is there. mid-build spec correction
+ * (2026-09-11, the main session, on hamr's question about export): a job
+ * spec is a SHAPE, signed once — source and destination are a PER-RUN value,
+ * the way `bareloop run <bundle> --repo <path>` varies the repo instance
+ * without touching the bundle's signature. Baking an absolute destination
+ * path into `job.js`/`jobSpecHash` would sign one instance where the spec is
+ * meant to describe a repeatable shape, so the run instance lives HERE
+ * instead — the manifest `prepareSource` already writes outside the tree —
+ * and nothing was added to the job schema.
+ *
+ * Absence is reported as absence: a patient the JOBS table points at
+ * directly, never having gone through `prepareSource`, has no manifest, and
+ * that IS "repo jobs untouched" — nothing here invents a destination for a
+ * job that never declared one. A manifest that EXISTS but cannot be read or
+ * parsed is a named stop, never a silent skip: the run has evidence
+ * something is there and wrong, and hiding that is worse than refusing on it.
+ * @param {string} into the manifest's own directory — `<into>/source.json`
+ *   (a run-u-style caller passes `dirname(workdir)`, since `workdir` IS
+ *   `<into>/tree`)
+ * @returns {Promise<{stop: null, present: false, manifest: null}|{stop: null, present: true, manifest: Record<string, any>}|SourceRefusal>}
+ */
+export function readSourceManifest(into: string): Promise<{
+    stop: null;
+    present: false;
+    manifest: null;
+} | {
+    stop: null;
+    present: true;
+    manifest: Record<string, any>;
+} | SourceRefusal>;
+/**
+ * Reduce a `readSourceManifest` success result to the `{destination}` a
+ * runner acts on, or `null` when there is none to act on (no manifest, one
+ * that never declared a destination, or — D3 — a `kind: 'repo'` manifest,
+ * whose `destination` names the WRITE FENCE inside the copied repo, never a
+ * filesystem drop-off point this door proves or copies into: "repo jobs
+ * UNCHANGED", `writeScope` already does that job, `src/job.js:363`). Pure
+ * extraction of the one piece of `run-u.mjs`'s front-door reading that has
+ * any logic in it (the rest is spine emits and control flow) —
+ * unit-testable apart from the script, which is otherwise unreachable
+ * without a live provider key.
+ * @param {{present: boolean, manifest: Record<string, any>|null}} read
+ * @returns {{destination: string}|null}
+ */
+export function frontDoorFromManifest(read: {
+    present: boolean;
+    manifest: Record<string, any> | null;
+}): {
+    destination: string;
+} | null;
+/**
+ * a named, non-throwing stop
+ */
+export type SourceRefusal = {
+    stop: string;
+    code: string;
+};

package/types/validate.d.ts

@@ -226,3 +226,10 @@ export function sweepNestedQuantifiers(root: any, red: (code: string, path: stri
  */
 export const CLOSE_SCRIPT_INTERPRETERS: readonly string[];
 export const SECRET_PATTERNS: RegExp[];
+/** Human-readable name for each entry in `SECRET_PATTERNS`, SAME order, SAME
+ * length — for a caller that must name WHICH shape matched (a refusal
+ * message, an audit line) without ever printing the matched text itself. Kept
+ * beside the inventory it describes rather than hand-typed at each call site,
+ * for the same reason `scanSecrets`/`redactSecrets` are: a second, drifting
+ * copy is how a name and its pattern come apart. */
+export const SECRET_PATTERN_NAMES: string[];