bareloop 0.25.1 → 0.27.0

package/src/providers.js

@@ -45,10 +45,17 @@ export const ANTHROPIC_TIER_MODELS = Object.freeze({
  * of a single-model provider, not a second model masquerading as `haiku`.
  * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
  * cheaper tier model, this is where it would earn its own `haiku` id.
+ *
+ * MODEL SWAP (F171, item 34 L16, hamr 2026-09-13): `deepseek-chat` is no
+ * longer served — a live `/models` call returned only `deepseek-flash` and
+ * `deepseek-v4-pro`. Switched to `deepseek-flash` (DeepSeek V4.1). F149's
+ * `legacyMaxTokens` measurement (asked 64 output tokens, got 665/608) was
+ * taken on `deepseek-chat` and is UNVERIFIED on `deepseek-flash` — kept on
+ * below as the fail-safe (over-capping direction is safe; see F171).
  */
 export const OPENAI_TIER_MODELS = Object.freeze({
-  sonnet: 'deepseek-chat',
-  haiku: 'deepseek-chat',
+  sonnet: 'deepseek-flash',
+  haiku: 'deepseek-flash',
 });
 
 /**
@@ -97,9 +104,14 @@ export const PROBE_STATUS = Object.freeze({
  *
  * A model with no entry here gets `{}` — bare-agent's own default
  * (`max_completion_tokens`, GPT-5-safe) applies, unmodified.
+ *
+ * F171 (2026-09-13): `deepseek-chat` was retired and swapped for
+ * `deepseek-flash` (item 34 L16). This gating was measured on
+ * `deepseek-chat` only and carried forward onto `deepseek-flash`
+ * UNVERIFIED — re-verify before any paid DeepSeek run relies on it.
  */
 const OPENAI_MODEL_OPTIONS = Object.freeze({
-  'deepseek-chat': Object.freeze({ legacyMaxTokens: true }),
+  'deepseek-flash': Object.freeze({ legacyMaxTokens: true }),
 });
 
 /**
@@ -189,6 +201,42 @@ export function resolveProvider(providerName) {
   return entry;
 }
 
+/**
+ * Report whether a resolved API key VALUE (not its presence — every call
+ * site already presence-checks separately) carries a shape an HTTP header
+ * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
+ * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
+ * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the
+ * FIRST paid call — after the run had already announced itself as spending,
+ * inside the paid span. curl tolerated the same value (HTTP 200 twice), so a
+ * curl probe is a blind instrument for this defect class.
+ *
+ * NEVER TRIMS OR REPAIRS — this reports a reason, it does not fix the value
+ * (hamr's retry-never-repair rule, in spirit: refuse loud, don't guess at
+ * what the operator's secret store meant). Every call site that gets a
+ * non-null reason back refuses at $0, in the SAME place and the SAME way it
+ * already refuses a missing key — this function only adds a second shape of
+ * refusal to a door that already had one.
+ *
+ * The checked shape is deliberately wider than what Node's own header
+ * encoder rejects (Node tolerates a bare tab in a header value): CR, LF, TAB,
+ * every other C0/DEL control character, and leading/trailing whitespace all
+ * refuse, because every one of them is evidence the resolved value is not a
+ * clean single-line secret — the same class of "reads as one plausible thing,
+ * is actually stale/wrong/multi-line" this finding named.
+ * @param {string} value the resolved key value — never logged, never echoed by any caller
+ * @returns {string|null} a plain-English reason class, or `null` when the value is clean
+ */
+export function apiKeyProblem(value) {
+  if (/[\r\n]/.test(value)) return 'contains a line break';
+  if (/\t/.test(value)) return 'contains a tab character';
+  // eslint-disable-next-line no-control-regex -- deliberately scanning C0/DEL controls
+  if (/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/.test(value)) return 'contains a control character';
+  if (value !== value.trim()) return 'has leading or trailing whitespace';
+  return null;
+}
+
 /**
  * Construct ONE provider instance for `providerName`/`model`, applying
  * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)

package/src/source.js

@@ -23,9 +23,9 @@
 // on rather than catch.
 
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { mkdir, readdir, readFile, writeFile, lstat, stat, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
-import { dirname, join, resolve, sep, basename } from 'node:path';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
+import { dirname, join, relative, resolve, sep, basename } from 'node:path';
 import { git } from './kinds.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
@@ -76,6 +76,106 @@ const MAX_SAME_DAY = 99;
 /** @param {string} code @param {string} stop @returns {SourceRefusal} */
 const refuse = (code, stop) => ({ stop, code });
 
+/**
+ * F177 / hamr's ruling (2026-09-14, option A): a `kind: 'repo'` copy's own
+ * `node_modules/` stays hidden from `changedSet` (src/kinds.js) even when the
+ * SOURCE repo's tracked `.gitignore` does not mention it — the person
+ * installs packages into the copy themselves (`missingDependencies`,
+ * `source-deps-missing`), and an unignored `node_modules` then reads as 247
+ * files of "the worker's own writes" (live-verified against a real copy of
+ * pulselog). The fix writes into the copy's PRIVATE exclude file
+ * (`.git/info/exclude`, resolved via `--git-path` rather than assumed —
+ * worktree layouts keep it in the common dir, not the per-worktree one) —
+ * never the tracked `.gitignore` — so the source repo's own files, including
+ * its `.gitignore` bytes, are never touched. Idempotent: an existing
+ * `node_modules/` line is left alone rather than duplicated.
+ *
+ * Plain folder/file/URL sources never call this — they have no `.git` of
+ * their own to carry a private exclude, and (M2b fix 6, above) their
+ * `.gitignore` is deliberately powerless over what the seed holds at all.
+ * @param {string} treeDir
+ * @returns {Promise<SourceRefusal|null>}
+ */
+async function hideNodeModulesInCopy(treeDir) {
+  const gp = await git(treeDir, ['rev-parse', '--git-path', 'info/exclude']);
+  if (!gp.ok) return refuse('source-git-failed', `git rev-parse --git-path info/exclude failed in ${treeDir}: ${gp.err}`);
+  const excludeRel = gp.out.trim().split('\n')[0].trim();
+  if (!excludeRel) return refuse('source-git-failed', `git rev-parse --git-path info/exclude returned nothing in ${treeDir}`);
+  const excludePath = join(treeDir, excludeRel);
+  await mkdir(dirname(excludePath), { recursive: true });
+  let existing = '';
+  try { existing = await readFile(excludePath, 'utf8'); } catch { /* no exclude file yet — created fresh below */ }
+  const hasLine = existing.split('\n').some((l) => l.trim() === 'node_modules/');
+  if (!hasLine) {
+    const sep = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+    await writeFile(excludePath, `${existing}${sep}node_modules/\n`);
+  }
+  return null;
+}
+
+/**
+ * Walk from `startDir` upward — inclusive — to the NEAREST ancestor whose own
+ * directory carries a `.git` entry, whether that entry is a real repo
+ * directory or a linked-worktree/submodule FILE (the caller decides what a
+ * file means for it). `null` when no ancestor up to the filesystem root has
+ * one. ONE helper for "find the repo boundary walking up", shared by
+ * {@link looksLikeRepoSource} and `prepareSource`'s own authoritative routing
+ * below (PRD item 33 M3 ruling 2 addendum, 2026-09-13: a Source that is a
+ * SUBFOLDER inside a git repo is a repo job, not a plain-folder one — the
+ * boundary is the nearest ancestor's `.git`, never only a `.git` sitting
+ * directly inside Source itself) and reused by `src/detectlang.js`'s own
+ * upward walk (`walkChain`), which only needs the boundary directory, not
+ * which kind of `.git` it is — never three copies of this rule.
+ * @param {string} startDir an absolute directory to start the walk FROM
+ * @returns {{dir: string, isFile: boolean}|null}
+ */
+export function nearestGitAncestor(startDir) {
+  let dir = resolve(startDir);
+  for (;;) {
+    const dotGit = join(dir, '.git');
+    if (existsSync(dotGit)) {
+      let isFile = false;
+      try { isFile = !lstatSync(dotGit).isDirectory(); } catch { /* raced away between exists and lstat — treated as a directory below, the pre-existing walk's own behaviour */ }
+      return { dir, isFile };
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null; // reached the filesystem root
+    dir = parent;
+  }
+}
+
+/**
+ * A CHEAP peek (a stat, never a read) at whether `source` is going to turn
+ * out to be a REPO source — the ONE rule for that question, shared by
+ * `prepareSource` (which routes the destination check below before the real
+ * walk further down decides authoritatively) and `scripts/run-interview.mjs`
+ * (PRD item 33 M3 ruling 2), which has to know BEFORE Source is even frozen
+ * whether Destination fills the write fence or a delivery directory. Never a
+ * second, hand-typed copy of this test: a URL is never a repo; a local path
+ * is a repo source only when it is a DIRECTORY, and the NEAREST ancestor
+ * (Source itself, or an ancestor above it — ruling 2's 2026-09-13 addendum)
+ * carries a `.git` DIRECTORY. A nearest `.git` that is a FILE (a linked
+ * worktree or a submodule) is NOT repo-like here — the real walk below
+ * refuses `source-is-linked-worktree` for that case, and this peek must
+ * agree closely enough to route the destination question correctly rather
+ * than offer the write-fence wording for a source that is about to be
+ * refused. An unreadable path is reported properly by the real walk; this
+ * peek only has to agree with that walk closely enough to route correctly,
+ * never to replace it.
+ * @param {string} source
+ * @returns {boolean}
+ */
+export function looksLikeRepoSource(source) {
+  if (/^https?:\/\//i.test(source)) return false;
+  try {
+    const abs = resolve(source);
+    const st = lstatSync(abs);
+    if (!st.isDirectory()) return false;
+    const found = nearestGitAncestor(abs);
+    return found !== null && !found.isFile;
+  } catch { return false; }
+}
+
 /** @param {Buffer} buf @returns {boolean} */
 function hasNulByte(buf) {
   // "first 8 KB" (PRD/M2 text) — a NUL anywhere further in a huge log-shaped
@@ -351,22 +451,14 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     return refuse('into-exists', `${intoAbs} already exists — a source door writes a FRESH tree, never reuses one (the export worktree rule)`);
   }
   const isUrl = /^https?:\/\//i.test(source);
-  // a CHEAP peek (a stat, never a read) at whether this source is going to
-  // turn out to be a repo — needed here, before the source is actually
-  // walked below, because a repo source's destination takes a DIFFERENT path
-  // (the write-fence recording above) than every other kind's (the directory
-  // proof). The real walk below makes the authoritative kind determination
-  // (and refuses source-is-linked-worktree when `.git` is a file); this peek
+  // needed here, before the source is actually walked below, because a repo
+  // source's destination takes a DIFFERENT path (the write-fence recording
+  // above) than every other kind's (the directory proof). The real walk
+  // below makes the authoritative kind determination (and refuses
+  // source-is-linked-worktree when `.git` is a file); `looksLikeRepoSource`
   // only has to agree with it closely enough to route the destination check
   // correctly, and it does — both read the same `.git` existence test.
-  let looksLikeRepoSource = false;
-  if (!isUrl) {
-    try {
-      const peekAbs = resolve(source);
-      const peekStat = await lstat(peekAbs);
-      looksLikeRepoSource = peekStat.isDirectory() && existsSync(join(peekAbs, '.git'));
-    } catch { /* an unreadable source is reported properly by the real walk below */ }
-  }
+  const isRepoLike = looksLikeRepoSource(source);
   // hamr's ruling (PRD item 33): source AND destination are proven at job
   // start, $0 — and review finding #2 sharpens WHEN: before `into` is
   // created, never after, so a refused destination leaves nothing on disk
@@ -374,7 +466,7 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   // its result). Order matters here: this runs before any source is read,
   // fetched, or walked.
   if (destination !== undefined) {
-    if (looksLikeRepoSource) {
+    if (isRepoLike) {
       if (typeof destination !== 'string' || destination.length === 0) {
         return refuse('destination-invalid', 'destination must be a non-empty value — a repo source records it as the declared write fence, wired into writeScope in a later milestone');
       }
@@ -384,7 +476,7 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     }
   }
 
-  /** @type {{kind: 'url'|'file'|'folder'|'repo', files: {rel: string, abs?: string, buf?: Buffer, symlinkTarget?: string}[], root?: string, finalUrl?: string}} */
+  /** @type {{kind: 'url'|'file'|'folder'|'repo', files: {rel: string, abs?: string, buf?: Buffer, symlinkTarget?: string}[], root?: string, finalUrl?: string, sourceSubdir?: string}} */
   let frozen;
 
   if (isUrl) {
@@ -429,22 +521,54 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
       // patients-are-copies rule), and gets the same `output/`, manifest,
       // destination and copy-out every other source gets. Its own guards
       // (the input stays untouched) arrive with M4.
-      const dotGit = join(sourceAbs, '.git');
-      let isRepo = false;
-      if (existsSync(dotGit)) {
+      //
+      // RULING 2 ADDENDUM (hamr, 2026-09-13, option A): a Source that is a
+      // SUBFOLDER inside a git repo IS a repo job — the boundary is the
+      // NEAREST ancestor's `.git`, found by walking UP from Source, never
+      // only a `.git` sitting directly inside Source itself (a monorepo
+      // package like `myrepo/packages/api` used to fall to the plain-folder
+      // path below, which has no checks yet and would hit untracked
+      // `node_modules` symlinks as a refusal, F164's class). The WHOLE
+      // repo's tracked files are frozen — `listRepoFiles(repoRoot)`, not just
+      // the subfolder — exactly as for a repo-ROOT source today.
+      const found = nearestGitAncestor(sourceAbs);
+      if (found !== null && found.isFile) {
         // a `.git` FILE (a linked worktree or a submodule) points its gitdir
         // somewhere else entirely — copying it would aim every git command,
         // the seed commit included, at the ORIGINAL repo. Refused, never
-        // followed, for the same reason a symlink is.
-        if (!(await lstat(dotGit)).isDirectory()) {
-          return refuse('source-is-linked-worktree', `${source}/.git is a file, not a directory — this is a linked worktree or a submodule, whose real git directory lives elsewhere; point the door at the repo itself (a copy would silently commit into the original)`);
-        }
-        isRepo = true;
+        // followed, for the same reason a symlink is. `found.dir` is the
+        // ancestor that actually carries the file — Source itself when
+        // Source IS that ancestor, an ancestor ABOVE Source otherwise.
+        return refuse('source-is-linked-worktree', `${found.dir}/.git is a file, not a directory — this is a linked worktree or a submodule, whose real git directory lives elsewhere; point the door at the repo itself (a copy would silently commit into the original)`);
       }
+      const isRepo = found !== null;
       if (isRepo) {
-        const walked = await listRepoFiles(sourceAbs);
+        const repoRoot = /** @type {{dir: string}} */ (found).dir;
+        const walked = await listRepoFiles(repoRoot);
         if (walked.stop !== null) return walked;
-        frozen = { kind: 'repo', root: sourceAbs, files: walked.files };
+        // Source's own path relative to the repo root — '' when Source IS
+        // the repo root, a real subpath (e.g. "packages/api") when it is a
+        // subfolder. Recorded in the manifest (below) for later use; nothing
+        // downstream reads it yet — the fence/scope wiring is a later piece.
+        const sourceSubdir = relative(repoRoot, sourceAbs).split(sep).join('/');
+        // hamr's ruling A (PRD item 34 loose end, 2026-09-13, live-proven at
+        // $0): the ruling-2 addendum above freezes the WHOLE repo whenever
+        // Source is a subfolder, but `listRepoFiles` only ever returns
+        // TRACKED paths — when the subfolder itself is gitignored or simply
+        // untracked, NONE of its own files are among them, and the freeze
+        // silently succeeds with a `kind: 'repo'` tree that holds nothing the
+        // person actually pointed Source at. Refused here, before `into` is
+        // created and before a single byte is scanned or written — a repo
+        // ROOT source (`sourceSubdir === ''`) is exempt (it always has the
+        // whole tracked tree by definition), and a subfolder with AT LEAST
+        // ONE tracked file underneath it is unaffected (that is the existing,
+        // unchanged "partially-ignored files inside a tracked folder" case).
+        if (sourceSubdir !== '' && !walked.files.some((f) => f.rel === sourceSubdir || f.rel.startsWith(`${sourceSubdir}/`))) {
+          return refuse('source-untracked-in-repo', `${sourceAbs} is inside the git repo at ${repoRoot}, but git does not track anything in it, so a repo job would not see its files — commit the files, or point Source at a folder outside the repo`);
+        }
+        frozen = {
+          kind: 'repo', root: repoRoot, files: walked.files, sourceSubdir,
+        };
       } else {
         const walked = await walkFolder(sourceAbs);
         if (walked.stop !== null) return walked;
@@ -524,17 +648,47 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     // strip the copied hooks (see NO_HOOKS above) — `force: true` because a
     // repo with no hooks configured has no `hooks/` to remove at all
     await rm(join(treeDir, '.git', 'hooks'), { recursive: true, force: true });
+    // F177: hide the copy's own future `node_modules/` before the seed is
+    // committed below — see `hideNodeModulesInCopy`'s docstring
+    const hideStop = await hideNodeModulesInCopy(treeDir);
+    if (hideStop !== null) return hideStop;
   }
   await mkdir(outputDir, { recursive: true });
   // git tracks no empty directories — a `.gitkeep` is what makes `output/`
   // actually exist in the seed commit the close measures changes against
   await writeFile(join(outputDir, '.gitkeep'), '');
-  for (const f of frozen.files) {
+  // TOCTOU close (item 34 L1, fix-ledger `src/source.js:506,537`): a folder/
+  // repo file's bytes were hashed and secret-scanned ABOVE, from one read —
+  // then re-read a SECOND time here via `copyFile`, off disk, to freeze into
+  // the tree. A file swapped on disk between the two reads would have its
+  // secret scan run against bytes different from the ones actually frozen —
+  // exactly the gap the hard line (secrets never enter the tree) exists to
+  // close. Fixed by re-verifying, not by caching every buffer: caching would
+  // hold a whole repo's bytes in memory at once (the streaming design above
+  // this loop exists precisely to avoid that for a repo source "far larger
+  // than memory"). Instead, this second read is hashed again and compared
+  // against `fileMeta`'s scan-time `sha256` (same index, same file order as
+  // the scan loop above) — a match means the bytes frozen ARE the bytes
+  // scanned; a mismatch refuses rather than silently freezing content the
+  // scan never saw. `copyFile` also preserved the source file's mode bits
+  // (verified: 0o755 in, 0o755 out; a plain `writeFile` defaults to 0o644),
+  // so the replacement chmod's the destination from a fresh `stat` to keep
+  // that behaviour unchanged.
+  for (let i = 0; i < frozen.files.length; i += 1) {
+    const f = frozen.files[i];
     const dest = join(treeDir, treeRel(f.rel));
     await mkdir(dirname(dest), { recursive: true });
-    if (f.buf) await writeFile(dest, f.buf);
-    else if (f.symlinkTarget !== undefined) await symlink(f.symlinkTarget, dest);
-    else await copyFile(/** @type {string} */ (f.abs), dest);
+    if (f.buf) { await writeFile(dest, f.buf); continue; }
+    if (f.symlinkTarget !== undefined) { await symlink(f.symlinkTarget, dest); continue; }
+    const [freshBuf, srcStat] = await Promise.all([
+      readFile(/** @type {string} */ (f.abs)),
+      stat(/** @type {string} */ (f.abs)),
+    ]);
+    if (sha256Hex(freshBuf) !== fileMeta[i].sha256) {
+      return refuse('source-changed-after-scan', `${f.rel} changed on disk after its secret scan — refused rather than freezing bytes the scan never saw (hard line #3)`);
+    }
+    await writeFile(dest, freshBuf);
+    await chmod(dest, srcStat.mode & 0o777);
   }
 
   if (frozen.kind !== 'repo') {
@@ -580,6 +734,13 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   const manifest = {
     kind: frozen.kind,
     source,
+    // Source's own path relative to the repo root (ruling 2 addendum,
+    // 2026-09-13) — '' when Source IS the repo root, a real subpath (e.g.
+    // "packages/api") when it is a subfolder frozen as part of the WHOLE
+    // repo. A NEW field beside the existing ones: `source` above keeps its
+    // existing meaning (the original Source path, untouched), and nothing
+    // downstream reads `sourceSubdir` yet — recorded here, wired later.
+    ...(frozen.sourceSubdir === undefined ? {} : { sourceSubdir: frozen.sourceSubdir }),
     ...(frozen.finalUrl === undefined ? {} : { finalUrl: frozen.finalUrl }),
     fetchedAt: new Date().toISOString(),
     files: fileMeta,
@@ -592,6 +753,102 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   return { stop: null, into: intoAbs, tree: treeDir, manifestPath, manifest };
 }
 
+/**
+ * The install command a lockfile in `dir` implies — checked in a fixed order
+ * so a tree carrying more than one lockfile still picks exactly one command,
+ * deterministically. `npm install` (no lockfile match) is the fallback, never
+ * a refusal — a repo can legally have dependencies with no committed
+ * lockfile.
+ * @type {ReadonlyArray<{file: string, command: string}>}
+ */
+const LOCKFILE_COMMANDS = Object.freeze([
+  Object.freeze({ file: 'package-lock.json', command: 'npm ci' }),
+  Object.freeze({ file: 'npm-shrinkwrap.json', command: 'npm ci' }),
+  Object.freeze({ file: 'pnpm-lock.yaml', command: 'pnpm install --frozen-lockfile' }),
+  Object.freeze({ file: 'yarn.lock', command: 'yarn install --frozen-lockfile' }),
+  Object.freeze({ file: 'bun.lockb', command: 'bun install --frozen-lockfile' }),
+  Object.freeze({ file: 'bun.lock', command: 'bun install --frozen-lockfile' }),
+]);
+
+/**
+ * THE INSTALL-GAP DETECTOR (PRD item 33 close-out, `docs/product/PRD.md:450-452`,
+ * hamr's ruling 2026-09-14, option A): `prepareSource` copies ONLY git-tracked
+ * files (hamr's ruling, `docs/product/ITEM33-BUILD.md:225-239` — unchanged by
+ * this function), so a JS/TS repo's prepared copy never carries `node_modules`,
+ * and every close stage needing a tool (`tsc`, a test runner) instrument-stops
+ * with nothing telling the person why. bareloop NEVER runs an install itself —
+ * it only ever touches gated primitives, and a shell-out to `npm`/etc from
+ * inside this module would be exactly the verb hamr's law reserves for the
+ * worker's own granted tools, never the arbiter-side machinery that decides
+ * whether a run even starts. This is a pure, $0 DETECTOR: it names the gap and
+ * the exact command a person runs THEMSELVES in the copy, then returns.
+ *
+ * JS/TS ONLY for now — a repo in another detected language returns `null`
+ * here unconditionally (no `package.json` to find), which is the correct
+ * "nothing to report" reading, not a gap in this function; per-language
+ * dependency-gap data for other languages is M3b's job
+ * (`docs/product/ITEM33-BUILD.md`, "M3b"), not this one's.
+ *
+ * SUBFOLDER-AS-REPO (ruling 2 addendum, commit 2a020d8): a subfolder job
+ * freezes the WHOLE repo, so `package.json` may sit at the repo root, at the
+ * subfolder itself, or anywhere between — the SAME nearest-manifest-walking-up
+ * rule `detectLanguage` (`src/detectlang.js`) applies, done independently here
+ * (not by importing `detectLanguage`) to avoid a `source.js` ⇄ `detectlang.js`
+ * import cycle, since `detectlang.js` already imports `nearestGitAncestor`
+ * from this module.
+ *
+ * @param {string} treeDir the prepared tree's root (`prepareSource`'s
+ *   returned `tree`, e.g. `<into>/tree` — a REPO source sits directly at this
+ *   root; every other kind sits under `input/` inside it and has no repo
+ *   dependency story yet, so callers only need this for a `kind: 'repo'`
+ *   manifest)
+ * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
+ *   undefined when Source IS the repo root)
+ * @returns {{manager: string, command: string, reason: string}|null} `null`
+ *   when there is nothing to report: no JS/TS manifest found walking up from
+ *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
+ *   `node_modules` is already there, or the manifest cannot even be read as
+ *   JSON (an invalid `package.json` is "cannot tell", never a false alarm).
+ */
+export function missingDependencies(treeDir, sourceSubdir = '') {
+  const root = resolve(treeDir);
+  let dir = sourceSubdir ? resolve(root, sourceSubdir) : root;
+  /** @type {string[]} */
+  const chain = [];
+  for (;;) {
+    chain.push(dir);
+    if (dir === root) break;
+    const parent = dirname(dir);
+    if (parent === dir) break; // filesystem root — safety only, never reachable under `root`
+    dir = parent;
+  }
+
+  for (const d of chain) {
+    const pkgPath = join(d, 'package.json');
+    if (!existsSync(pkgPath)) continue;
+    let pkg;
+    try {
+      pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    } catch {
+      return null; // cannot tell — an invalid package.json is not a fabricated gap
+    }
+    if (pkg === null || typeof pkg !== 'object' || Array.isArray(pkg)) return null;
+    const depCount = Object.keys(pkg.dependencies ?? {}).length + Object.keys(pkg.devDependencies ?? {}).length;
+    if (depCount === 0) return null; // a manifest with nothing to install is not a gap
+    if (existsSync(join(d, 'node_modules'))) return null;
+
+    const lock = LOCKFILE_COMMANDS.find((l) => existsSync(join(d, l.file)));
+    const installCmd = lock ? lock.command : 'npm install';
+    const rel = relative(root, d).split(sep).join('/');
+    return {
+      manager: installCmd.split(' ')[0],
+      command: rel === '' ? installCmd : `cd ${rel} && ${installCmd}`,
+      reason: `${rel === '' ? 'package.json' : `${rel}/package.json`} lists dependencies but the copy has no node_modules`,
+    };
+  }
+  return null;
+}
+
 /**
  * The delivered name (M2b fix 4, kept under D3): a destination FILE of
  * `/home/me/profile.md` lands as `/home/me/profile-2026-09-12.md`, and a

package/src/text.js

@@ -8,8 +8,12 @@
 // record, for the same reason again — a second writer that forgets the scrub is
 // a leak on the very trail the scrub exists to protect.
 
+import { createRequire } from 'node:module';
 import { redactSecrets } from './validate.js';
 
+const require = createRequire(import.meta.url);
+const { HaltError } = require('bare-agent');
+
 // A fence counts as the artifact's WRAPPER only when it opens within this many
 // lines of the response — the chatty-preamble shape ("Here's the fix:\n```…").
 // A fence buried deeper inside an unfenced reply is the artifact's OWN content
@@ -149,6 +153,47 @@ export function capStop({ ceilingUsd, knownUsd, spendComplete }) {
   return null;
 }
 
+/**
+ * THE ONE SPELLING of "was this throw a call casualty, or something else" —
+ * F179/F180's seam. `authorscout.js`'s `settled` narrows a rejected
+ * `loop.run()` to this one class: swallowing every throw would launder a
+ * budget `HaltError`, a programming bug, or any other named terminal into
+ * "the call failed" — the exact class of dishonesty this repo refuses (an
+ * unknown reported as a known).
+ *
+ * bare-agent 0.42.0's `OpenAIProvider.generate` used to throw a raw
+ * `SyntaxError` from an unguarded `JSON.parse(tc.function.arguments)` after
+ * a billed HTTP round (F179/BA-27) — this predicate used to admit that class
+ * too. bare-agent 0.43.0 fixed it upstream (`parseToolCalls`, shared by
+ * OpenAIProvider and Ollama): a malformed tool-call arguments string now
+ * returns a priced round with `toolCalls: []` plus its own `malformedToolCall`
+ * marker instead of throwing. Verified against 0.43.0's installed source that
+ * no provider bareloop constructs (`AnthropicProvider`, `OpenAIProvider`,
+ * `GeminiProvider` — `src/providers.js`) can still throw a JSON `SyntaxError`
+ * out of `generate()` after a billed round: Anthropic and Gemini read tool-call
+ * arguments as already-parsed objects off their own response shape (nothing to
+ * `JSON.parse`), and every provider's raw-HTTP-body parse is already
+ * try/catch-wrapped inside `_request`, converted to a plain `Error` before it
+ * can reach here. bareloop never streams a provider response. So the
+ * SyntaxError branch this predicate used to carry is dead code and was
+ * removed in the same change that bumped to bare-agent 0.43.0 — re-add it (or
+ * a narrower successor) only if a real provider is found to reintroduce the
+ * class.
+ *
+ * A `HaltError` is deliberately excluded — it is bare-agent's own governance
+ * exit (a budget/turn cap), never a transport casualty, and this predicate
+ * must never launder one into a mere "the call failed".
+ * @param {any} err
+ * @returns {string|null} a short reason when `err` is an admitted casualty class,
+ *   `null` for everything else (including `HaltError`) — the caller re-throws on `null`.
+ */
+export function callCasualty(err) {
+  if (err instanceof HaltError) return null;
+  const e = /** @type {any} */ (err);
+  if (e?.code === 'ETIMEDOUT' || e?.name === 'TimeoutError') return String(e?.message ?? e);
+  return null;
+}
+
 // ── THE RAW MODEL OUTPUT, AS A PERSISTED RECORD ─────────────────────────────
 //
 // Run mslhn707 died on a survey that broke JSON at position 1339 and left NO

package/src/validate.js

@@ -41,11 +41,34 @@ export function globToPrefix(scope) {
   return p;
 }
 
+/**
+ * Path segments a fence/scope may never contain, checked WHOLE-SEGMENT
+ * (`prefix.split('/')`), never substring — a look-alike (`.github`,
+ * `.gitignore`, `my.git`, `node_modules_util`) is a DIFFERENT name and stays
+ * admitted. hamr's ruling (option B, 2026-09-14, block both): F178 — a
+ * signed fence naming `.git` could let a worker write git's own files (refs,
+ * the seed, `info/exclude`) and hide those writes from `changedSet`. F177's
+ * follow-up — a signed fence naming `node_modules` directly is the same class
+ * of gap (an installed/worker-written file inside it is invisible to
+ * `changedSet` the same way, and installs are the person's job now, F177).
+ * This catches only a fence that NAMES one of these directly; a fence like
+ * `packages/api/**` that later reaches a NESTED `node_modules` beneath it is a
+ * distinct, only partially closeable gap — see the runtime belt in
+ * planrun.js for `node_modules` (`.git` has no such gap: there is exactly one
+ * `.git` per repo, always at the workdir root, so its own runtime belt is a
+ * single `fs.deny` entry). Both are inexpressible at declaration time, the
+ * same law #1 already applies to `..`.
+ * @type {readonly string[]}
+ */
+export const FORBIDDEN_SCOPE_SEGMENTS = Object.freeze(['.git', 'node_modules']);
+
 /**
  * A scope may never reach the arbiter's inputs (design law #1): it must
  * resolve to a PROPER subdirectory of the run directory. Absolute paths and
  * ".." segments escape it; "." / "./**" cover the whole run directory — where
  * the close suite lives. Windows spellings ("..\", "C:\") count as escapes.
+ * A `.git` or `node_modules` segment anywhere in the prefix is refused too
+ * (F178/F177, see {@link FORBIDDEN_SCOPE_SEGMENTS}).
  * Exported for the job validator: the operator's outer fence obeys the SAME
  * law through the same code — two containment transforms would be the F9
  * red-class one level up.
@@ -59,7 +82,8 @@ export function scopeContained(s) {
   // that normalizes to something absolute can never pass (defense in depth
   // against a future globToPrefix regression; the un-gameable gate, law #1).
   if (prefix === '' || prefix === '.' || prefix.startsWith('/') || /^[a-zA-Z]:/.test(prefix)) return false;
-  return prefix.split('/').every((seg) => seg !== '..');
+  const segments = prefix.split('/');
+  return segments.every((seg) => seg !== '..' && !FORBIDDEN_SCOPE_SEGMENTS.includes(seg));
 }
 
 /** Shared with the job validator — one definition of "a JSON object" for both