bareloop 0.26.0 → 0.27.0

package/types/authorflow.d.ts

@@ -254,13 +254,21 @@ export function writeScopeBlock(writeScope: string[]): string;
  * no listed check can verify — shown so the composer names the gap in its
  * own notes rather than the plan quietly reading as if everything asked for
  * is covered.
- * @param {{checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[]}} confirmed
+ * `answeredQuestions` (F175's open half, run mu0voeo4, hamr's 2026-09-16
+ * ruling) is every `Q:/A:` pair the person answered inline when a "Confirm"
+ * or "Type the goal yourself" pick forced a raised question before
+ * acceptance — BINDING, never re-decided by the composer, and a DIFFERENT
+ * meaning from `openQuestions` (which means "could not resolve"): the two
+ * never merge.
+ * @param {{checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[],
+ *   answeredQuestions?: string[]}} confirmed
  */
 export function confirmedBlock(confirmed: {
     checks: string[];
     protections: string[];
     openQuestions?: string[];
     notChecked?: string[];
+    answeredQuestions?: string[];
 }): string;
 /**
  * The whole authoring prompt, as one string.
@@ -284,7 +292,7 @@ export function confirmedBlock(confirmed: {
  *   guards: {name: string, kind: string, params: Record<string, any>, fill: string[]}[],
  *   ownedEnvNames?: string[], mode?: 'tool'|'text', catalogue?: Record<string, any>,
  *   writeScope?: string[]|null,
- *   confirmed?: {checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[]}|null}} o
+ *   confirmed?: {checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[], answeredQuestions?: string[]}|null}} o
  */
 export function authorPrompt({ answers, questions, facts, listingBlock, lang, verdictType, guards, ownedEnvNames, mode, catalogue, writeScope, confirmed, }: {
     answers: Record<string | number, string>;
@@ -308,6 +316,7 @@ export function authorPrompt({ answers, questions, facts, listingBlock, lang, ve
         protections: string[];
         openQuestions?: string[];
         notChecked?: string[];
+        answeredQuestions?: string[];
     } | null;
 }): string;
 /**
@@ -592,12 +601,20 @@ export function confirmTool(box: {
  * listing already paid for, the write fence, the detected language, "worse
  * than before" when the person gave one (repo only), and — on a fix round —
  * what the person asked to change.
+ * F183 (2026-09-16, ruling A, run mu2qmept): also carries the REAL,
+ * code-derived `protections` list ({@link confirmProtections} — the same
+ * guards the close will actually compose plus the real write fence, never a
+ * second hand-typed list) as an ALREADY COVERED block, with the instruction
+ * that anything on it never belongs in `notChecked`. Twice live (mu2bjmed,
+ * mu2qmept) the model claimed a guard or the write fence was missing while
+ * blind to what was actually enforced — this is the fix: show it the facts
+ * before it drafts, never hand-write a matcher over its answer.
  * @param {{answers: Record<string|number, string>, questions: Record<string|number, string>,
  *   labels?: Record<string|number, string>, facts?: any, listing?: string|null,
  *   writeScope?: string[]|null, isRepo: boolean, lang: string, worseThanBefore?: string,
- *   fixText?: string|null}} o
+ *   fixText?: string|null, protections?: string[]}} o
  */
-export function confirmPrompt({ answers, questions, labels, facts, listing, writeScope, isRepo, lang, worseThanBefore, fixText }: {
+export function confirmPrompt({ answers, questions, labels, facts, listing, writeScope, isRepo, lang, worseThanBefore, fixText, protections }: {
     answers: Record<string | number, string>;
     questions: Record<string | number, string>;
     labels?: Record<string | number, string>;
@@ -608,6 +625,7 @@ export function confirmPrompt({ answers, questions, labels, facts, listing, writ
     lang: string;
     worseThanBefore?: string;
     fixText?: string | null;
+    protections?: string[];
 }): string;
 /**
  * THE CONFIRM TURN: the $0 half (worse-than-before for a repo, a language
@@ -636,7 +654,7 @@ export function confirmPrompt({ answers, questions, labels, facts, listing, writ
  *   stop: null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart',
  *   rounds: number,
  *   accepted: {goal: string, checks: string[], protections: string[], lang: string,
- *     worseThanBefore: string, openQuestions: string[], notChecked: string[]}|null,
+ *     worseThanBefore: string, openQuestions: string[], notChecked: string[], answeredQuestions?: string[]}|null,
  *   reds: Red[], cost: any}>}
  */
 export function runConfirmTurn({ verdictType, answers, questions, labels, facts, listing, writeScope, isRepo, lang, generate, book, ask, onPhase, mode, worseThanBefore: presetWorseThanBefore, }: {
@@ -674,6 +692,7 @@ export function runConfirmTurn({ verdictType, answers, questions, labels, facts,
         worseThanBefore: string;
         openQuestions: string[];
         notChecked: string[];
+        answeredQuestions?: string[];
     } | null;
     reds: Red[];
     cost: any;
@@ -689,7 +708,13 @@ export function runConfirmTurn({ verdictType, answers, questions, labels, facts,
  * The return is deliberately complete rather than tidy:
  *   - `ok` is true iff a declaration passed validation and was measured;
  *   - `declaration` is the LAST ACCEPTED one, genre-env injected — the exact form
- *     that will run and that the signature will cover;
+ *     that will run and that the signature will cover; unless F176's fallback
+ *     fired (see `fellBack`), in which case it is the newest SOUND accepted one
+ *     instead — a "last accepted" close whose seed read instrument-stopped is
+ *     never handed to a signer as though it were the best close this run found;
+ *   - `fellBack` is `null` unless the fallback above fired, in which case it names
+ *     `{from, to, brokenStages}` — which iteration was dropped, which one now
+ *     stands, and which of the dropped one's stages instrument-stopped;
  *   - `reds` is what the LAST validated iteration said. `ok:true` with a non-empty
  *     `reds` means the final revision was rejected and the previous close stands:
  *     the rejection is reported, never hidden, and never silently shipped either;
@@ -717,7 +742,7 @@ export function runConfirmTurn({ verdictType, answers, questions, labels, facts,
  *   structuredMode?: 'tool'|'text', catalogue?: Record<string, any>, writeScope?: string[]|null,
  *   priorCalls?: {label: string, costUsd: number|null, unpricedRounds: number}[]|null,
  *   priorRaws?: any[]|null,
- *   confirmed?: {checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[]}|null}} o
+ *   confirmed?: {checks: string[], protections: string[], openQuestions?: string[], notChecked?: string[], answeredQuestions?: string[]}|null}} o
  */
 export function authorClose({ workdir, seedRef, lang, verdictType, answers, questions, writeScope, scout, listing, priorCalls, priorRaws, confirmed, generate, seedReadFn, closeCtx, ceilingUsd, onPhase, onCall, maxRevisions, structureRetries, structuredMode, catalogue, }: {
     workdir: string;
@@ -767,6 +792,7 @@ export function authorClose({ workdir, seedRef, lang, verdictType, answers, ques
         protections: string[];
         openQuestions?: string[];
         notChecked?: string[];
+        answeredQuestions?: string[];
     } | null;
 }): Promise<any>;
 /** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
@@ -1023,6 +1049,22 @@ export const LANGUAGE_PICK_FIELD: Readonly<{
     label: "Language";
     prompt: "This repo has more than one supported language's manifest at the same level. Which one is this job about?";
 }>;
+/**
+ * F175's open half (docs/logs/FINDINGS.md, run mu0voeo4), hamr's ruling
+ * (2026-09-16): "Confirm" and "Type the goal yourself" may not bypass a
+ * `questions` entry the model itself raised on the plan being accepted — the
+ * person answers it inline, one question at a time, with NO extra model
+ * call (the round cap and D3 are untouched). This is the `field` handed to
+ * `ask({kind: 'answer', ...})` for each forced question — `question`,
+ * `index` (1-based) and `total` ride alongside on the step itself, not on
+ * this frozen constant, because they differ per question within one turn.
+ */
+export const ANSWER_QUESTION_FIELD: Readonly<{
+    id: "answerQuestion";
+    kind: "mechanical";
+    label: "Answer";
+    prompt: string;
+}>;
 /**
  * THE CONFIRM TURN'S MENU — a structured CHOICE the person picks from after
  * each round, never free text matched against a pattern (ruling 6's "no

package/types/index.d.ts

@@ -29,4 +29,4 @@ export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalE
 export { PROMPT_REGISTERS, isPromptFile } from "./promptregisters.js";
 export { exportBundle, bundleHash, readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps } from "./bundle.js";
 export { readCloseScripts, checkCloseAbsolutePaths, absolutePathLiteralsOf, hashCloseScriptBytes, checkCloseByteSignature, checkStageByteSignature, signCloseScripts } from "./close-integrity.js";
-export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest, datedDestination, pickDelivery } from "./source.js";
+export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest, datedDestination, pickDelivery, missingDependencies } from "./source.js";

package/types/job.d.ts

@@ -4,6 +4,27 @@
  * against the worker-surface package, a locked VERDICT type is demand against
  * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
  * filed as an upstream bug (the BA-2 misattribution class). */
+/**
+ * The `baseUrl` SHAPE rule, standalone (PRD item 28 ruling (d); PRD item 33
+ * close-out, "authoring provider selectable" — a bad `--base-url` used to
+ * refuse only at the end of the interview, through `validateJob`, after every
+ * question had already been asked). ONE spelling of the rule: `validateJob`
+ * below calls this, and so does `scripts/run-interview.mjs`, at flag-parse
+ * time, before it asks anything.
+ *
+ * No network access, so this checks SHAPE only: `https://` for a real
+ * endpoint, or `http://` restricted to a loopback host (a local
+ * OpenAI-compatible server, the only legitimate reason to skip TLS) — and
+ * never a credential embedded IN the URL itself. A URL travels into logs and
+ * spine records far more casually than a header ever would, and secrets never
+ * enter the tree/spine (hard line #3) — a baseUrl carrying `user:pass@host`
+ * is exactly that leak, just spelled differently. The returned message never
+ * echoes the value it judged — it is printed as-is by both callers, and a
+ * value that failed for carrying credentials must not repeat them back.
+ * @param {unknown} value
+ * @returns {string|null} a red `detail`, or `null` when the value is admitted
+ */
+export function validateBaseUrl(value: unknown): string | null;
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
  * JSON text or plain parsed data — the ingest contract; a live object with a

package/types/planrun.d.ts

@@ -73,7 +73,6 @@
  * No gap → the empty string, so the brief renders byte-identically to the pre-F86
  * one. A labelled empty section would be an invitation to explain an absence the
  * run never observed (a stall never judged its exits at all).
- *
  * @param {string | null | undefined} gap the step's last exit gap text
  * @returns {string} the labelled block, or '' when there is nothing to show
  */
@@ -473,6 +472,47 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
     } | null | undefined;
     resumable?: boolean | undefined;
 }): Promise<string>;
+/**
+ * The runtime belt for F178 (`.git`) and F177's follow-up (`node_modules`) —
+ * hamr's option B ruling (2026-09-14): block WRITING to either, never reading.
+ * bareguard's `fs.deny` cannot be used for this: it blocks ALL fs actions,
+ * reads included (node_modules/bareguard/src/primitives/fs.js:43 "paths/
+ * prefixes denied for all fs actions", checked at :62-66 before the read/write
+ * split) — putting `.git` there (the first version of this fix) silently also
+ * blocked READING it, which was never ruled, and the worker's persona never
+ * names `.git`/`node_modules` as a denied book the way it does the gate audit
+ * / `.smoke` / `.litectx` (`tests/tools.test.js`'s persona/fence-drift guard
+ * caught exactly this in the full gate). `fs.deny` is exact prefix-containment
+ * only anyway — no glob, no path-segment match — confirmed by reading
+ * `within()` (node_modules/bareguard/src/primitives/fs.js:26-31): `p === b ||
+ * p.startsWith(b + '/')` against each configured entry, nothing else; it
+ * could not express `node_modules`-at-any-depth even if reads were not a
+ * problem (`node_modules/bareguard/src/glob.js`'s `matchAny`/`globToRegex`
+ * exist in the same package but `fs.js` never imports them).
+ *
+ * `tools.denyArgPatterns` (`node_modules/bareguard/src/primitives/tools.js`,
+ * step 3 of `Gate#_stepEval` — the SAME step `fsCheck` runs at, checked right
+ * after it in the `??` chain, `node_modules/bareguard/src/gate.js`) is the
+ * supported hook used instead: a RegExp tested against
+ * `JSON.stringify(action)`, keyed by `action.type` so it is scoped to
+ * `write`/`edit` ONLY — a `read` action never reaches this pattern at all.
+ * Because `fsCheck` runs first in the same `??` chain, this pattern is
+ * reached only when the path already passed `writeScope`/`deny` — exactly the
+ * residual case (an in-fence write/edit whose path still carries a `.git` or
+ * `node_modules` segment; `.git` itself is never IN a signed fence in the
+ * first place, `scopeContained` in src/validate.js refuses that at
+ * declaration time — this is the belt for a validator regression). Matched
+ * whole-segment (a look-alike like `.github`/`.gitignore`/`my.git`/
+ * `node_modules_util` stays admitted). Safe to match the WHOLE serialized
+ * action (not just the `path` field in isolation) because bareloop's own
+ * action shape (`toolAction`, src/tools.js) never carries a write's byte
+ * CONTENT in the action object — `args.bytes` is a length, not the text — so
+ * there is no written-file-content collision risk the way there would be for
+ * bareguard's own `content.denyPatterns` primitive (which explicitly strips
+ * payload fields for exactly that reason).
+ * @type {RegExp}
+ */
+export const FORBIDDEN_WRITE_SEGMENT_PATTERN: RegExp;
 /**
  * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
  * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a

package/types/providers.d.ts

@@ -8,6 +8,34 @@
  * @returns {ProviderTableEntry}
  */
 export function resolveProvider(providerName: string): ProviderTableEntry;
+/**
+ * Report whether a resolved API key VALUE (not its presence — every call
+ * site already presence-checks separately) carries a shape an HTTP header
+ * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
+ * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
+ * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the
+ * FIRST paid call — after the run had already announced itself as spending,
+ * inside the paid span. curl tolerated the same value (HTTP 200 twice), so a
+ * curl probe is a blind instrument for this defect class.
+ *
+ * NEVER TRIMS OR REPAIRS — this reports a reason, it does not fix the value
+ * (hamr's retry-never-repair rule, in spirit: refuse loud, don't guess at
+ * what the operator's secret store meant). Every call site that gets a
+ * non-null reason back refuses at $0, in the SAME place and the SAME way it
+ * already refuses a missing key — this function only adds a second shape of
+ * refusal to a door that already had one.
+ *
+ * The checked shape is deliberately wider than what Node's own header
+ * encoder rejects (Node tolerates a bare tab in a header value): CR, LF, TAB,
+ * every other C0/DEL control character, and leading/trailing whitespace all
+ * refuse, because every one of them is evidence the resolved value is not a
+ * clean single-line secret — the same class of "reads as one plausible thing,
+ * is actually stale/wrong/multi-line" this finding named.
+ * @param {string} value the resolved key value — never logged, never echoed by any caller
+ * @returns {string|null} a plain-English reason class, or `null` when the value is clean
+ */
+export function apiKeyProblem(value: string): string | null;
 /**
  * Construct ONE provider instance for `providerName`/`model`, applying
  * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)

package/types/source.d.ts

@@ -88,6 +88,51 @@ export function prepareSource({ source, into, destination, fetchTimeoutMs }: {
     manifestPath: string;
     manifest: object;
 } | SourceRefusal>;
+/**
+ * THE INSTALL-GAP DETECTOR (PRD item 33 close-out, `docs/product/PRD.md:450-452`,
+ * hamr's ruling 2026-09-14, option A): `prepareSource` copies ONLY git-tracked
+ * files (hamr's ruling, `docs/product/ITEM33-BUILD.md:225-239` — unchanged by
+ * this function), so a JS/TS repo's prepared copy never carries `node_modules`,
+ * and every close stage needing a tool (`tsc`, a test runner) instrument-stops
+ * with nothing telling the person why. bareloop NEVER runs an install itself —
+ * it only ever touches gated primitives, and a shell-out to `npm`/etc from
+ * inside this module would be exactly the verb hamr's law reserves for the
+ * worker's own granted tools, never the arbiter-side machinery that decides
+ * whether a run even starts. This is a pure, $0 DETECTOR: it names the gap and
+ * the exact command a person runs THEMSELVES in the copy, then returns.
+ *
+ * JS/TS ONLY for now — a repo in another detected language returns `null`
+ * here unconditionally (no `package.json` to find), which is the correct
+ * "nothing to report" reading, not a gap in this function; per-language
+ * dependency-gap data for other languages is M3b's job
+ * (`docs/product/ITEM33-BUILD.md`, "M3b"), not this one's.
+ *
+ * SUBFOLDER-AS-REPO (ruling 2 addendum, commit 2a020d8): a subfolder job
+ * freezes the WHOLE repo, so `package.json` may sit at the repo root, at the
+ * subfolder itself, or anywhere between — the SAME nearest-manifest-walking-up
+ * rule `detectLanguage` (`src/detectlang.js`) applies, done independently here
+ * (not by importing `detectLanguage`) to avoid a `source.js` ⇄ `detectlang.js`
+ * import cycle, since `detectlang.js` already imports `nearestGitAncestor`
+ * from this module.
+ *
+ * @param {string} treeDir the prepared tree's root (`prepareSource`'s
+ *   returned `tree`, e.g. `<into>/tree` — a REPO source sits directly at this
+ *   root; every other kind sits under `input/` inside it and has no repo
+ *   dependency story yet, so callers only need this for a `kind: 'repo'`
+ *   manifest)
+ * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
+ *   undefined when Source IS the repo root)
+ * @returns {{manager: string, command: string, reason: string}|null} `null`
+ *   when there is nothing to report: no JS/TS manifest found walking up from
+ *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
+ *   `node_modules` is already there, or the manifest cannot even be read as
+ *   JSON (an invalid `package.json` is "cannot tell", never a false alarm).
+ */
+export function missingDependencies(treeDir: string, sourceSubdir?: string): {
+    manager: string;
+    command: string;
+    reason: string;
+} | null;
 /**
  * The delivered name (M2b fix 4, kept under D3): a destination FILE of
  * `/home/me/profile.md` lands as `/home/me/profile-2026-09-12.md`, and a

package/types/text.d.ts

@@ -100,6 +100,41 @@ export function capStop({ ceilingUsd, knownUsd, spendComplete }: {
     knownUsd: number;
     spendComplete: boolean;
 }): "cap-halt" | "pricing-red" | null;
+/**
+ * THE ONE SPELLING of "was this throw a call casualty, or something else" —
+ * F179/F180's seam. `authorscout.js`'s `settled` narrows a rejected
+ * `loop.run()` to this one class: swallowing every throw would launder a
+ * budget `HaltError`, a programming bug, or any other named terminal into
+ * "the call failed" — the exact class of dishonesty this repo refuses (an
+ * unknown reported as a known).
+ *
+ * bare-agent 0.42.0's `OpenAIProvider.generate` used to throw a raw
+ * `SyntaxError` from an unguarded `JSON.parse(tc.function.arguments)` after
+ * a billed HTTP round (F179/BA-27) — this predicate used to admit that class
+ * too. bare-agent 0.43.0 fixed it upstream (`parseToolCalls`, shared by
+ * OpenAIProvider and Ollama): a malformed tool-call arguments string now
+ * returns a priced round with `toolCalls: []` plus its own `malformedToolCall`
+ * marker instead of throwing. Verified against 0.43.0's installed source that
+ * no provider bareloop constructs (`AnthropicProvider`, `OpenAIProvider`,
+ * `GeminiProvider` — `src/providers.js`) can still throw a JSON `SyntaxError`
+ * out of `generate()` after a billed round: Anthropic and Gemini read tool-call
+ * arguments as already-parsed objects off their own response shape (nothing to
+ * `JSON.parse`), and every provider's raw-HTTP-body parse is already
+ * try/catch-wrapped inside `_request`, converted to a plain `Error` before it
+ * can reach here. bareloop never streams a provider response. So the
+ * SyntaxError branch this predicate used to carry is dead code and was
+ * removed in the same change that bumped to bare-agent 0.43.0 — re-add it (or
+ * a narrower successor) only if a real provider is found to reintroduce the
+ * class.
+ *
+ * A `HaltError` is deliberately excluded — it is bare-agent's own governance
+ * exit (a budget/turn cap), never a transport casualty, and this predicate
+ * must never launder one into a mere "the call failed".
+ * @param {any} err
+ * @returns {string|null} a short reason when `err` is an admitted casualty class,
+ *   `null` for everything else (including `HaltError`) — the caller re-throws on `null`.
+ */
+export function callCasualty(err: any): string | null;
 /**
  * ONE raw model emission, ready to persist.
  *

package/types/validate.d.ts

@@ -13,6 +13,8 @@ export function globToPrefix(scope: string): string;
  * resolve to a PROPER subdirectory of the run directory. Absolute paths and
  * ".." segments escape it; "." / "./**" cover the whole run directory — where
  * the close suite lives. Windows spellings ("..\", "C:\") count as escapes.
+ * A `.git` or `node_modules` segment anywhere in the prefix is refused too
+ * (F178/F177, see {@link FORBIDDEN_SCOPE_SEGMENTS}).
  * Exported for the job validator: the operator's outer fence obeys the SAME
  * law through the same code — two containment transforms would be the F9
  * red-class one level up.
@@ -205,6 +207,26 @@ export function hasNestedQuantifier(src: string): boolean;
  * @param {(code: string, path: string, detail?: string) => void} red
  */
 export function sweepNestedQuantifiers(root: any, red: (code: string, path: string, detail?: string) => void): void;
+/**
+ * Path segments a fence/scope may never contain, checked WHOLE-SEGMENT
+ * (`prefix.split('/')`), never substring — a look-alike (`.github`,
+ * `.gitignore`, `my.git`, `node_modules_util`) is a DIFFERENT name and stays
+ * admitted. hamr's ruling (option B, 2026-09-14, block both): F178 — a
+ * signed fence naming `.git` could let a worker write git's own files (refs,
+ * the seed, `info/exclude`) and hide those writes from `changedSet`. F177's
+ * follow-up — a signed fence naming `node_modules` directly is the same class
+ * of gap (an installed/worker-written file inside it is invisible to
+ * `changedSet` the same way, and installs are the person's job now, F177).
+ * This catches only a fence that NAMES one of these directly; a fence like
+ * `packages/api/**` that later reaches a NESTED `node_modules` beneath it is a
+ * distinct, only partially closeable gap — see the runtime belt in
+ * planrun.js for `node_modules` (`.git` has no such gap: there is exactly one
+ * `.git` per repo, always at the workdir root, so its own runtime belt is a
+ * single `fs.deny` entry). Both are inexpressible at declaration time, the
+ * same law #1 already applies to `..`.
+ * @type {readonly string[]}
+ */
+export const FORBIDDEN_SCOPE_SEGMENTS: readonly string[];
 /**
  * PRD item 27/M2 close-bytes signature, orchestrator-flagged gap
  * (2026-09-06): a close stage's `cmd` can name an addressable script TWO