bareloop 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.29.0] — 2026-09-26
+
+### Added
+
+- **`bareloop` panel (N6/P0/P1)** — a read-only HTTP server (`bareloop panel`, bound to
+  `127.0.0.1:4700`) serving a single-page app built from one run list
+  (`~/.config/bareloop/runs.jsonl`, populated by `bareloop run`/`bareloop runs backfill`).
+  The page reads the library's own `replayRun`/spine/gate-audit functions directly, in-process
+  — the same read side `bareloop replay` uses, never a duplicated parser.
+- **Run tab: step-map + per-part cards.** A plan-shape run renders one two-line card per PART
+  (scout, plan, each step, each replan, the post-step fix loop, judge when recorded), each
+  clickable through to its own slice of the Audit tab; an old-shape (iterations, no
+  step-start) run collapses to one "run" card.
+- **Audit tab: Grouped (part → attempt → rounds table) and Flat views**, a search box
+  (matches job/runid/model), and All/Writes/Blocked filter chips that auto-open every
+  matching group.
+- **Job tab** resolves the real spec (bundle `spec.json`, `jobs/<job>.json`, or the run's own
+  job-start record) and shows Success/Guardrails/Tools/Judge-examples fields plus the full
+  granted-tools "offered" list.
+- **Run Summary** gained `model` (with provider) and `judge` lines, and a died glyph `[?]`
+  distinct from a real failed verdict `[✗]`.
+
+### Changed
+
+- **Workflows and History merged into one `Runs` tab**, toggled between a grouped-by-job
+  "Workflows" view (default) and a flat "History" view — both built from the one `/api/runs`
+  list; `/api/workflows` and the client's `listWorkflows` were deleted.
+- Audit-tab paths shorten to the run's own resolved tree root (`pathShort`) when one can be
+  found; an older run with no resolvable root keeps its full absolute path.
+
+### Fixed
+
+- **`bareloop replay`'s tool-call count was contaminated by a shared gate-audit sidecar** — a
+  sidecar file can carry rows from several runs that happen to reuse the same filename;
+  `auditWindow` now scopes every reader (CLI and panel alike) to the run's own
+  `job-start`..`job-end` window, so the two can never disagree.
+- **Panel tests bound a fixed port, flaking under a taken port** — every test now asks the OS
+  for an ephemeral port (`port: 0`) instead of guessing a free one.
+- Audit tab's "Raw log" leaked an EARLIER unrelated run's rows when a gate-audit sidecar is
+  shared across runs; it now shows only this run's own ts-windowed lines, byte-for-byte.
+- A `~2`-style backfill-collision runid (two archived spines sharing a basename in different
+  directories) echoed the wrong, unsuffixed runid in the run header and its sibling lookups.
+- `toolCalls`/`behaviour` report `null` (unknown), never a fabricated `0`, when a run has no
+  gate-audit sidecar at all.
+- Backfill scans recursively (bounded depth) instead of the top directory plus its immediate
+  subdirectories only, and dedups by resolved spine path rather than a filename-derived runid
+  (two same-basename spines in different directories are different runs, not duplicates).
+- **Workflows job (parent) row is its latest run**: clicking it opens that run (previously a
+  dead click after the Runs-tab merge); the expanded child list shows only OLDER runs, never
+  repeating the latest as its own first child; the expand caret appears only when a matching
+  older run exists under the active filters/search (not just `runCount > 1`); and the row's
+  "selected" state and click target both follow whichever run is actually active
+  (`representedRun`) — so a search hit or a History pick on an older run correctly expands
+  and highlights that run's job, instead of always marking/opening the job's latest.
+- Various Workflows/History/Audit rendering fixes: rows stay two lines and never wrap; the
+  meta-line separator carries a leading space; a died run's "why" line uses one plain
+  timestamp format; a run that died before its first step reads "0 of 0 done" (never "0 of
+  1"); the Audit tab distinguishes "no sidecar ever written" from "sidecar exists but empty";
+  History's filter chips no longer needed two clicks to register; the desktop list scrolls in
+  its own pane and mobile gets a "back to list" affordance; check-type labelling correctly
+  falls back to "deterministic" for runs that predate `verdictType` (2026-08-18); no-verdict
+  parts (scout/plan/replan/judge) render no result glyph rather than a guessed one; the Run
+  tab's step-map numbering and card order matched (F197/F198); Summary's "offered" line shows
+  the FULL granted-tools list, never truncated to the top few.
+
 ## [0.28.0] — 2026-09-24
 
 ### Added

package/bareloop.context.md

@@ -3186,6 +3186,63 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   this command reports, it never grades), `1` on a missing file/directory or a non-spine
   file, `1` with a usage line on no args.
 
+- **`bareloop runs`** / **`bareloop runs backfill <dir>`** (PANEL-BUILD.md P1, 2026-09-24
+  rulings — "one home for runs", hamr's option B) → the one run list, at `~/.config/bareloop/
+  runs.jsonl` (the same directory the keys file, PRD §7d, lives in — outside any repo tree,
+  never moved into one). This is a LIST, not a relocation: patient copies stay exactly where
+  they already are (`bareloop-patients/…` for `run-u`, `<bundleDir>/runs/<runid>/` for
+  `bareloop run`); jobs stay in `jobs/` (moving them into the home too is deferred to P3,
+  hamr picked option "A"). `bareloop runs` with no subcommand prints every listed row, one
+  line each — `job (runid) · date · spine path`, with ` — file missing` appended when the
+  row's `spine` no longer exists on disk. `bareloop runs backfill <dir>` scans `dir` and its
+  immediate subdirectories for archived spines already on disk (both the free-standing
+  layout, e.g. `<dir>/<x>/u-<id>.jsonl`, and the bundle layout, `<dir>/<x>/runs/<runid>/
+  spine.jsonl`), reusing `src/replayio.js`'s `parseJsonl`/`isSidecarByName`/`looksLikeSpine`
+  (never a second parser), and adds one row per spine whose runid is not already listed —
+  idempotent, running it twice adds nothing the second time. Prints `added N, already listed
+  M, skipped K (not a spine or unreadable)` — never silent about what it found. Read-only,
+  $0: no interview, no author, no run trigger, no key ever read. A row is `{ at, runid, job,
+  spine, patient, via }` — `spine`/`patient` are always absolute paths (`patient: null` when
+  not known, e.g. every `via:"backfill"` row: no spine record carries a run's workdir);
+  `via` is `'run-u'`, `'bundle'`, or `'backfill'`. `bareloop run-u` and `bareloop run` (the
+  bundle path) each append their own row at run START, before the first paid call — a
+  list-append failure is caught at both call sites and printed loudly to stderr
+  (`WARNING: could not add this run to ~/.config/bareloop/runs.jsonl (…)`); the run itself
+  always continues (a panel list must never block real, already-signed work). Interview/
+  author sessions are NOT added (deferred to P3 — nothing to list at that stage yet). These
+  functions (`appendRun`/`readRunList`/`backfillRuns`/`formatRunRow`, `src/runlist.js`) are
+  NOT exported from the package root — the panel's HTTP server (P1's next task) will call
+  them the same in-process way `src/cli.js` does, per the layering law
+  (`docs/product/PANEL-BUILD.md` §2), not through `bareloop`'s public API.
+
+- **`bareloop panel [--port N]`** (PANEL-BUILD.md P1) → a READ-ONLY `node:http` server
+  (no new dependency), bound to `127.0.0.1` ONLY, default port `4700`. Serves the panel's
+  look (Tokyo Night box-drawing TUI style) over the run list's real data: `GET /` the page;
+  `GET /api/runs` (newest first, each row enriched with a glyph/check-type/spend/wall
+  summary, `fileMissing:true` when the listed spine is gone — the client groups this SAME
+  list by job for the left pane's "Workflows" view and renders it flat for "History", both
+  behind one `Runs` tab toggle; there is no separate `/api/workflows` endpoint, deleted in
+  the P1 Runs-tab merge); `GET /api/runs/:runid` (the full replay — parts/steps, counters,
+  summary, model/provider/judge); `GET /api/runs/:runid/audit` (the gate-audit sidecar rows,
+  ts-windowed to this run alone even when the sidecar file is shared with other runs, plus
+  the matching raw-log text windowed the same way — when one resolves); `GET
+  /api/runs/:runid/rounds?part=&attempt=&offset=&limit=` (one attempt's rounds, lazily
+  paged, for the Audit tab's Grouped view); `GET /api/runs/:runid/job` (the signed spec's
+  own fields, ONLY when a bundle-layout run's `spec.json` is reachable — a run-u run has
+  none on disk, and this reads `resolved:false` with every spec-only field honestly
+  `'unknown'`, never guessed from the spine's own narrower `job-start` record). Every
+  endpoint is GET/HEAD only (anything else — including every write verb — is `405`); a URL
+  never joins a path segment into a filesystem read — a runid is looked up in the run list
+  first (`RUNID_RE`, `src/panel/server.js` — accepts a `~2`-style backfill-disambiguated
+  suffix too, and every endpoint echoes back the LISTED runid, never a filename-derived one
+  that can silently drop that suffix), and only the path THAT ROW stores is ever read. A
+  taken port fails loudly (names the port, exit `1`) — this command never silently tries a
+  different one. No interview, no author, no run trigger, no key/`.env` ever read on this
+  path. One more caller of `src/replayio.js`/`src/runlist.js`, in-process, per the layering
+  law (`docs/product/PANEL-BUILD.md` §2) — the panel's HTTP handler holds no flow logic of
+  its own. Chat/Settings/authoring (P3/P4) are not built yet; the page says so rather than
+  hiding the gap.
+
 - **`bareloop run-u <flags…>`** (PANEL-BUILD.md P0 task 2/4) → the person-path run flow
   (the JOBS-table/`--spec` runner, resume, the review door — `docs/logs/FINDINGS.md`'s
   U-mode). `src/cli.js`'s `run-u` dispatch hands `rest` straight to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/authorrun.js

@@ -1277,7 +1277,15 @@ export async function main(argv, deps = {}) {
       err(`  AND THE SPINE COULD NOT BE WRITTEN: ${/** @type {any} */ (spineErr)?.message ?? spineErr}`);
       err('  the error above is the only record of this run — copy it before it scrolls');
     }
-    err(`  spine ${spineFile}`);
+    // no `err(\`  spine ${spineFile}\`)` here — this catch falls through to the
+    // shared tail (`out(\`\nspine      ${spineFile}\`)\`, below), which runs on
+    // EVERY exit path including this one (nothing in finally/the tail skips it
+    // when the catch already set exitCode). A second, catch-local print here
+    // used to duplicate that line on every crash; ONE owner (the tail) now
+    // prints it, same as the refusal/failed-gate/signed-readout paths always
+    // did. (The `err('  spine …')` in the SIGINT/SIGTERM/SIGHUP handler above
+    // is a different path — a real signal re-raises and never reaches the
+    // tail, so that one stays as the sole print for a killed run.)
     // 4, distinct from 1 (a refusal or a failed gate), 2 (operator/config) and 3 (a
     // leak). A crash is none of those: it is the run failing to reach a verdict at
     // all, and sharing an exit code with a refusal would file a bug as a result.

package/src/behaviour.js

@@ -126,11 +126,14 @@ export function runBehaviour(events, { runId } = {}) {
  * Render a {@link runBehaviour} summary as the agreed printable block
  * (2–4 short lines). A zero-call run formats plainly ("0 tool calls") rather
  * than a NaN-laced percentage — an empty run is a complete, reportable
- * answer, not a division error.
- * @param {ReturnType<typeof runBehaviour>} summary
+ * answer, not a division error. `summary === null` means the caller never
+ * had a gate-audit sidecar to read at all (see `replayRun`'s `auditAvailable`
+ * option) — that reads as "unknown", never coerced to a 0-call summary.
+ * @param {ReturnType<typeof runBehaviour>|null} summary
  * @returns {string}
  */
 export function formatBehaviour(summary) {
+  if (summary === null) return 'unknown (no gate-audit sidecar found for this run)';
   const { totalCalls, byTool, denied, repeats, repeatPct } = summary; // uniquePaths: data-only, not in the agreed printed shape
   const lines = [];
 

package/src/cli.js

@@ -58,6 +58,17 @@ import {
   parseJsonl, looksLikeSpine, replayOne, listSpines, readHistoryLog,
 } from './replayio.js';
 import { formatReplay, formatAllLines } from './replay.js';
+// PANEL-BUILD.md P1 — the read-only panel HTTP server (`bareloop panel`).
+// One more caller of the same `src/` library functions this file already
+// calls (the layering law, PANEL-BUILD.md §2) — `src/panel/server.js` never
+// re-implements the spine/run-list read side, it calls `src/replayio.js`/
+// `src/runlist.js` directly, in-process.
+import { panelMain } from './panel/server.js';
+// PANEL-BUILD.md P1 (2026-09-24 rulings) — the one run list
+// (`~/.config/bareloop/runs.jsonl`) and its backfill scan. `bareloop runs`
+// (list) and `bareloop runs backfill <dir>` (reconstruct rows from archived
+// spines already on disk) are this rung's only new commands.
+import { appendRun, readRunList, backfillRuns, formatRunRow } from './runlist.js';
 
 // The tier->model tables live in `src/providers.js` now (PRD item 28's
 // factory) — one seam instead of a copy hardcoded in each runner. A
@@ -393,6 +404,23 @@ async function doRun(args, { out, err, cwd, env, now, deps }) {
   const closeDir = join(runsDir, 'close');
   mkdirSync(closeDir, { recursive: true });
 
+  // PANEL-BUILD.md P1 — one row in the run list, BEFORE the first paid call
+  // (runJob, right below). A list-append failure must never block a real,
+  // already-signed run: caught and named loudly, never rethrown.
+  // `deps.runlistHome` — the SAME test seam shape `deps.provider`/`deps.now`
+  // already are on this ctx (never a new env var, see src/runlist.js's own
+  // header comment): a caller that injects it (every test in
+  // tests/cli.test.js that reaches this line) writes its row under a temp
+  // home instead of the real `~/.config/bareloop`; production never sets it,
+  // so `appendRun` falls through to `runlistHome()`'s own `os.homedir()`.
+  try {
+    appendRun({
+      at: new Date(now()).toISOString(), runid, job: runSpec.job, spine: spineFile, patient: worktree, via: 'bundle',
+    }, { home: deps.runlistHome });
+  } catch (e) {
+    err(`WARNING: could not add this run to ~/.config/bareloop/runs.jsonl (${/** @type {Error} */ (e).message}) — the run continues; the panel's list will be missing this row.`);
+  }
+
   let outcome;
   try {
     outcome = await runJob(runSpec, {
@@ -540,6 +568,38 @@ function doReplay(args, { out, err, cwd }) {
   return 0;
 }
 
+/**
+ * `bareloop runs` — print the one run list, one line per row
+ * ({@link formatRunRow}). `bareloop runs backfill <dir>` — scan `dir` for
+ * archived spines and add a row per one not already listed
+ * ({@link backfillRuns}), printing the count added/already-listed/skipped
+ * (never silent). Read-only, $0: no interview, no author, no run trigger, no
+ * key ever read.
+ * @param {string[]} args @param {{ out: (s: string) => void, err: (s: string) => void, cwd: string }} ctx
+ */
+function doRuns(args, { out, err, cwd }) {
+  if (args[0] === 'backfill') {
+    const dirArg = args[1];
+    if (!dirArg) { err('usage: bareloop runs backfill <dir>'); return 1; }
+    const dir = resolve(cwd, dirArg);
+    if (!existsSync(dir)) { err(`no such directory: ${dir}`); return 1; }
+    let result;
+    try {
+      result = backfillRuns(dir);
+    } catch (e) {
+      err(`backfill failed: ${/** @type {Error} */ (e).message}`);
+      return 1;
+    }
+    out(`backfill ${dir}: added ${result.added}, already listed ${result.alreadyListed}, skipped ${result.skipped} (not a spine or unreadable)`);
+    return 0;
+  }
+  const { rows, skipped } = readRunList();
+  if (rows.length === 0) { out('runs: (none listed yet — see `bareloop runs backfill <dir>`)'); }
+  else for (const row of rows) out(formatRunRow(row));
+  if (skipped > 0) out(`(${skipped} malformed line${skipped === 1 ? '' : 's'} skipped)`);
+  return 0;
+}
+
 /**
  * The bare `bareloop` menu: `1 export  2 run  3 history  q quit`, then the
  * SAME code path as the sub-command, asking its args line by line. `run-u`,
@@ -556,7 +616,7 @@ async function runMenu(deps, ctx) {
   const rl = createInterface({ input: stdin, output: stdout });
   try {
     ctx.out('1 export  2 run  3 history  q quit');
-    ctx.out('(also on the command line, not wizarded here: run-u, interview, author, replay — run `bareloop <name>` with its own flags)');
+    ctx.out('(also on the command line, not wizarded here: run-u, interview, author, replay, runs, panel — run `bareloop <name>` with its own flags)');
     const choice = (await rl.question('> ')).trim().toLowerCase();
     if (choice === '' || choice === 'q' || choice === 'quit') return 0;
     if (choice === '1') {
@@ -593,7 +653,7 @@ async function runMenu(deps, ctx) {
  * code, so `bin/bareloop.mjs` can set `process.exitCode` and let node flush
  * queued stdout on its own (F-something: `process.exit()` can discard it).
  * @param {string[]} argv
- * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any }} deps
+ * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any, runlistHome?: string }} deps
  * @returns {Promise<number>}
  */
 export async function main(argv, deps = {}) {
@@ -641,6 +701,15 @@ export async function main(argv, deps = {}) {
   // seam — same shape as `doHistory`/`doExport`, not the argv-owning
   // `main(argv, deps)` modules the flows above delegate to.
   if (cmd === 'replay') return doReplay(rest, ctx);
-  err(`unknown command ${JSON.stringify(cmd)} — one of: export, run, history, run-u, interview, author, replay`);
+  // `bareloop runs` / `bareloop runs backfill <dir>` — PANEL-BUILD.md P1's
+  // one run list. Read-only ($0): no interview, no author, no run trigger,
+  // no key ever read.
+  if (cmd === 'runs') return doRuns(rest, ctx);
+  // `bareloop panel [--port N]` — PANEL-BUILD.md P1's read-only HTTP panel.
+  // Never runs a job, spends money, or reads a key: it serves the run list
+  // and spine/gate-audit reads over `127.0.0.1` only. `deps.runlistHome`
+  // rides through the same injectable seam `run`/`run-u` already use.
+  if (cmd === 'panel') return panelMain(rest, { out, err, runlistHome: deps.runlistHome });
+  err(`unknown command ${JSON.stringify(cmd)} — one of: export, run, history, run-u, interview, author, replay, runs, panel`);
   return 1;
 }